openapi: 3.1.0
info:
  title: TheHive
  version: v6.0.0
  description: |2+

    ## Get started

    This guide covers everything you need to make your first successful API call to TheHive.

    The publicly hosted API documentation reflects the latest version of TheHive. To browse the documentation that matches the version of TheHive you are running, open it from within the application: select the **?** button in the top right corner, then **API Docs**.

    The v0 API is deprecated and isn't documented. New integrations should target v1.

    ### Prerequisites

    You need a running TheHive instance and an unlocked user account.

    ### Authentication

    Almost all endpoints require authentication.

    TheHive supports two authentication methods:

    #### API key (recommended)

    Use your API key as a bearer token in the `Authorization` header.

    Generate a new API key with `POST /api/v1/user/{userId}/key/renew`, or retrieve an existing one with `GET /api/v1/user/{userId}/key`.

    If you have a [Normal user account](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/#types), you can also manage your API key in your [user settings](https://docs.strangebee.com/thehive/user-guides/manage-user-settings/#manage-your-api-key).

    curl
    ```bash
    curl -X <http_method> -H 'Authorization: Bearer <api_key>' \
      https://<thehive_host>/api/v1/<endpoint>
    ```

    python
    ```python
    import requests

    headers = {"Authorization": "Bearer <api_key>"}
    response = requests.<http_method>("https://<thehive_host>/api/v1/<endpoint>", headers=headers)
    ```

    #### Basic authentication

    Only available for [Normal user accounts](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/#types).

    Pass your login and password using HTTP Basic authentication. The login is typically an email address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication), a plain username is also accepted.

    curl
    ```bash
    curl -X <http_method> -u <login>:<password> \
      https://<thehive_host>/api/v1/<endpoint>
    ```

    python
    ```python
    import requests

    response = requests.<http_method>("https://<thehive_host>/api/v1/<endpoint>", auth=("<login>", "<password>"))
    ```

    The following endpoints are public and can be called without credentials:

    - `POST /api/v1/login`: Authenticate with login, password, and a TOTP code if MFA is enabled. Returns a session cookie used to authenticate subsequent requests.
    - `GET /api/v1/logout`: Invalidate the current session.
    - `POST /api/v1/logout`: Invalidate the current session. Same as `GET`, provided for clients that can't send `GET` requests with a body.
    - `GET /api/v1/auth/local/passwordPolicy`: Retrieve the password policy configured on the server such as minimum length or complexity requirements.
    - `GET /api/v1/status/public`: Retrieve public server information, including the TheHive version and license status, without exposing sensitive configuration.

    All other endpoints return `401 Unauthorized` when called without valid credentials.

    ### Your first API call

    Start with `GET /api/v1/user/current`: it requires no request body, confirms your credentials work, and returns your user ID.

    curl
    ```bash
    curl -X GET -H 'Authorization: Bearer <api_key>' \
         https://<thehive_host>/api/v1/user/current
    ```

    python
    ```python
    import requests

    BASE_URL = "https://<thehive_host>"
    API_KEY = "<api_key>"

    headers = {"Authorization": f"Bearer {API_KEY}"}
    response = requests.get(f"{BASE_URL}/api/v1/user/current", headers=headers)
    user = response.json()
    ```

    ### X-Organisation header

    By default, API calls target the user's default organization. The `defaultOrganisation` field returned by `GET /api/v1/user/current` tells you which one it is.

    If your account belongs to several organizations and you need to target a specific one, add the `X-Organisation` header. This is also required when performing administration actions, as these must be executed in the context of the `admin` organization.

    curl
    ```bash
    curl -H 'Authorization: Bearer <api_key>' \
         -H 'X-Organisation: <organization_name>' \
         https://<thehive_host>/api/v1/user/current
    ```

    python
    ```python
    import requests

    BASE_URL = "https://<thehive_host>"
    API_KEY = "<api_key>"

    headers = {"Authorization": f"Bearer {API_KEY}", "X-Organisation": "<organization_name>"}
    response = requests.get(f"{BASE_URL}/api/v1/user/current", headers=headers)
    user = response.json()
    ```

    ### Request and response format

    All request and response bodies use JSON: `Content-Type: application/json`.

    Dates are represented as Unix timestamps in milliseconds.

    ### How the API is organized

    TheHive exposes two kinds of endpoints.

    #### The Query API

    `POST /api/v1/query` handles all listing, filtering, sorting, and pagination needs.

    A single endpoint accepts a structured body that chains operations:

    ```json
    {
      "query": [
        { "_name": "listCase" },
        { "_name": "filter", "_eq": { "_field": "status", "_value": "Open" } },
        { "_name": "sort", "_fields": [{ "_createdAt": "desc" }] },
        { "_name": "page", "from": 0, "to": 15, "extraData": ["taskStats", "shareCount"] }
      ],
      "excludeFields": ["description", "summary"]
    }
    ```

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query reference.

    #### Standard REST endpoints

    Standard REST endpoints handle write operations and direct entity lookups.

    They follow conventional HTTP conventions:

    | <nobr>Operation </nobr>| Method | Example |
    |-----------|--------|---------|
    | <nobr>Create </nobr>| `POST` | `POST /api/v1/case` |
    | <nobr>Read </nobr>| `GET` | `GET /api/v1/case/{idOrName}` |
    | <nobr>Update </nobr>| `PATCH` | `PATCH /api/v1/case/{idOrName}` |
    | <nobr>Replace / set </nobr>| `PUT` | `PUT /api/v1/case/{caseId}/shares` |
    | <nobr>Delete </nobr>| `DELETE` | `DELETE /api/v1/case/{idOrName}` |

    ### Permissions and capabilities

    Each user account has permissions defined by their profile. TheHive checks them on every API call.

    Some endpoints are only available with a Gold, Platinum, or One license. When that's the case, the required license tier is listed on the endpoint.

    To check which license is active on your instance and what capabilities it includes, call `GET /api/v1/status`.

    ### Request size limits

    TheHive enforces the following request size limits:

    | <nobr>Request type </nobr>| Default limit | Description |
    |---|---|---|
    | <nobr>Standard API requests (JSON payloads) </nobr>| 10 MB | Maximum size for request bodies processed in memory |
    | <nobr>File uploads and attachments </nobr>| 1 GB | Maximum size for streamed request bodies written to disk |

    TheHive rejects requests that exceed these limits.

    To stay within these limits:
    - Avoid sending excessively large JSON payloads.
    - Upload large files as attachments rather than embedding data directly in requests.
    - Implement rate limiting and additional protections at the reverse proxy level when exposing the API externally.

    ### Errors

    Every endpoint returns at least the following HTTP status codes:

    | <nobr>Code </nobr>| Meaning |
    |------|---------|
    | <nobr>`400 Bad Request` </nobr>| Invalid request parameters or body |
    | <nobr>`404 Not Found` </nobr>| Resource does not exist |
    | <nobr>`500 Internal Server Error` </nobr>| Unexpected server-side error |

    Endpoints that require authentication additionally return:

    | <nobr>Code </nobr>| Meaning |
    |------|---------|
    | <nobr>`401 Unauthorized` </nobr>| Missing or invalid credentials |
    | <nobr>`403 Forbidden` </nobr>| Authenticated but insufficient permissions |

    Other codes may appear depending on the specific operation. Refer to individual endpoint documentation for the full list.

    The standard error response body is:

    ```json
    {
      "type": "AuthorizationError",
      "message": "You don't have permission to perform this action"
    }
    ```

    A small number of endpoints deviate from this format. These cases are noted in the relevant endpoint descriptions.

  x-logo:
    url: /static/logo-thehive-doc.svg
    altText: TheHive Logo
tags:
- name: Query and Export
  description: |2+

    A query is an array of chained steps that lets you search, filter, sort, and paginate data across any entity type.

    Use [`GET /api/v1/describe/{model}`](https://docs.strangebee.com/thehive/api-docs/#tag/Describe/operation/Describe%20a%20model) to discover which properties exist on a model and whether they can be filtered, sorted, or aggregated. Use [`GET /api/v1/describe/_all`](https://docs.strangebee.com/thehive/api-docs/#tag/Describe/operation/Describe%20all%20models) to get this information for every model at once.

    ### How a query works

    A query pipeline runs as follows:

    1. Start with a primary operation to define the initial entity set (required).
    2. Chain related object operations to navigate from one entity to its related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    ### Request body

    The request body accepts three fields:

    - `query` (required): an array of operation objects, each with a `_name` field identifying the operation type
    - `includeFields` (optional): an array of field names to keep in every result object, all other fields are omitted
    - `excludeFields` (optional): an array of field names to omit from every result object, ignored when `includeFields` is set

    ### Primary operations

    Primary operations are the first step in a query pipeline. Two types are available:

    - **`listXxx`**: returns all entities of that type accessible to the current user
    - **`getXxx`**: returns a single entity identified by `idOrName`—either an ID prefixed with `~` or a type-specific field

    Available primary operations depend on the entity type. See **Primary operations by entity** in the **Query API** endpoint reference.

    <details>
    <summary><strong>Examples</strong></summary>

    List all cases accessible to the current user:

    ```json
    {
      "query": [
        {"_name": "listCase"}
      ],
      "excludeFields": ["description"]
    }
    ```

    Get case `~1234` by its ID:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"}
      ],
      "excludeFields": ["description"]
    }
    ```

    </details>

    ### Related object operations

    After a primary operation, chain a related object operation to navigate to associated entities. These operations return the related entities and can themselves be followed by filter, sort, or further related object steps.

    Available related object operations depend on the entity type. See **Related object operations by entity** in the **Query API** endpoint reference.

    <details>
    <summary><strong>Examples</strong></summary>

    Get all observables across all accessible cases:

    ```json
    {
      "query": [
        {"_name": "listCase"},
        {"_name": "observables"}
      ],
      "excludeFields": ["description"]
    }
    ```

    Get the task logs of case `~1234`:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "tasks"},
        {"_name": "logs"}
      ],
      "excludeFields": ["description"]
    }
    ```

    </details>

    ### Filter operation

    Use `"_name": "filter"` to narrow the current result set.

    Available filters:

    | <nobr>Filter </nobr> | <nobr>Syntax </nobr> | Description |
    |---|---|---|
    | <nobr>`_and`</nobr> | `{"_and": [...other filters]}` | All conditions must match |
    | <nobr>`_or`</nobr> | `{"_or": [...other filters]}` | At least one condition must match |
    | <nobr>`_not`</nobr> | `{"_not": { other filter }}` | Condition must not match |
    | <nobr>`_any`</nobr> | `{"_any": null}` | Matches any entity |
    | <nobr>`_lt`</nobr> | `{"_lt": {"_field": "<field>", "_value": <value>}}` | Less than |
    | <nobr>`_gt`</nobr> | `{"_gt": {"_field": "<field>", "_value": <value>}}` | Greater than |
    | <nobr>`_lte`</nobr> | `{"_lte": {"_field": "<field>", "_value": <value>}}` | Less than or equal |
    | <nobr>`_gte`</nobr> | `{"_gte": {"_field": "<field>", "_value": <value>}}` | Greater than or equal |
    | <nobr>`_ne`</nobr> | `{"_ne": {"_field": "<field>", "_value": <value>}}` | Not equal |
    | <nobr>`_eq`</nobr> | `{"_eq": {"_field": "<field>", "_value": <value>}}` | Equal |
    | <nobr>`_is`</nobr> | `{"_is": {"_field": "<field>", "_value": <value>}}` | Same as `_eq` |
    | <nobr>`_startsWith`</nobr> | `{"_startsWith": {"_field": "<field>", "_value": "<value>"}}` | String starts with |
    | <nobr>`_endsWith`</nobr> | `{"_endsWith": {"_field": "<field>", "_value": "<value>"}}` | String ends with |
    | <nobr>`_id`</nobr> | `{"_id": "~<id>"}` | Filter by ID |
    | <nobr>`_between`</nobr> | `{"_between": {"_field": "<field>", "_from": <from>, "_to": <to>}}` | Range filter. `_from` is inclusive, `_to` is exclusive. Both are required |
    | <nobr>`_in`</nobr> | `{"_in": {"_field": "<field>", "_values": [<value1>, ...]}}` | Field matches one of the given values |
    | <nobr>`_has`</nobr> | `{"_has": "<field>"}` | The object has this field |
    | <nobr>`_like`</nobr> | `{"_like": {"_field": "<field>", "_value": "<value>"}}` | Field (or a word, depending on the index type) contains the substring |
    | <nobr>`_match`</nobr> | `{"_match": {"_field": "<field>", "_value": "<value>"}}` | Field contains the word |
    | <nobr>`_contains` *(deprecated)*</nobr> | `{"_contains": "<field>"}` | Replaced by `_has` |

    <details>
    <summary><strong>Examples</strong></summary>

    Filter the case list to keep only high-severity cases:

    ```json
    {
      "query": [
        {"_name": "listCase"},
        {
          "_name": "filter",
          "_eq": {"_field": "severity", "_value": 3}
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    Get the tasks of case `~1234` that are still in progress:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "tasks"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "InProgress"}
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    </details>

    ### Sort operation

    Use `"_name": "sort"` with a `_fields` array to order results. `direction` is one of `asc` or `desc`.

    <details>
    <summary><strong>Examples</strong></summary>

    Sort the high-severity cases by creation date, newest first:

    ```json
    {
      "query": [
        {"_name": "listCase"},
        {
          "_name": "filter",
          "_eq": {"_field": "severity", "_value": 3}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    Sort the in-progress tasks of case `~1234` by due date, earliest first:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "tasks"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "InProgress"}
        },
        {
          "_name": "sort",
          "_fields": [{"dueDate": "asc"}]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    </details>

    ### Pagination and extraData

    Use `"_name": "page"` as the last step to paginate results and request computed fields.

    Not every operation supports `page`. Some return a value that's already final and accept no further step at all. For the rest, leaving off the last step already renders the full and unpaginated result of the current traversal, without `extraData` or the `X-Total` total count. Adding `"_name": "output"` as the last step makes that intent explicit without changing the response.

    TheHive adds an `extraData` object to each result containing the requested computed fields. Available values depend on the entity type. See **Extra data by entity** in the **Query API** endpoint reference.

    Include `"total"` in `extraData` to receive the total number of matching results in the `X-Total` response header.

    <details>
    <summary><strong>Examples</strong></summary>

    Get the first 10 high-severity cases (sorted by creation date, newest first), with task statistics, share count, and the total in the response header:

    ```json
    {
      "query": [
        {"_name": "listCase"},
        {
          "_name": "filter",
          "_eq": {"_field": "severity", "_value": 3}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["taskStats", "shareCount", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    Get the first 5 in-progress tasks of case `~1234` (sorted by due date, earliest first), with the assigned case template:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "tasks"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "InProgress"}
        },
        {
          "_name": "sort",
          "_fields": [{"dueDate": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["caseTemplate", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    </details>

    ### Date filter values

    Date fields accept two formats.

    #### Timestamp

    A numeric value in milliseconds since the Unix epoch. Available with: `_lt`, `_gt`, `_lte`, `_gte`, `_ne`, `_eq`, `_between`, `_in`.

    ```json
    "_gte": {
      "_field": "_createdAt",
      "_value": 1734425224596
    }
    ```

    #### JSON (relative date)

    A JSON object expressing a date relative to now. Available with: `_lt`, `_gt`, `_lte`, `_gte`, `_between`.

    | <nobr>Field </nobr>| Required | Type | Value |
    |---|---|---|---|
    | <nobr>`amount`</nobr> | Yes | int | >= 0 |
    | <nobr>`unit`</nobr> | Yes | string | `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` |
    | <nobr>`look`</nobr> | Yes | string | `behind`, `ahead` |
    | <nobr>`timezone`</nobr> | No | string | Time zone ID. Defaults to the system time zone. |
    | <nobr>`modifier`</nobr> | No | string | `startOfDay` (sets time to `00:00:00`), `endOfDay` (sets time to `23:59:59.999999999`) |

    `now` represents the same point in time regardless of time zone. When `modifier` is set, the resulting time depends on the time zone. Use `timezone` and `modifier` together to get predictable results.

    <details>
    <summary><strong>Examples</strong></summary>

    Fetches data created yesterday:

    ```json
    {
      "_name": "filter",
      "_between": {
        "_field": "_createdAt",
        "_from": {"amount": 1, "unit": "days", "look": "behind", "modifier": "startOfDay"},
        "_to":   {"amount": 1, "unit": "days", "look": "behind", "modifier": "endOfDay"}
      }
    }
    ```

    Fetches data created today:

    ```json
    {
      "_name": "filter",
      "_gt": {
        "_field": "_createdAt",
        "_value": {"amount": 0, "unit": "days", "look": "behind", "modifier": "startOfDay"}
      }
    }
    ```

    Fetches data created in the last six months in a specific time zone:

    ```json
    {
      "_name": "filter",
      "_between": {
        "_field": "_createdAt",
        "_from": {"amount": 6, "unit": "months", "look": "behind", "timezone": "Australia/Darwin", "modifier": "startOfDay"},
        "_to":   {"amount": 0, "unit": "days",   "look": "behind"}
      }
    }
    ```

    </details>

    ### Exporting query results

    Two companion endpoints reuse the same query pipeline to produce downloadable files:

    - **Export API** (`GET /api/v1/export`): runs a query and streams the results back as CSV, JSON, TXT, or MISP. The query and the export options are both passed as stringified JSON, in the `query` and `options` URL parameters.
    - **Get export fields** (`GET /api/v1/export/_fields`): lists the field paths available per model. Use it to populate the `fields` option of a CSV export.

    See the **Export API** and **Get export fields** endpoint references for the full set of options and output formats.

- name: Describe
  description: |
    Describe endpoints return metadata about entity models: their
    properties, each property's data type, cardinality, whether
    it's aggregable, its index type, and, for enumerated properties,
    the list of allowed values.

    Use them to discover which fields you can reference in `filter`,
    `sort`, or aggregation steps when building a query with the
    [Query endpoint](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API).
- name: Audit
  description: |
    An audit log entry records a single create, update, delete, merge, or
    function invocation performed in TheHive, capturing the action, the
    user who performed it, and the affected objects. TheHive displays
    them in the case and alert **History** tabs, and shows the most
    recent key events in the Live Feed.

    You can identify an audit log entry by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve audit log entries with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial audit log entry set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the 10 most recent `update` actions on case `~327925760`,
    sorted by creation date newest first, and include the total count
    in the response:

    ```json
    {
      "query": [
        {"_name": "listAuditFromObject", "id": "~327925760"},
        {
          "_name": "filter",
          "_eq": {"_field": "action", "_value": "update"}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["details"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`getAudit` </nobr>| Gets a single audit log entry by ID |
    | <nobr>`listAuditFromObject` </nobr>| Lists audit log entries for a specific object, identified by its ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Case
  description: |
    A case is the primary investigation entity in TheHive.
    It centralizes all data gathered during a security incident response,
    including tasks, observables, procedures, comments, and attachments.

    You can identify a case by its `_id` or its `number`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve cases with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial case set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five `InProgress` tasks of case `~1234`, sorted by due date,
    and include the case template and the total count in the response:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "tasks"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "InProgress"}
        },
        {
          "_name": "sort",
          "_fields": [{"dueDate": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["caseTemplate", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCase` </nobr>| Lists all cases accessible to the current user |
    | <nobr>`getCase` </nobr>| Gets a single case by ID or case number |
    | <nobr>`countCase` *(deprecated)* </nobr>| Counts cases accessible to the current user. Replaced by `[{"_name": "listCase"}, {"_name": "count"}]`. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`tasks` </nobr>| Tasks of the case |
    | <nobr>`taskGroups` </nobr>| Distinct task group names in the case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`observables` </nobr>| Observables of the case |
    | <nobr>`alerts` </nobr>| Alerts merged into the case |
    | <nobr>`shares` </nobr>| Sharing configurations of the case |
    | <nobr>`organisations` </nobr>| Organizations the case is shared with |
    | <nobr>`procedures` </nobr>| Procedures (TTPs) attached to the case |
    | <nobr>`pages` </nobr>| Pages attached to the case |
    | <nobr>`attachments` </nobr>| Attachments of the case |
    | <nobr>`comments` </nobr>| Comments on the case |
    | <nobr>`allComments` </nobr>| Comments on the case and on its merged alerts |
    | <nobr>`assignableUsers` </nobr>| Users who can be assigned to the case |
    | <nobr>`similarCasesLight` </nobr>| Cases sharing observables with this case, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarCaseLightCount` </nobr>| Number of cases sharing observables with this case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarAlertsLight` </nobr>| Alerts sharing observables with this case, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarAlertLightCount` </nobr>| Number of alerts sharing observables with this case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarCases` *(deprecated)* </nobr>| Use `similarCasesLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarAlerts` *(deprecated)* </nobr>| Use `similarAlertsLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`similarAlertCount` *(deprecated)* </nobr>| Use `similarAlertLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`linkedCases` *(deprecated)* </nobr>| Alias for `similarCases`. Use `similarCasesLight` instead. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`linkedCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`customEvents` </nobr>| Custom events attached to the case in the timeline |
    | <nobr>`caseReports` </nobr>| Case reports of the case |
    | <nobr>`timeline` </nobr>| Activity timeline of the case |
    | <nobr>`actions` </nobr>| Cortex responder executions run on the case |
    | <nobr>`external` </nobr>| Restricts the result set to external-access cases ([TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/)). Requires a Platinum or One license. |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`observableStats` </nobr>| Statistics about observables in the case |
    | <nobr>`taskStats` </nobr>| Statistics about tasks in the case |
    | <nobr>`alerts` </nobr>| Alerts linked to the case |
    | <nobr>`alertCount` </nobr>| Number of alerts linked to the case |
    | <nobr>`isOwner` </nobr>| Whether the requesting organization owns the case |
    | <nobr>`shareCount` </nobr>| Number of organizations the case is shared with |
    | <nobr>`permissions` </nobr>| Permissions the current user has on the case |
    | <nobr>`actionRequired` </nobr>| Whether an action is required from the current user |
    | <nobr>`procedureCount` </nobr>| Number of procedures (TTPs) attached to the case |
    | <nobr>`attachmentCount` </nobr>| Number of attachments in the case |
    | <nobr>`contributors` </nobr>| Users who have contributed to the case |
    | <nobr>`computed.handlingDuration` </nobr>| Time elapsed from case creation to close (in milliseconds) |
    | <nobr>`computed.handlingDurationInSeconds` </nobr>| Handling duration in seconds |
    | <nobr>`computed.handlingDurationInMinutes` </nobr>| Handling duration in minutes |
    | <nobr>`computed.handlingDurationInHours` </nobr>| Handling duration in hours |
    | <nobr>`computed.handlingDurationInDays` </nobr>| Handling duration in days |
    | <nobr>`status` </nobr>| Status object with stage and color |
    | <nobr>`owningOrganisation` </nobr>| Organization that owns the case |
    | <nobr>`links` </nobr>| Cases linked to this case |
- name: CaseStatus
  description: |
    A case status represents the current state of a case and belongs to
    one of three stages: *New*, *In progress*, or *Closed*. A status in
    the *Closed* stage can also require an impact, so you can't close a
    case with it unless you provide an `impactStatus`.

    Creating, updating, and deleting case statuses requires the
    `managePlatform` permission. Call these endpoints with the
    `X-Organisation: admin` header to target the `admin` organization.

    You can identify a case status by its `_id` or `value`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve case statuses with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial case status set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 *In progress* case statuses sorted by order,
    and include the total count and deletion eligibility in the response:

    ```json
    {
      "query": [
        {"_name": "listCaseStatus"},
        {
          "_name": "filter",
          "_eq": {"_field": "stage", "_value": "InProgress"}
        },
        {
          "_name": "sort",
          "_fields": [{"order": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total", "canDelete"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCaseStatus` </nobr>| Lists all case statuses available in the organization |
    | <nobr>`getCaseStatus` </nobr>| Gets a single case status by ID or value |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`canDelete` </nobr>| Whether the status can be deleted. Returns `false` for predefined TheHive statuses and for statuses still assigned to cases |
- name: Alert
  description: |
    An alert is a security event generated by external detection tools such as SIEM, EDR,
    or threat intelligence platforms. Alerts are triaged and either closed or escalated
    into cases for further investigation.

    You can identify an alert by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve alerts with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial alert set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 *New* alerts sorted by event date, and include the related
    case and procedure count in the response:

    ```json
    {
      "query": [
        {"_name": "listAlert"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "New"}
        },
        {
          "_name": "sort",
          "_fields": [{"date": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["relatedCase", "procedureCount", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listAlert` </nobr>| Lists all alerts visible to the current user |
    | <nobr>`getAlert` </nobr>| Gets a single alert by ID or alert reference (`type;source;sourceRef`) |
    | <nobr>`countAlert` *(deprecated)* </nobr>| Counts alerts accessible to the current user. Replaced by `[{"_name": "listAlert"}, {"_name": "count"}]`. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`countUnreadAlert` *(deprecated)* </nobr>| Counts alerts with stage *New*. Replaced by a `listAlert`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`countImportedAlert` *(deprecated)* </nobr>| Counts alerts with stage *Imported*. Replaced by a `listAlert`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`countRelatedAlert` *(deprecated)* </nobr>| Counts alerts related to a given case. Replaced by a `listAlert` + `filter` + `count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`observables` </nobr>| Observables attached to the alert |
    | <nobr>`case` </nobr>| Case linked to the alert |
    | <nobr>`attachments` </nobr>| Attachments of the alert |
    | <nobr>`assignableUsers` </nobr>| Users who can be assigned to the alert |
    | <nobr>`procedures` </nobr>| Procedures (TTPs) linked to the alert |
    | <nobr>`comments` </nobr>| Comments on the alert |
     <nobr>`similarCasesLight` </nobr>| Cases sharing observables with this alert, with matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarCaseLightCount` </nobr>| Number of cases sharing observables with this alert. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarAlertsLight` </nobr>| Alerts sharing observables with this alert, with matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarAlertLightCount` </nobr>| Number of alerts sharing observables with this alert. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarCases` *(deprecated)* </nobr>| Use `similarCasesLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarAlerts` *(deprecated)* </nobr>| Use `similarAlertsLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
     <nobr>`similarAlertCount` *(deprecated)* </nobr>| Use `similarAlertLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`actions` </nobr>| Cortex responder executions run on the alert |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`importDate` </nobr>| Date the alert was merged into a case |
    | <nobr>`relatedCase` </nobr>| Case linked to this alert, including `number`, `accessKind`, and `isVisible` sub-fields |
    | <nobr>`status` </nobr>| Status object with stage and color |
    | <nobr>`procedureCount` </nobr>| Number of procedures (TTPs) linked to the alert |
    | <nobr>`caseNumber` *(deprecated)* </nobr>| Use `relatedCase.number` instead |
- name: AlertStatus
  description: |
    An alert status represents the current state of an alert and belongs
    to one of four stages: *New*, *In progress*, *Closed*, or *Imported*.

    Creating, updating, and deleting alert statuses requires the
    `managePlatform` permission. Call these endpoints with the
    `X-Organisation: admin` header to target the `admin` organization.

    You can identify an alert status by its `_id` or `value`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve alert statuses with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial alert status set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 *In progress* alert statuses sorted by order,
    and include the total count and deletion eligibility in the response:

    ```json
    {
      "query": [
        {"_name": "listAlertStatus"},
        {
          "_name": "filter",
          "_eq": {"_field": "stage", "_value": "InProgress"}
        },
        {
          "_name": "sort",
          "_fields": [{"order": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total", "canDelete"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listAlertStatus` </nobr>| Lists all alert statuses available in the organization |
    | <nobr>`getAlertStatus` </nobr>| Gets a single alert status by ID or value |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`canDelete` </nobr>| Whether the status can be deleted. Returns `false` for predefined TheHive statuses and for statuses still assigned to alerts |
- name: Task
  description: |
    A task is a unit of work tracked within a case.
    Tasks organize investigative activities, track ownership and completion
    status, and can be grouped by category.

    You can identify a task by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve tasks with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial task set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five flagged case tasks, sorted by due date,
    with action status and case ID included:

    ```json
    {
      "query": [
        {"_name": "listTask"},
        {"_name": "inCase"},
        {
          "_name": "filter",
          "_eq": {"_field": "flag", "_value": true}
        },
        {
          "_name": "sort",
          "_fields": [{"dueDate": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["actionRequired", "caseId"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listTask` </nobr>| Lists all tasks accessible to the current user |
    | <nobr>`listCaseTask` </nobr>| Lists tasks linked to cases (excludes case-template tasks) |
    | <nobr>`getTask` </nobr>| Gets a single task by ID |
    | <nobr>`waitingTasks` </nobr>| Lists tasks with status `Waiting` linked to cases |
    | <nobr>`myTasks` </nobr>| Lists tasks assigned to the current user |
    | <nobr>`waitingTask` *(deprecated)* </nobr>| Alias for `waitingTasks` |
    | <nobr>`countTask` *(deprecated)* </nobr>| Counts non-cancelled tasks for a given case. Replaced by a `listTask`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`assignableUsers` </nobr>| Users who can be assigned to the task |
    | <nobr>`logs` </nobr>| Task logs of the task |
    | <nobr>`case` </nobr>| Case the task belongs to |
    | <nobr>`caseTemplate` </nobr>| Case template the task originates from |
    | <nobr>`organisations` </nobr>| Organizations the task is shared with |
    | <nobr>`shares` </nobr>| Sharing configurations of the task |
    | <nobr>`inCase` </nobr>| Restricts the result set to tasks linked to a case (excludes case-template tasks) |
    | <nobr>`actions` </nobr>| Cortex responder executions run on the task |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`case` </nobr>| Case the task belongs to |
    | <nobr>`caseId` </nobr>| ID of the case the task belongs to |
    | <nobr>`caseTemplate` </nobr>| Case template the task originates from |
    | <nobr>`caseTemplateId` </nobr>| ID of the case template |
    | <nobr>`isOwner` </nobr>| Whether the requesting organization owns the task |
    | <nobr>`shareCount` </nobr>| Number of organizations the task is shared with |
    | <nobr>`actionRequired` </nobr>| Whether an action is required on the task |
    | <nobr>`actionRequiredMap` </nobr>| Map of organizations requiring action on the task |
    | <nobr>`logCount` </nobr>| Number of logs in the task |
- name: Observable
  description: |
    Observables are data points tracked within cases and alerts that
    represent specific events or indicators of suspicious or malicious
    activity. They include IP addresses, domain names, file hashes,
    URLs, and other artifacts used for threat correlation and enrichment
    by Cortex analyzers.

    You can identify an observable by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve observables with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial observable set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five IOC observables, sorted by creation date,
    with seen-summary and share count included:

    ```json
    {
      "query": [
        {"_name": "listObservable"},
        {
          "_name": "filter",
          "_eq": {"_field": "ioc", "_value": true}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["seenSummary", "shareCount"]
        }
      ],
      "excludeFields": ["reports"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listObservable` </nobr>| Lists all observables accessible to the current user |
    | <nobr>`getObservable` </nobr>| Gets a single observable by ID |
    | <nobr>`countCaseObservable` *(deprecated)* </nobr>| Counts observables of a given case. Replaced by a `listObservable`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
    | <nobr>`countAlertObservable` *(deprecated)* </nobr>| Counts observables of a given alert. Replaced by a `listObservable`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`case` </nobr>| Case the observable belongs to |
    | <nobr>`alert` </nobr>| Alert the observable belongs to |
    | <nobr>`shares` </nobr>| Sharing configurations of the observable |
    | <nobr>`organisations` </nobr>| Organizations the observable is shared with |
    | <nobr>`similar` </nobr>| Observables similar to this one |
    | <nobr>`attachments` </nobr>| Attachments of the observable |
    | <nobr>`jobs` </nobr>| Cortex analysis jobs run on the observable |
    | <nobr>`actions` </nobr>| Cortex responder executions run on the observable |
    | <nobr>`fromCase` </nobr>| Restricts the result set to observables attached to a case |
    | <nobr>`fromAlert` </nobr>| Restricts the result set to observables attached to an alert |
    | <nobr>`fromJobReport` </nobr>| Restricts the result set to observables produced by a Cortex analyzer report |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`seen` *(deprecated)* </nobr>| Whether the observable has been seen in other cases |
    | <nobr>`seenSummary` </nobr>| Summary of cases where the observable appears |
    | <nobr>`shares` </nobr>| Organizations the observable is shared with |
    | <nobr>`links` </nobr>| Observables linked to this one |
    | <nobr>`permissions` </nobr>| Permissions the current user has on the observable |
    | <nobr>`isOwner` </nobr>| Whether the requesting organization owns the observable |
    | <nobr>`shareCount` </nobr>| Number of organizations the observable is shared with |
- name: CustomField
  description: |
    Custom fields are additional fields that enrich cases and
    alerts in TheHive. An admin must first create a custom
    field and define its type. Several types are available:

      - `string`
      - `integer`
      - `float`
      - `boolean`
      - `date`
      - `url`


    Once created, a custom field is available on any object that
    has a `customFields` field.

    The two formats differ in behavior:

    - JSON object — adds or updates the specified fields and
      leaves all other existing custom field values untouched.
      Display order is not controllable with this format.
    - JSON array — replaces the entire set of custom field
      values, removing any value not included in the array. Use
      the `order` field to control the display order of each value.

    Multi-values are supported by repeating the entry in the array
    format, or by passing an array of values in the object format.

    JSON object example:

    ```json
    {
      "customFields": {
        "threat-type": "Malware",
        "detection-source": ["EDR", "SIEM"]
      }
    }
    ```

    JSON array example:

    ```json
    {
      "customFields": [
        {"name": "threat-type", "value": "Malware", "order": 0},
        {"name": "detection-source", "value": "EDR", "order": 1},
        {"name": "detection-source", "value": "SIEM", "order": 2}
      ]
    }
    ```

    You can identify a custom field by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve custom fields with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial custom field set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five custom fields in the `Classification`
    group, sorted by name, and include whether each field is
    deletable and the total count:

    ```json
    {
      "query": [
        {"_name": "listCustomField"},
        {
          "_name": "filter",
          "_eq": {"_field": "group", "_value": "Classification"}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["deletable", "total"]
        }
      ],
      "excludeFields": ["options"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCustomField` </nobr>| Lists all custom fields |
    | <nobr>`getCustomField` </nobr>| Gets a custom field by ID or name |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`deletable` </nobr>| Whether the custom field can be deleted |
- name: Comment
  description: |+
    Comments are short conversational notes attached to cases and alerts.
    Unlike pages, which are structured Markdown documents, comments are
    intended for real-time communication: documenting investigation progress,
    sharing findings with team members, or recording triage decisions.

    You can identify a comment by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve comments with
    filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial comment set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the 10 most recent comments created by `lucas@example.com`, and
    include their parent case or alert link and total count in the response:

    ```json
    {
      "query": [
        {"_name": "listComment"},
        {
          "_name": "filter",
          "_eq": {"_field": "_createdBy", "_value": "lucas@example.com"}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["links", "total"]
        }
      ],
      "excludeFields": ["message"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listComment` </nobr>| Lists all comments accessible to the current user |
    | <nobr>`getComment` </nobr>| Gets a single comment by ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`links` </nobr>| Case or alert the comment belongs to |

- name: Task Log
  description: |
    A task log—also referred to as an activity—records actions,
    observations, and decisions made in response to a task.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve task logs with
    filtering, sorting, or pagination.

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the ten most recent logs created by
    `alice@example.com`, sorted by date, and include the
    associated case and action count:

    ```json
    {
      "query": [
        {"_name": "listLog"},
        {
          "_name": "filter",
          "_eq": {"_field": "_createdBy", "_value": "alice@example.com"}
        },
        {
          "_name": "sort",
          "_fields": [{"date": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["case", "actionCount"]
        }
      ],
      "excludeFields": ["owner"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listLog` </nobr>| Lists all task logs accessible to the current user |
    | <nobr>`getLog` </nobr>| Gets a single task log by ID |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`attachments` </nobr>| Attachments of the log |
    | <nobr>`actions` </nobr>| Cortex responder executions run on the task log |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`case` </nobr>| Case the task log belongs to |
    | <nobr>`task` </nobr>| Task the log belongs to |
    | <nobr>`taskId` </nobr>| ID of the task the log belongs to |
    | <nobr>`actionCount` </nobr>| Number of actions on the task log |
- name: Timeline
  description: |
    A case timeline is a chronological view of all events that
    occurred during the case lifecycle. Events include case status
    changes, alert occurrences, task activity, flagged task logs,
    IOC sightings, TTPs occurrences, and custom events.

    Custom events can be added to mark specific milestones or
    observations not captured automatically.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve custom events with
    filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial
       custom event set (required).
    2. Chain related object operations to navigate to custom
       events of a specific case (optional).
    3. Apply filter and sort steps to narrow or order the
       results (optional).
    4. End with a page step to paginate and request computed
       extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    List the first 10 custom events starting after
    January 14, 2025, sorted by date ascending, and include
    the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listCustomEvent"},
        {
          "_name": "filter",
          "_gt": {"_field": "date", "_value": 1736849400000}
        },
        {
          "_name": "sort",
          "_fields": [{"date": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCustomEvent` </nobr>| Lists all custom events in timelines accessible to the current user |
    | <nobr>`getCustomEvent` </nobr>| Gets a single custom event from timelines by ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: TTP
  description: |
    Tactics, techniques, and procedures (TTPs) record which attack techniques
    were observed on a case or alert, when they occurred, and optionally how
    they were carried out—referred to as the procedure.
    By default, TheHive uses the [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/), but custom catalogs
    are also supported.

    The catalogs of techniques, also called patterns, and tactics are managed through the
    [**Att&ck**](https://docs.strangebee.com/thehive/api-docs/#tag/Att%26ck) endpoints.

    You can identify a TTP by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve TTPs with
    filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial TTP set
       (required).
    2. Apply filter and sort steps to narrow or order the results
       (optional).
    3. End with a page step to paginate and request computed extra
       fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 occurrences of technique `T1486`, sorted by
    occurrence date ascending, and include the technique details in the
    response:

    ```json
    {
      "query": [
        {"_name": "listProcedure"},
        {
          "_name": "filter",
          "_eq": {"_field": "patternId", "_value": "T1486"}
        },
        {
          "_name": "sort",
          "_fields": [{"occurDate": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["pattern"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listProcedure` </nobr>| Lists all procedures (TTPs) accessible to the current user |
    | <nobr>`getProcedure` </nobr>| Gets a single procedure by ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`pattern` </nobr>| Attack techniques associated with the procedure |
    | <nobr>`tactic` </nobr>| Attack tactics associated with the procedure |
    | <nobr>`patternParent` </nobr>| Parent attack technique in the hierarchy |
    | <nobr>`patternTactics` </nobr>| All tactics associated with the attack technique |
    | <nobr>`patternCatalog` </nobr>| Catalog the attack technique belongs to |
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Att&ck
  description: |
    Attack techniques, also called patterns, and tactics describe the behaviors and methods used by threat
    actors. They're organized into catalogs based on the MITRE ATT&CK framework.
    TheHive includes the [MITRE Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/) by default.

    To record a procedure associated with a tactic and technique on a case
    or alert, use the
    [**TTP**](https://docs.strangebee.com/thehive/api-docs/#tag/TTP) endpoints.

    You can identify an attack technique by its `_id` or MITRE pattern ID, and a catalog by its `_id` or `name`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve attack techniques and
    catalogs with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial entity set
       (required).
    2. Chain related object operations to navigate to related entities
       (optional).
    3. Apply filter and sort steps to narrow or order the results
       (optional).
    4. End with a page step to paginate and request computed extra
       fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 `impact` attack techniques in the
    `Enterprise Attack` catalog, sorted by pattern ID, and include
    the parent technique in the response:

    ```json
    {
      "query": [
        {"_name": "getCatalog", "idOrName": "Enterprise Attack"},
        {"_name": "patterns"},
        {
          "_name": "filter",
          "_eq": {"_field": "tactics", "_value": "impact"}
        },
        {
          "_name": "sort",
          "_fields": [{"patternId": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["parent"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Attack technique primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listPattern` </nobr>| Lists all attack techniques accessible to the current user |
    | <nobr>`getPattern` </nobr>| Gets a single attack technique by ID |

    ### Attack technique extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`parent` </nobr>| Parent attack technique in the hierarchy |
    | <nobr>`children` </nobr>| Child attack techniques in the hierarchy |
    | <nobr>`tactics` </nobr>| Tactics associated with the attack technique |
    | <nobr>`catalog` </nobr>| Catalog the attack technique belongs to |

    ### Catalog primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCatalog` </nobr>| Lists all attack technique catalogs |
    | <nobr>`getCatalog` </nobr>| Gets a single attack technique catalog by ID or name |

    ### Catalog related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`patterns` </nobr>| Techniques in the attack catalog |
    | <nobr>`tactics` </nobr>| Tactics in the attack catalog. Supports sort, filter, count, and aggregation. Doesn't support pagination, extraData, or output |

    ### Catalog extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`tactics` </nobr>| Tactics defined in the attack catalog |
- name: Views
  description: |2

    Views save the filters, sort order, displayed
    columns, and display options applied to a list, so
    you can reapply them later without rebuilding them
    each time.

    A view has a name and applies to a single list,
    identified by its entity type. A view is either:

    - Private: visible and editable only by its
      creator.
    - Shared: visible and editable by every member of
      the creator's organization.
- name: Share
  description: |+
    A share is a case-level access grant for a linked organization,
    with a permission profile and local sharing rules for tasks and
    observables. These endpoints manage per-case sharing configurations,
    distinct from the global rules set when creating and linking organizations.
    See [Organizations Sharing Rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
    for an overview.

    Use these endpoints when global sharing rules don't cover an existing case,
    or when a case needs sharing settings that differ from the global
    defaults.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve shares with
    filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial
       share configuration set (required).
    2. Chain related object operations to navigate to shares
       of a specific case (optional).
    3. Apply filter and sort steps to narrow or order the
       results (optional).
    4. End with a page step to paginate and request computed
       extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve shares of case `~4123456789` with the `analyst` profile,
    sorted by organization name, and include the total share count:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~4123456789"},
        {"_name": "shares"},
        {
          "_name": "filter",
          "_eq": {"_field": "profileName", "_value": "analyst"}
        },
        {
          "_name": "sort",
          "_fields": [{"organisationName": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["owner"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listShare` </nobr>| Lists all sharing configurations |
    | <nobr>`getShare` </nobr>| Gets a single sharing configuration by ID |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`case` </nobr>| Case associated with the share |
    | <nobr>`observables` </nobr>| Observables associated with the share |
    | <nobr>`tasks` </nobr>| Tasks associated with the share |
    | <nobr>`organisation` </nobr>| Organization associated with the share |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |

- name: Organization
  description: |+
    An organization is an independent tenant in TheHive with its own
    users, cases, and settings. A default `admin` organization provides
    global administration. [Organizations can be linked to share cases](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/),
    with configurable permission profiles and task/observable sharing
    rules.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve organizations with
    filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial
       organization set (required).
    2. Chain related object operations to navigate to related
       entities (optional).
    3. Apply filter and sort steps to narrow or order the
       results (optional).
    4. End with a page step to paginate and request computed
       extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve all unlocked organizations with their user counts,
    sorted by name:

    ```json
    {
      "query": [
        {"_name": "listOrganisation"},
        {
          "_name": "filter",
          "_not": {"_field": "locked", "_value": true}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 25,
          "extraData": ["userCount", "total"]
        }
      ]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listOrganisation` </nobr>| Lists all organizations accessible to the current user |
    | <nobr>`getOrganisation` </nobr>| Gets a single organization by ID or name |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`users` </nobr>| Users in the organization |
    | <nobr>`caseTemplates` </nobr>| Case templates of the organization |
    | <nobr>`alerts` </nobr>| Alerts of the organization |
    | <nobr>`attachments` </nobr>| Attachments of the organization |
    | <nobr>`visible` </nobr>| Restricts the result set to organizations visible to the current user |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`userCount` </nobr>| Number of users in the organization |

- name: Observable Type
  description: |
    Observable types define the category of an observable in TheHive.
    TheHive includes a predefined set of types that you can extend with custom ones.

    You can identify an observable type by its `_id` or by its `name`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve observable types with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial observable type set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    List all non-attachment observable types, sorted by name,
    and include the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listObservableType"},
        {
          "_name": "filter",
          "_eq": {"_field": "isAttachment", "_value": false}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ]
    }
    ```

    ### Primary operations

    | Operation | Description |
    |---|---|
    | <nobr>`listObservableType`</nobr> | Lists all observable types |
    | <nobr>`getObservableType`</nobr> | Gets an observable type by ID or name |

    ### Extra data

    | extraData value | Description |
    |---|---|
    | <nobr>`total`</nobr> | Total number of matching results across all pages, returned in the `X-Total` response header |
- name: User
  description: |
    You can identify a user by their `_id` or `login`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve users with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial user set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 non-locked analysts, sorted by name,
    and include their organizations and the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listUser"},
        {"_name": "filter", "_eq": {"_field": "profile", "_value": "analyst"}},
        {"_name": "filter", "_eq": {"_field": "locked", "_value": false}},
        {"_name": "sort", "_fields": [{"name": "asc"}]},
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["organisations", "total"]
        }
      ],
      "excludeFields": ["avatar"]
    }
    ```

    ### Primary operations

    | Operation | Description |
    |---|---|
    | <nobr>`listUser`</nobr> | Lists all users visible to the current user |
    | <nobr>`getUser`</nobr> | Gets a single user by ID or login |
    | <nobr>`currentUser`</nobr> | Returns the currently authenticated user |
    | <nobr>`listVisibleUsers`</nobr> | Lists users from all organizations visible to the current user |

    ### Related object operations

    | Operation | Returns |
    |---|---|
    | <nobr>`tasks`</nobr> | Tasks assigned to the user |
    | <nobr>`cases`</nobr> | Cases assigned to the user |
    | <nobr>`alerts`</nobr> | Alerts assigned to the user |

    ### Extra data

    | extraData value | Description |
    |---|---|
    | <nobr>`lockout`</nobr> | Information about authentication lockout for the user |
    | <nobr>`organisations`</nobr> | Organizations the user belongs to |
    | <nobr>`total`</nobr> | Returns the total number of matching users in the `X-Total` response header |
- name: Authentication
  description: |
    These endpoints handle authentication for TheHive: signing in
    and out, activating or deactivating multifactor authentication
    with a time-based one-time password app, and retrieving the
    password policy enforced by the local authentication provider.
- name: Page
  description: |
    Pages are structured Markdown documents for documentation within TheHive.
    Two types exist:

    - Knowledge Base pages: organization-wide, intended for long-term
      reference such as lessons learned and reports.
    - Case pages: attached to a specific case, intended for temporary
      documentation during investigations.

    You can identify a page by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve pages with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial page set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 Knowledge Base pages in the `Investigation` category,
    sorted by title, and include the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listOrganisationPage"},
        {
          "_name": "filter",
          "_eq": {"_field": "category", "_value": "Investigation"}
        },
        {
          "_name": "sort",
          "_fields": [{"title": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["content"]
    }
    ```

    ### Primary operations

    | Operation | Description |
    |---|---|
    | <nobr>`listPage` </nobr>| Lists all pages accessible to the current user, including Knowledge Base pages and case pages |
    | <nobr>`listOrganisationPage` </nobr>| Lists Knowledge Base pages of the current organization |
    | <nobr>`getPage` </nobr>| Returns a page by ID |

    ### Related object operations

    | Operation | Returns |
    |---|---|
    | <nobr>`pages` </nobr>| Case pages attached to a case |
    | <nobr>`headerPage` </nobr>| Page headers (without content) for the current page set. Experimental — breaking changes may occur in future releases. Takes `from` and `to` pagination parameters |

    ### Extra data

    | extraData value | Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results. Returned in the `X-Total` response header |
- name: PageTemplate
  description: |
    Case pages are investigation-scoped documents for sharing notes, reports, and other
    content within a case. Case page templates predefine a title, category, and Markdown
    content to reuse when adding those pages. Once created, a template is available
    to all users in the organization.

    You can identify a page template by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve page templates with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial page template set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five page templates in the *Investigation* category,
    sorted by title, and include the case template count and total result count:

    ```json
    {
      "query": [
        {"_name": "listPageTemplate"},
        {
          "_name": "filter",
          "_eq": {"_field": "category", "_value": "Investigation"}
        },
        {
          "_name": "sort",
          "_fields": [{"title": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["caseTemplateCount", "total"]
        }
      ],
      "excludeFields": ["content"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listPageTemplate` </nobr>| Lists all page templates visible to the current user in the organization |
    | <nobr>`getPageTemplate` </nobr>| Gets a single page template by ID |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`caseTemplates` </nobr>| Case templates that include the page template |
    | <nobr>`headerPage` *(experimental)* </nobr>| Page template header info, without the content field. Accepts `from`, `to`, and `extraData` pagination parameters |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`caseTemplateCount` </nobr>| Number of case templates that include this page template |
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: CaseTemplate
  description: |
    Case templates pre-fill fields when creating cases or applying templates to existing cases.
    Each template defines default values for severity, TLP, PAP, tags, tasks,
    custom fields, and pages.

    You can identify a case template by its `_id` or by its `name`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve case templates with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial case template set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 case templates whose name starts with "Ransomware",
    sorted by name, and include linked page template headers:

    ```json
    {
      "query": [
        {"_name": "listCaseTemplate"},
        {
          "_name": "filter",
          "_like": {"_field": "name", "_value": "Ransomware*"}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["pageTemplateHeaders", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCaseTemplate` </nobr>| Lists all case templates |
    | <nobr>`getCaseTemplate` </nobr>| Gets a single case template by ID or name |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`tasks` </nobr>| Task templates of the case template |
    | <nobr>`pageTemplates` </nobr>| Page templates of the case template |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`pageTemplateHeaders` </nobr>| Headers of the page templates linked to the case template |
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Taxonomy
  description: |
    Taxonomies are catalogs of structured tags used to label cases,
    alerts, and observables in TheHive. Each taxonomy groups tags
    into namespaced predicates and values following the
    [MISP taxonomy format](https://www.misp-standard.org/rfc/misp-standard-taxonomy-format.html). Taxonomy tags are shared across
    organizations and follow a predefined schema—they're distinct
    from custom free-form tags, which are created by users
    and are specific to a single organization.

    TheHive ships with a set of MISP taxonomies that aren't
    activated by default. Activate each one to make its tags
    available. You can also import custom
    taxonomies as ZIP archives containing a `machinetag.json` file.

    You can identify a taxonomy by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve taxonomies with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial taxonomy set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    The query operations below cover taxonomies only. To query
    custom tags, see the [**Tag**](https://docs.strangebee.com/thehive/api-docs/#tag/Tag) section.

    ### Example

    Retrieve the first five taxonomies whose namespace starts with `tlp`,
    sorted alphabetically, and include whether each is enabled and the
    total count:

    ```json
    {
      "query": [
        {"_name": "listTaxonomy"},
        {
          "_name": "filter",
          "_like": {"_field": "namespace", "_value": "tlp"}
        },
        {"_name": "tags"},
        {
          "_name": "sort",
          "_fields": [{"namespace": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["enabled", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listTaxonomy` </nobr>| Lists all taxonomies accessible to the current user |
    | <nobr>`getTaxonomy` </nobr>| Gets a single taxonomy by ID or namespace |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`tags` </nobr>| Tags belonging to the taxonomy |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`enabled` </nobr>| Whether the taxonomy is activated |
- name: Case Report
  description: |
    A case report is a generated document that summarizes key data from a case.
    Reports can be generated from a case report template or uploaded manually,
    and are available in the **Attachments** tab of the case once saved.

    You can identify a case report by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve case reports with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial case report set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the five most recent HTML reports for case `~1234`, sorted by
    creation date newest first, and include the total count in the response:

    ```json
    {
      "query": [
        {"_name": "getCase", "idOrName": "~1234"},
        {"_name": "caseReports"},
        {
          "_name": "filter",
          "_eq": {"_field": "contentType", "_value": "text/html"}
        },
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["total"]
        }
      ],
      "excludeFields": []
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCaseReport` </nobr>| Lists all case reports accessible to the current user |
    | <nobr>`getCaseReport` </nobr>| Gets a single case report by ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Cortex
  description: |
    A Cortex analyzer enriches an observable with contextual intelligence
    and produces a report. A Cortex responder triggers an automated action
    on a case, an alert, or a related entity, such as blocking an
    indicator on a firewall or proxy,
    or sending an email notification.

    Cortex servers are connected
    to TheHive and managed by administrators. Multiple Cortex
    servers can be connected at once, and analyzer and responder
    operations are aggregated across every Cortex server
    available to your organization.

    Analyzers and responders themselves aren't TheHive entities:
    they're queried live from the connected Cortex servers. Use
    the dedicated analyzer and responder endpoints to list them,
    such as `GET /api/v1/connector/cortex/analyzer` and
    `GET /api/v1/connector/cortex/responders/{entityType}`, or
    refer to the [Cortex API](https://docs.strangebee.com/cortex/api/api-guide/).

    However, running an analyzer creates a job, and running a
    responder creates an action. Both are TheHive entities that
    keep a record of the execution, its status, and its report,
    and both can be retrieved with [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API).

    Analyzer templates control how a job's report is rendered once
    the analyzer completes. They're also retrievable with
    [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API).

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial job, action, or analyzer template set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the jobs run on observable `~1234`, sorted by creation
    date newest first, and include the total count and rendered
    report in the response:

    ```json
    {
      "query": [
        {"_name": "getObservable", "idOrName": "~1234"},
        {"_name": "jobs"},
        {
          "_name": "sort",
          "_fields": [{"_createdAt": "desc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["total", "report"]
        }
      ],
      "excludeFields": []
    }
    ```

    ### Analyzer jobs

    #### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listJob` </nobr>| Lists all jobs accessible to the current user |
    | <nobr>`getJob` </nobr>| Gets a single job by ID |

    #### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`jobs` </nobr>| From an observable, the jobs run on it |
    | <nobr>`observable` </nobr>| From a job, the analyzed observable |
    | <nobr>`reportObservables` </nobr>| From a job, the observables extracted from its report |

    #### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`links` </nobr>| The analyzed observable, with its parent case or alert |
    | <nobr>`report` </nobr>| The job's rendered report |

    ### Responder actions

    #### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listAction` </nobr>| Lists all actions accessible to the current user |
    | <nobr>`getAction` </nobr>| Gets a single action by ID |

    #### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`actions` </nobr>| Chained after a case, an observable, a task, a task log, or an alert query, the actions run on it |

    #### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |

    ### Analyzer templates

    #### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listAnalyzerTemplate` </nobr>| Lists all analyzer templates |
    | <nobr>`getReportTemplate` </nobr>| Gets a single analyzer template by ID |

    #### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Dashboard
  description: |
    A dashboard compiles and visualizes data to give you key insights at a glance. Dashboards
    are scoped to an organization, and can be private or shared
    with the entire organization.

    You can identify a dashboard by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve dashboards with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial dashboard set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve up to ten shared dashboards, sorted by title in
    ascending order, include the total count in the response, and
    exclude the widget definition payload:

    ```json
    {
      "query": [
        {"_name": "listDashboard"},
        {
          "_name": "filter",
          "_eq": {"_field": "status", "_value": "Shared"}
        },
        {
          "_name": "sort",
          "_fields": [{"title": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["definition"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listDashboard` </nobr>| Lists all dashboards accessible to the current user |
    | <nobr>`getDashboard` </nobr>| Gets a single dashboard by ID |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Alert Feeder
  description: |
    An alert feeder retrieves data from an external system on a schedule and converts
    it into alerts using a JavaScript function. Each feeder sends periodic HTTP requests
    to an external API and transforms the response with a feeder function of type
    `feeder:alert`. A feeder can also generate cases and tasks as part of that
    transformation.

    Feeders support five authentication methods: none, HTTP Basic, API key, bearer
    token, and OAuth 2.0.

    Required license: Platinum or One
- name: Function
  description: |
    A function is a user-defined JavaScript script that processes data and calls TheHive API.
    Functions let you automate custom workflows: creating alerts from external sources,
    enriching cases, and running actions on cases or alerts without modifying the application code.

    You can identify a function by its `_id` or its `name`.

    See [About Functions](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/) for the available function types, execution modes, and trigger sources.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve functions with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial function set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 enabled functions sorted by name, and include the total count:

    ```json
    {
      "query": [
        {"_name": "listFunction"},
        {
          "_name": "filter",
          "_eq": {"_field": "mode", "_value": "Enabled"}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["definition"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listFunction` </nobr>| Lists all functions accessible to the current user |
    | <nobr>`getFunction` </nobr>| Gets a single function by ID or name |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Case Report Template
  description: |
    Case report templates define the layout used to generate reports from case descriptions.
    Each template specifies a set of widgets (like tables, lists, timelines, or text blocks),
    an optional header and footer, date formats, and language settings.

    You can identify a case report template by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve case report templates with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial case report template set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first five case report templates whose title starts with "Ransomware",
    sorted by title, and include the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listCaseReportTemplate"},
        {
          "_name": "filter",
          "_startsWith": {"_field": "title", "_value": "Ransomware"}
        },
        {
          "_name": "sort",
          "_fields": [{"title": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 5,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["definition"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listCaseReportTemplate` </nobr>| Lists all case report templates |
    | <nobr>`getCaseReportTemplate` </nobr>| Gets a single case report template by ID |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`attachments` </nobr>| Files uploaded to the template for use in `Image` widgets |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Tag
  description: |
    Tags are labels assigned to cases, alerts, and observables
    in TheHive. Tags are created in two ways: as custom free-form
    tags entered directly by users, or as taxonomy tags imported
    from a taxonomy. Custom tags are specific to a single
    organization and can't be shared between organizations or
    TheHive instances.

    You can identify a tag by its `_id`.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve tags with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial tag set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    The query operations below cover custom tags only. To query
    taxonomy tags, see the [**Taxonomy**](https://docs.strangebee.com/thehive/api-docs/#tag/Taxonomy) section.

    ### Example

    Retrieve the custom tags labeled `file-encryption` or `ransomware`,
    sorted alphabetically, and include their usage statistics and
    total count:

    ```json
    {
      "query": [
        {"_name": "listTag"},
        {"_name": "freetags"},
        {
          "_name": "filter",
          "_or": [
            {"_eq": {"_field": "predicate", "_value": "file-encryption"}},
            {"_eq": {"_field": "predicate", "_value": "ransomware"}}
          ]
        },
        {
          "_name": "sort",
          "_fields": [{"predicate": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["usage", "total"]
        }
      ],
      "excludeFields": ["description"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listTag` </nobr>| Lists all custom tags of the current organization (excludes taxonomy-imported tags) |
    | <nobr>`getTag` </nobr>| Gets a single tag by ID |
    | <nobr>`freetags` </nobr>| Alias for `listTag` |
    | <nobr>`tagAutoComplete` </nobr>| Autocompletes tag suggestions. Takes a `TagHint` parameter (`namespace`, `predicate`, `value`, `freeTag`, `limit`). Doesn't support sort, filter, pagination, or extraData |
    | <nobr>`countFreetags` </nobr>| Counts custom tags of the current organization. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |

    ### Related object operations

    | <nobr>Operation </nobr>| Returns |
    |---|---|
    | <nobr>`freetags` </nobr>| Restricts the result set to custom tags of the current organization |
    | <nobr>`text` </nobr>| Display name of each tag. Doesn't support sort, filter, pagination, or extraData |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
    | <nobr>`usage` </nobr>| Usage statistics for the tag |
- name: Profile
  description: |
    A profile defines the permissions available to a user within an
    organization in TheHive. Profiles are assigned per user-organization
    pair. TheHive provides six predefined profiles: Admin, Org-Admin, Analyst,
    and Read-Only on all plans, and External-Reader and External-Actor on
    Platinum and One licenses. You can create custom profiles on Gold,
    Platinum, and One licenses.

    You can identify a profile by its `_id` or name.

    Use [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to retrieve profiles with filtering, sorting, or pagination.

    A query is an array of chained steps:

    1. Start with a primary operation to define the initial profile set (required).
    2. Chain related object operations to navigate to related entities (optional).
    3. Apply filter and sort steps to narrow or order the results (optional).
    4. End with a page step to paginate and request computed extra fields (optional).

    See the [**Query and Export**](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export) section for the full query syntax.

    ### Example

    Retrieve the first 10 profiles sorted by name, excluding the Admin
    profile, and include the total count in the response:

    ```json
    {
      "query": [
        {"_name": "listProfile"},
        {
          "_name": "filter",
          "_ne": {"_field": "name", "_value": "Admin"}
        },
        {
          "_name": "sort",
          "_fields": [{"name": "asc"}]
        },
        {
          "_name": "page",
          "from": 0,
          "to": 10,
          "extraData": ["total"]
        }
      ],
      "excludeFields": ["permissions"]
    }
    ```

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`listProfile` </nobr>| Lists all profiles |
    | <nobr>`getProfile` </nobr>| Gets a single profile by ID or name |

    ### Extra data

    | <nobr>extraData value </nobr>| Description |
    |---|---|
    | <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
- name: Admin
  description: |
    Platform-level administration endpoint for TheHive. It lets you change the
    log level of any logger at runtime, without restarting TheHive.

    It requires the `managePlatform` permission. Call it with the
    `X-Organisation: admin` header to target the `admin` organization.
- name: Config
  description: |-
    Your personal configuration items, stored as arbitrary JSON
    values under a key you choose.

    TheHive uses this store for settings such as `dashboards`,
    `list-views-cases`, `list-views-tasks`, `list-views-alerts`,
    `notification.items`, `organisation`, and `profile`. Each item
    falls back to TheHive default value until you set an
    override.

    Use `GET /api/v1/config/user` to list your current
    configuration items and their keys.
- name: License
  description: |
    A license controls the features and quotas available on a TheHive instance.

    TheHive offers four license plans:

    | Plan | Description |
    |---|---|
    | `Community` | Essential features to get started with TheHive or for users with basic needs. |
    | `Gold` | Designed for internal response teams requiring enhanced case management lifecycles and organizational integrations. |
    | `Platinum` | Ideal for large teams needing extensive server connections, clustering, and dedicated continuous support for mission-critical, large-scale incident response. |
    | `One` | Includes all Platinum features plus workflow automation with TheHive Flow. |

    ### Quotas

    Each license defines limits for users, organizations, cluster nodes,
    case templates, and dashboards.

    Not all user accounts count toward the user limit:

    **Count toward the user limit:**
    - Unlocked Normal user accounts with at least one licensed permission

    **Don't count toward the user limit:**
    - Normal user accounts with no licensed permissions, for example users
      with a Read-Only or Admin-only profile
    - Service user accounts

    **Consume license seats but are unlimited:**
    - External user accounts, intended for users who access
      [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/)

    See [About Licenses](https://docs.strangebee.com/thehive/installation/licenses/about-licenses/)
    for more information.

    ### Activation

    StrangeBee issues licenses tied to a specific instance. Activate a license
    using the following steps:

    1. Call `GET /api/v1/license/challenge` to obtain a challenge token for your instance.
    2. Send the challenge token to the [StrangeBee license portal](https://docs.strangebee.com/thehive/installation/licenses/license/#step-2-generate-your-license-key)
       to receive a license key.
    3. Call `POST /api/v1/license` to add and activate the license key.

    For Community licenses, first request one at
    [Request a Community License](https://docs.strangebee.com/thehive/installation/licenses/request-a-community-license/)
    before following these steps.

    All endpoints except `GET /api/v1/license/current` require the
    `managePlatform` permission. Call them with the `X-Organisation: admin`
    header to target the `admin` organization.
- name: Branding
  description: |
    Branding lets you personalize TheHive with your own login page
    logo, navigation bar logo, favicon, and browser tab title.

    See [Customize TheHive Branding](https://docs.strangebee.com/thehive/administration/customize-thehive-branding/)
    for more information.
- name: Permission
  description: |
    Permissions are the building blocks of profiles in TheHive. Each
    permission grants access to specific actions on a given entity. For
    example, `manageCase/create` lets a user create cases.

    ### Case management

    - `manageCase/create`
    - `manageCase/merge`
    - `manageCase/reopen`
    - `manageCase/changeOwnership`
    - `manageCase/update`
    - `manageCase/delete`

    ### Alert management

    - `manageAlert/reopen`
    - `manageAlert/delete`
    - `manageAlert/create`
    - `manageAlert/import`
    - `manageAlert/update`

    ### Other permissions

    - `manageCustomField`
    - `manageProfile`
    - `managePageTemplate`
    - `manageUser`
    - `manageAction`
    - `manageFunction/invoke`
    - `manageCaseAccess/restrict`
    - `accessTheHiveFS`
    - `manageFunction/create`
    - `manageTask`
    - `manageProcedure`
    - `manageCaseReport`
    - `manageSla`
    - `manageComment`
    - `manageTaxonomy`
    - `manageTag`
    - `managePage`
    - `managePlatform`
    - `manageDashboard`
    - `managePattern`
    - `manageConfig`
    - `manageCaseTemplate`
    - `manageOrganisation`
    - `manageAnalyzerTemplate`
    - `manageCustomEvent`
    - `manageObservable`
    - `manageKnowledgeBase`
    - `manageShare`
    - `manageCaseReportTemplate`
    - `manageAnalyse`
    - `manageCaseAccess/external`
    - `manageObservableTemplate`

    ### Primary operations

    | <nobr>Operation </nobr>| Description |
    |---|---|
    | <nobr>`list` </nobr>| Lists all permissions |
- name: Email Intake
  description: |2+

    The email intake connector connects TheHive to one or more mailboxes and
    automatically converts incoming emails into alerts.

    TheHive polls connected mailboxes at a configurable interval and creates one alert
    per email. Processed emails can optionally be moved to an archive folder or marked
    as read. Each mailbox can be scoped to one or more organizations.

    All endpoints in this connector require the `manageConfig` permission.
    Call them with the `X-Organisation: admin` header to target the
    `admin` organization.

    Supported providers:

    - IMAP: any IMAP server with password authentication
    - Microsoft 365: Microsoft 365 mailboxes via OAuth 2.0
    - Microsoft Graph API: Microsoft 365 mailboxes using OAuth 2.0 and the Microsoft Graph REST API
    - Google Workspace: Gmail mailboxes via OAuth 2.0

    License requirements: Gold, Platinum, or One — Platinum or One required for OAuth 2.0 providers: Microsoft 365, Microsoft Graph API, and Google Workspace

- name: MISP
  description: |+
    [MISP](https://www.misp-project.org/) (Malware Information Sharing Platform) is an
    open-source threat intelligence platform for sharing indicators of compromise (IOCs),
    tactics, techniques, and procedures (TTPs) across organizations.

    TheHive integrates with MISP in two directions:

    - Import: MISP events are automatically fetched from configured MISP servers and
      converted into alerts in TheHive. Existing alerts are updated when the
      corresponding MISP event is republished with changes. Use
      `POST /api/v1/alert/{alertId}/unfollow` to stop receiving updates for a
      specific alert. You can also manually import a MISP event JSON file as a case.
    - Export: Cases with observables marked as IOCs can be exported to MISP as events
      for community sharing. Once exported, TheHive automatically synchronizes subsequent
      IOC updates to the MISP event.

    To set up a MISP server connection, see
    [Connect a MISP Server](https://docs.strangebee.com/thehive/administration/misp-integration/connect-a-misp-server/).
    Connecting multiple MISP servers requires a paid license.

- name: Status
  description: |
    Status endpoints return operational information about your
    TheHive instance: the platform version, license status, the
    status of each connector, enabled feature flags, and, for the
    authenticated endpoint, the Pekko cluster state and the
    database schema version of each module.
servers:
- url: /
paths:
  /api/v1/query:
    post:
      tags:
      - Query and Export
      description: |2

        <details>
        <summary><strong>Primary operations by entity</strong></summary>

        | <nobr>Entity </nobr>| <nobr>Operation </nobr>| Description |
        |---|---|---|
        | <nobr>Any entity </nobr>| <nobr>`listAny` </nobr>| Lists all alerts, cases, observables, tasks, and task logs accessible to the current user, in a single result set |
        | <nobr>Any entity </nobr>| <nobr>`getAny` </nobr>| Gets any entity by ID across all entity types accessible to the current user |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`listCase` </nobr>| Lists all cases accessible to the current user |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`getCase` </nobr>| Gets a single case by ID or case number |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`countCase` *(deprecated)* </nobr>| Counts cases accessible to the current user. Replaced by `[{"_name": "listCase"}, {"_name": "count"}]`. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`listAlert` </nobr>| Lists all alerts accessible to the current user |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`getAlert` </nobr>| Gets a single alert by ID or alert reference (`type;source;sourceRef`) |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`countAlert` *(deprecated)* </nobr>| Counts alerts accessible to the current user. Replaced by `[{"_name": "listAlert"}, {"_name": "count"}]`. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`countUnreadAlert` *(deprecated)* </nobr>| Counts alerts with stage `New`. Replaced by a `listAlert`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`countImportedAlert` *(deprecated)* </nobr>| Counts alerts with [stage `Imported`](https://docs.strangebee.com/thehive/administration/status/about-statuses/#attributes). Replaced by a `listAlert`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`countRelatedAlert` *(deprecated)* </nobr>| Counts alerts related to a given case. Replaced by a `listAlert`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`listTask` </nobr>| Lists all tasks accessible to the current user |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`getTask` </nobr>| Gets a single task by ID |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`listCaseTask` </nobr>| Lists tasks linked to cases (excludes case-template tasks) |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`waitingTasks` </nobr>| Lists tasks with status `Waiting` linked to cases |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`myTasks` </nobr>| Lists tasks assigned to the current user |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`waitingTask` *(deprecated)* </nobr>| Alias for `waitingTasks` |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`countTask` *(deprecated)* </nobr>| Counts non-cancelled tasks for a given case. Replaced by a `listTask`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`listObservable` </nobr>| Lists all observables accessible to the current user |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`getObservable` </nobr>| Gets a single observable by ID |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`countCaseObservable` *(deprecated)* </nobr>| Counts observables of a given case. Replaced by a `listObservable`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`countAlertObservable` *(deprecated)* </nobr>| Counts observables of a given alert. Replaced by a `listObservable`+`filter`+`count` chain. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`listLog` </nobr>| Lists all task logs accessible to the current user |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`getLog` </nobr>| Gets a single task log by ID |
        | <nobr>Comment </nobr>| <nobr>`listComment` </nobr>| Lists all comments accessible to the current user |
        | <nobr>Comment </nobr>| <nobr>`getComment` </nobr>| Gets a single comment by ID |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`listShare` </nobr>| Lists all sharing configurations. |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`getShare` </nobr>| Gets a single sharing configuration by ID |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`listProcedure` </nobr>| Lists all procedures (TTPs) accessible to the current user |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`getProcedure` </nobr>| Gets a single procedure by ID |
        | <nobr>Page </nobr>| <nobr>`listPage` </nobr>| Lists all pages accessible to the current user ([Knowledge Base pages](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-knowledge-base/) and [case pages](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-case-pages/)) |
        | <nobr>Page </nobr>| <nobr>`listOrganisationPage` </nobr>| Lists the [Knowledge Base pages](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-knowledge-base/) of the current organization |
        | <nobr>Page </nobr>| <nobr>`getPage` </nobr>| Gets a single page by ID ([Knowledge Base page](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-knowledge-base/) or [case page](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-case-pages/)) |
        | <nobr>[Case template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-templates/about-case-templates/) </nobr>| <nobr>`listCaseTemplate` </nobr>| Lists all case templates |
        | <nobr>[Case template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-templates/about-case-templates/) </nobr>| <nobr>`getCaseTemplate` </nobr>| Gets a single case template by ID or name |
        | <nobr>[Page template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-page-templates/about-case-page-templates/) </nobr>| <nobr>`listPageTemplate` </nobr>| Lists all page templates |
        | <nobr>[Page template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-page-templates/about-case-page-templates/) </nobr>| <nobr>`getPageTemplate` </nobr>| Gets a single page template by ID |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`listOrganisation` </nobr>| Lists all organizations |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`getOrganisation` </nobr>| Gets a single organization by ID or name |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`listUser` </nobr>| Lists all users |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`getUser` </nobr>| Gets a single user by ID or login |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`currentUser` </nobr>| Returns the currently authenticated user |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`listVisibleUsers` </nobr>| Lists users from all organizations visible to the current user |
        | <nobr>[Custom field](https://docs.strangebee.com/thehive/administration/custom-fields/about-custom-fields/) </nobr>| <nobr>`listCustomField` </nobr>| Lists all custom fields |
        | <nobr>[Custom field](https://docs.strangebee.com/thehive/administration/custom-fields/about-custom-fields/) </nobr>| <nobr>`getCustomField` </nobr>| Gets a single custom field by ID or name |
        | <nobr>[Alert status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`listAlertStatus` </nobr>| Lists all alert statuses |
        | <nobr>[Alert status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`getAlertStatus` </nobr>| Gets a single alert status by ID or value |
        | <nobr>[Case status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`listCaseStatus` </nobr>| Lists all case statuses |
        | <nobr>[Case status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`getCaseStatus` </nobr>| Gets a single case status by ID or value |
        | <nobr>[Observable type](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/#type) </nobr>| <nobr>`listObservableType` </nobr>| Lists all observable types |
        | <nobr>[Observable type](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/#type) </nobr>| <nobr>`getObservableType` </nobr>| Gets a single observable type by ID or name |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`listPattern` </nobr>| Lists all attack techniques accessible to the current user |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`getPattern` </nobr>| Gets a single attack technique by ID |
        | <nobr>[Taxonomy](https://docs.strangebee.com/thehive/administration/taxonomies/about-taxonomies/) </nobr>| <nobr>`listTaxonomy` </nobr>| Lists all taxonomies accessible to the current user |
        | <nobr>[Taxonomy](https://docs.strangebee.com/thehive/administration/taxonomies/about-taxonomies/) </nobr>| <nobr>`getTaxonomy` </nobr>| Gets a single taxonomy by ID or namespace |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`listTag` </nobr>| Lists all custom tags of the current organization (excludes taxonomy-imported tags) |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`getTag` </nobr>| Gets a single tag by ID |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`freetags` </nobr>| Alias for `listTag` |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`tagAutoComplete` </nobr>| Autocompletes tag suggestions. Takes a `TagHint` parameter (`namespace`, `predicate`, `value`, `freeTag`, `limit`). Doesn't support sort, filter, pagination, or extraData |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`countFreetags` </nobr>| Counts custom tags of the current organization. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Catalog of patterns](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`listCatalog` </nobr>| Lists all attack technique catalogs |
        | <nobr>[Catalog of patterns](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`getCatalog` </nobr>| Gets a single attack technique catalog by ID or name |
        | <nobr>[Profile](https://docs.strangebee.com/thehive/administration/profiles/about-profiles/) </nobr>| <nobr>`listProfile` </nobr>| Lists all profiles |
        | <nobr>[Profile](https://docs.strangebee.com/thehive/administration/profiles/about-profiles/) </nobr>| <nobr>`getProfile` </nobr>| Gets a single profile by ID or name |
        | <nobr>[Dashboard](https://docs.strangebee.com/thehive/user-guides/analyst-corner/dashboard/about-dashboards/) </nobr>| <nobr>`listDashboard` </nobr>| Lists all dashboards accessible to the current user |
        | <nobr>[Dashboard](https://docs.strangebee.com/thehive/user-guides/analyst-corner/dashboard/about-dashboards/) </nobr>| <nobr>`getDashboard` </nobr>| Gets a single dashboard by ID |
        | <nobr>[Custom event](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/case-timelines/about-case-timelines/) </nobr>| <nobr>`listCustomEvent` </nobr>| Lists all custom events in timelines accessible to the current user |
        | <nobr>[Custom event](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/case-timelines/about-case-timelines/) </nobr>| <nobr>`getCustomEvent` </nobr>| Gets a single custom event from timelines by ID |
        | <nobr>[Case report](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/case-reports/about-case-reports/) </nobr>| <nobr>`listCaseReport` </nobr>| Lists all case reports accessible to the current user |
        | <nobr>[Case report](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/case-reports/about-case-reports/) </nobr>| <nobr>`getCaseReport` </nobr>| Gets a single case report by ID |
        | <nobr>[Case report template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-report-templates/about-case-report-templates/) </nobr>| <nobr>`listCaseReportTemplate` </nobr>| Lists all case report templates |
        | <nobr>[Case report template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-report-templates/about-case-report-templates/) </nobr>| <nobr>`getCaseReportTemplate` </nobr>| Gets a single case report template by ID |
        | <nobr>[Audit](https://docs.strangebee.com/thehive/user-guides/organization/about-audit-logs/) </nobr>| <nobr>`getAudit` </nobr>| Gets a single audit log by ID |
        | <nobr>[Audit](https://docs.strangebee.com/thehive/user-guides/organization/about-audit-logs/) </nobr>| <nobr>`listAuditFromObject` </nobr>| Lists audit logs for a given object. Takes an `id` parameter: the object's ID |
        | <nobr>Action (Cortex) </nobr>| <nobr>`listAction` </nobr>| Lists all Cortex responder actions accessible to the current user |
        | <nobr>Action (Cortex) </nobr>| <nobr>`getAction` </nobr>| Gets a single Cortex responder action by ID |
        | <nobr>[Analyzer template (Cortex)](https://docs.strangebee.com/thehive/administration/analyzer-templates/about-analyzer-templates/) </nobr>| <nobr>`listAnalyzerTemplate` </nobr>| Lists all analyzer report templates |
        | <nobr>[Analyzer template (Cortex)](https://docs.strangebee.com/thehive/administration/analyzer-templates/about-analyzer-templates/) </nobr>| <nobr>`getReportTemplate` </nobr>| Gets a single analyzer report template by ID |
        | <nobr>Job (Cortex) </nobr>| <nobr>`listJob` </nobr>| Lists all Cortex analysis jobs accessible to the current user |
        | <nobr>Job (Cortex) </nobr>| <nobr>`getJob` </nobr>| Gets a single Cortex analysis job by ID |
        | <nobr>[Function](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/) </nobr>| <nobr>`listFunction` </nobr>| Lists all functions accessible to the current user. Requires a Platinum or One license |
        | <nobr>[Function](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/) </nobr>| <nobr>`getFunction` </nobr>| Gets a single function by ID or name. Requires a Platinum or One license |

        </details>

        <details>
        <summary><strong>Related object operations by entity</strong></summary>

        | <nobr>Source entity </nobr>| <nobr>Operation </nobr>| Returns |
        |---|---|---|
        | <nobr>Any entity </nobr>| <nobr>`count` </nobr>| Number of entities in the current result set. Recommended replacement for the deprecated `countXxx` operations |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`tasks` </nobr>| Tasks of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`taskGroups` </nobr>| Distinct task group names in the case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`observables` </nobr>| Observables of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`alerts` </nobr>| Alerts merged into the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`shares` </nobr>| Sharing configurations of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`organisations` </nobr>| Organizations the case is shared with |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`procedures` </nobr>| Procedures (TTPs) attached to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`pages` </nobr>| Pages attached to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`attachments` </nobr>| Attachments of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`comments` </nobr>| Comments on the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`allComments` </nobr>| Comments on the case and on its merged alerts |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`assignableUsers` </nobr>| Users who can be assigned to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarCasesLight` </nobr>| Cases sharing observables with this case, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarCaseLightCount` </nobr>| Number of cases sharing observables with this case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarAlertsLight` </nobr>| Alerts sharing observables with this case, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarAlertLightCount` </nobr>| Number of alerts sharing observables with this case. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarCases` *(deprecated)* </nobr>| Use `similarCasesLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarAlerts` *(deprecated)* </nobr>| Use `similarAlertsLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`similarAlertCount` *(deprecated)* </nobr>| Use `similarAlertLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`linkedCases` *(deprecated)* </nobr>| Alias for `similarCases`. Use `similarCasesLight` instead. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`linkedCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`customEvents` </nobr>| Custom events attached to the case in the timeline |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`caseReports` </nobr>| Case reports of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`timeline` </nobr>| Activity timeline of the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`actions` </nobr>| Cortex responder executions run on the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`external` </nobr>| Restricts the result set to external-access cases ([TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/)). Requires a Platinum or One license. |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`case` </nobr>| Case the alert was merged into |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`observables` </nobr>| Observables of the alert |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`procedures` </nobr>| Procedures (TTPs) attached to the alert |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`comments` </nobr>| Comments on the alert |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`attachments` </nobr>| Attachments of the alert |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`assignableUsers` </nobr>| Users who can be assigned to the alert |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarCasesLight` </nobr>| Cases sharing observables with this alert, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarCaseLightCount` </nobr>| Number of cases sharing observables with this alert. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarAlertsLight` </nobr>| Alerts sharing observables with this alert, with the matching observables grouped by data type. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarAlertLightCount` </nobr>| Number of alerts sharing observables with this alert. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarCases` *(deprecated)* </nobr>| Use `similarCasesLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarCaseCount` *(deprecated)* </nobr>| Use `similarCaseLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarAlerts` *(deprecated)* </nobr>| Use `similarAlertsLight` for improved performance. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`similarAlertCount` *(deprecated)* </nobr>| Use `similarAlertLightCount` for improved performance. Returns a value directly. Doesn't support sort, filter, pagination, extraData, or output |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`actions` </nobr>| Cortex responder executions run on the alert |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`case` </nobr>| Case the task belongs to |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`caseTemplate` </nobr>| Case template the task originates from |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`logs` </nobr>| Task logs of the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`shares` </nobr>| Sharing configurations of the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`organisations` </nobr>| Organizations the task is shared with |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`assignableUsers` </nobr>| Users who can be assigned to the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`inCase` </nobr>| Restricts the result set to tasks linked to a case (excludes case-template tasks) |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`actions` </nobr>| Cortex responder executions run on the task |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`case` </nobr>| Case the observable belongs to |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`alert` </nobr>| Alert the observable belongs to |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`shares` </nobr>| Sharing configurations of the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`organisations` </nobr>| Organizations the observable is shared with |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`similar` </nobr>| Observables similar to this one |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`attachments` </nobr>| Attachments of the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`jobs` </nobr>| Cortex analysis jobs run on the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`actions` </nobr>| Cortex responder executions run on the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`fromCase` </nobr>| Restricts the result set to observables attached to a case |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`fromAlert` </nobr>| Restricts the result set to observables attached to an alert |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`fromJobReport` </nobr>| Restricts the result set to observables produced by a Cortex analyzer report |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`attachments` </nobr>| Attachments of the log |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`actions` </nobr>| Cortex responder executions run on the task log |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`case` </nobr>| Case associated with the share |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`observables` </nobr>| Observables associated with the share |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`tasks` </nobr>| Tasks associated with the share |
        | <nobr>[Share](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) </nobr>| <nobr>`organisation` </nobr>| Organization associated with the share |
        | <nobr>[Case template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-templates/about-case-templates/) </nobr>| <nobr>`tasks` </nobr>| Task templates of the case template |
        | <nobr>[Case template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-templates/about-case-templates/) </nobr>| <nobr>`pageTemplates` </nobr>| Page templates of the case template |
        | <nobr>[Page template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-page-templates/about-case-page-templates/) </nobr>| <nobr>`caseTemplates` </nobr>| Case templates that include the page template |
        | <nobr>[Page template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-page-templates/about-case-page-templates/) </nobr>| <nobr>`headerPage` *(experimental)* </nobr>| Page template header info, without the content field. Accepts `from`, `to`, and `extraData` pagination parameters |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`users` </nobr>| Users in the organization |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`caseTemplates` </nobr>| Case templates of the organization |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`alerts` </nobr>| Alerts of the organization |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`attachments` </nobr>| Attachments of the organization |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`visible` </nobr>| Restricts the result set to organizations visible to the current user |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`tasks` </nobr>| Tasks assigned to the user |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`cases` </nobr>| Cases assigned to the user |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`alerts` </nobr>| Alerts assigned to the user |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`freetags` </nobr>| Restricts the result set to custom tags of the current organization |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`text` </nobr>| Display name of each tag. Doesn't support sort, filter, pagination, or extraData |
        | <nobr>[Catalog of patterns](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`patterns` </nobr>| Techniques in the attack catalog |
        | <nobr>[Catalog of patterns](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`tactics` </nobr>| Tactics in the attack catalog. Supports sort, filter, count, and aggregation. Doesn't support pagination, extraData, or output |
        | <nobr>[Taxonomy](https://docs.strangebee.com/thehive/administration/taxonomies/about-taxonomies/) </nobr>| <nobr>`tags` </nobr>| Tags belonging to the taxonomy |
        | <nobr>[Case report template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-report-templates/about-case-report-templates/) </nobr>| <nobr>`attachments` </nobr>| Files uploaded to the template for use in `Image` widgets |
        | <nobr>Job (Cortex) </nobr>| <nobr>`observable` </nobr>| Observable the job analyzed |
        | <nobr>Job (Cortex) </nobr>| <nobr>`reportObservables` </nobr>| Observables produced by the analyzer report |

        </details>

        <details>
        <summary><strong>Available extraData fields by entity</strong></summary>

        | <nobr>Entity </nobr>| <nobr>extraData value </nobr>| Description |
        |---|---|---|
        | <nobr>Any entity </nobr>| <nobr>`total` </nobr>| Total number of matching results across all pages. Returned in the `X-Total` response header |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`observableStats` </nobr>| Statistics about observables in the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`taskStats` </nobr>| Statistics about tasks in the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`alerts` </nobr>| Alerts linked to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`alertCount` </nobr>| Number of alerts linked to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`isOwner` </nobr>| Whether the requesting organization owns the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`shareCount` </nobr>| Number of organizations the case is shared with |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`permissions` </nobr>| Permissions the current user has on the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`actionRequired` </nobr>| Whether an action is required from the current user |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`procedureCount` </nobr>| Number of procedures (TTPs) attached to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`attachmentCount` </nobr>| Number of attachments in the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`contributors` </nobr>| Users who have contributed to the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`computed.handlingDuration` </nobr>| Time elapsed from case creation to close (in milliseconds) |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`computed.handlingDurationInSeconds` </nobr>| Handling duration in seconds |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`computed.handlingDurationInMinutes` </nobr>| Handling duration in minutes |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`computed.handlingDurationInHours` </nobr>| Handling duration in hours |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`computed.handlingDurationInDays` </nobr>| Handling duration in days |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`status` </nobr>| Status object with stage and color |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`owningOrganisation` </nobr>| Organization that owns the case |
        | <nobr>[Case](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/about-cases/) </nobr>| <nobr>`links` </nobr>| Cases linked to this case |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`importDate` </nobr>| Date the alert was merged into a case |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`caseNumber` *(deprecated)* </nobr>| Number of the case the alert was merged into |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`relatedCase` </nobr>| Case the alert was merged into |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`status` </nobr>| Status object with stage and color |
        | <nobr>[Alert](https://docs.strangebee.com/thehive/user-guides/analyst-corner/alerts/about-alerts/) </nobr>| <nobr>`procedureCount` </nobr>| Number of procedures (TTPs) attached to the alert |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`case` </nobr>| Case the task belongs to |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`caseId` </nobr>| ID of the case the task belongs to |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`caseTemplate` </nobr>| Case template the task originates from |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`caseTemplateId` </nobr>| ID of the case template |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`isOwner` </nobr>| Whether the requesting organization owns the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`shareCount` </nobr>| Number of organizations the task is shared with |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`actionRequired` </nobr>| Whether an action is required on the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`actionRequiredMap` </nobr>| Map of organizations requiring action on the task |
        | <nobr>[Task](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-tasks/) </nobr>| <nobr>`logCount` </nobr>| Number of logs in the task |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`seen` *(deprecated)* </nobr>| Whether the observable has been seen in other cases |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`seenSummary` </nobr>| Summary of cases where the observable appears |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`shares` </nobr>| Organizations the observable is shared with |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`links` </nobr>| Observables linked to this one |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`permissions` </nobr>| Permissions the current user has on the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`isOwner` </nobr>| Whether the requesting organization owns the observable |
        | <nobr>[Observable](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/observables/about-observables/) </nobr>| <nobr>`shareCount` </nobr>| Number of organizations the observable is shared with |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`case` </nobr>| Case the task log belongs to |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`task` </nobr>| Task the log belongs to |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`taskId` </nobr>| ID of the task the log belongs to |
        | <nobr>[Log](https://docs.strangebee.com/thehive/user-guides/analyst-corner/tasks/about-task-logs/) </nobr>| <nobr>`actionCount` </nobr>| Number of actions on the task log |
        | <nobr>Comment </nobr>| <nobr>`links` </nobr>| Case or alert the comment belongs to |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`pattern` </nobr>| Attack techniques associated with the procedure |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`tactic` </nobr>| Attack tactics associated with the procedure |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`patternParent` </nobr>| Parent attack technique in the hierarchy |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`patternTactics` </nobr>| All tactics associated with the attack technique |
        | <nobr>[Procedure](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`patternCatalog` </nobr>| Catalog the attack technique belongs to |
        | <nobr>[Organization](https://docs.strangebee.com/thehive/administration/organizations/about-organizations/) </nobr>| <nobr>`userCount` </nobr>| Number of users in the organization |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`lockout` </nobr>| Information about authentication lockout for the user |
        | <nobr>[User](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/) </nobr>| <nobr>`organisations` </nobr>| Organizations the user belongs to |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`parent` </nobr>| Parent attack technique in the hierarchy |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`children` </nobr>| Child attack techniques in the hierarchy |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`tactics` </nobr>| Tactics associated with the attack technique |
        | <nobr>[Pattern](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`catalog` </nobr>| Catalog the attack technique belongs to |
        | <nobr>[Catalog of patterns](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/ttps/about-ttps/) </nobr>| <nobr>`tactics` </nobr>| Tactics defined in the attack catalog |
        | <nobr>[Tag](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/tags/about-tags/) </nobr>| <nobr>`usage` </nobr>| Usage statistics for the tag |
        | <nobr>[Taxonomy](https://docs.strangebee.com/thehive/administration/taxonomies/about-taxonomies/) </nobr>| <nobr>`enabled` </nobr>| Whether the taxonomy is enabled in the current organization |
        | <nobr>[Custom field](https://docs.strangebee.com/thehive/administration/custom-fields/about-custom-fields/) </nobr>| <nobr>`deletable` </nobr>| Whether the custom field can be deleted |
        | <nobr>[Alert status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`canDelete` </nobr>| Whether the alert status can be deleted |
        | <nobr>[Case status](https://docs.strangebee.com/thehive/administration/status/about-statuses/) </nobr>| <nobr>`canDelete` </nobr>| Whether the case status can be deleted |
        | <nobr>[Case template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-templates/about-case-templates/) </nobr>| <nobr>`pageTemplateHeaders` </nobr>| Headers of the page templates linked to the case template |
        | <nobr>[Page template](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-templates/case-page-templates/about-case-page-templates/) </nobr>| <nobr>`caseTemplateCount` </nobr>| Number of case templates that include this page template |
        | <nobr>Job (Cortex) </nobr>| <nobr>`links` </nobr>| Case or alert the Cortex job's observable belongs to |
        | <nobr>Job (Cortex) </nobr>| <nobr>`report` </nobr>| Cortex analyzer report content |
        | <nobr>[Attachment](https://docs.strangebee.com/thehive/user-guides/analyst-corner/cases/attachments/about-attachments/) </nobr>| <nobr>`task` </nobr>| Task log the attachment belongs to (when the attachment is a log attachment) |

        </details>
      operationId: Query API
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputQuery'
            example:
              query:
              - _name: listCase
              - _eq:
                  _field: severity
                  _value: 3
                _name: filter
              - _fields:
                - _createdAt: desc
                _name: sort
              - from: 0
                to: 10
                extraData:
                - taskStats
                - shareCount
                - total
                _name: page
              excludeFields:
              - description
        required: true
      responses:
        '200':
          description: Success
          headers:
            X-Total:
              description: Total number of matching results across all pages. Only
                present when `total` is included in `extraData`.
              required: false
              schema:
                type: integer
                format: int64
          content:
            application/json:
              schema: {}
              example:
              - _id: ~98112
                _type: Case
                _createdBy: alice@example.com
                _createdAt: 1745539200000
                _updatedBy: alice@example.com
                _updatedAt: 1745625600000
                number: 412
                title: Suspicious Ransomware Activity
                severity: 3
                severityLabel: High
                startDate: 1745539200000
                tags:
                - ransomware
                - file-encryption
                - TheOrganization
                flag: true
                tlp: 3
                tlpLabel: Red
                pap: 2
                papLabel: Amber
                status: InProgress
                stage: InProgress
                assignee: alice@example.com
                access:
                  _kind: OrganisationAccessKind
                customFields: []
                extraData:
                  taskStats:
                    Waiting: 1
                    InProgress: 4
                    Completed: 4
                    Cancel: 0
                  shareCount: 2
                newDate: 1745539200000
                inProgressDate: 1745542800000
                timeToDetect: 0
              - _id: ~98098
                _type: Case
                _createdBy: alice@example.com
                _createdAt: 1745452800000
                _updatedBy: alice@example.com
                _updatedAt: 1745625600000
                number: 408
                title: Unauthorized Access – Compromised Employee Account
                severity: 3
                severityLabel: High
                startDate: 1745452800000
                endDate: 1745625600000
                tags:
                - intrusion
                - compromised-account
                - TheOrganization
                flag: true
                tlp: 3
                tlpLabel: Red
                pap: 3
                papLabel: Red
                status: Closed
                stage: Closed
                impactStatus: WithImpact
                assignee: alice@example.com
                access:
                  _kind: OrganisationAccessKind
                customFields: []
                extraData:
                  taskStats:
                    Waiting: 0
                    InProgress: 0
                    Completed: 5
                    Cancel: 0
                  shareCount: 1
                newDate: 1745452800000
                inProgressDate: 1745456400000
                closedDate: 1745625600000
                timeToDetect: 0
                timeToResolve: 172800000
                handlingDuration: 172800000
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/query" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "query": [
              {
                "_name": "listCase"
              },
              {
                "_eq": {
                  "_field": "severity",
                  "_value": 3
                },
                "_name": "filter"
              },
              {
                "_fields": [
                  {
                    "_createdAt": "desc"
                  }
                ],
                "_name": "sort"
              },
              {
                "from": 0,
                "to": 10,
                "extraData": [
                  "taskStats",
                  "shareCount",
                  "total"
                ],
                "_name": "page"
              }
            ],
            "excludeFields": [
              "description"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/query",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "query": [
                      {
                          "_name": "listCase"
                      },
                      {
                          "_eq": {
                              "_field": "severity",
                              "_value": 3
                          },
                          "_name": "filter"
                      },
                      {
                          "_fields": [
                              {
                                  "_createdAt": "desc"
                              }
                          ],
                          "_name": "sort"
                      },
                      {
                          "from": 0,
                          "to": 10,
                          "extraData": [
                              "taskStats",
                              "shareCount",
                              "total"
                          ],
                          "_name": "page"
                      }
                  ],
                  "excludeFields": [
                      "description"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/export:
    get:
      tags:
      - Query and Export
      description: |2

        **Warning**: This is an unstable route. Breaking changes could happen in future releases.

        Export the results of a query as a downloadable file in the specified format. The file is streamed back with a `Content-Disposition: attachment` header. When the underlying query produces a total count, the total number of exported elements is also returned in the `X-Total` response header.

        The `query` parameter is a stringified JSON value that conforms to the format accepted by the **Query API** endpoint.

        The `options` parameter is a stringified JSON value with the following structure:

        - Common fields:
          - `format`: `(string)` accepted values are `"csv"`, `"json"`, `"txt"`, and `"misp"`
          - `fileName`: `(optional, string)` file name without extension (default: `<YYYY-MM-DD>_export`)
          - `model`: `(string)` accepted values are `"Case"`, `"Alert"`, `"User"`, `"Organisation"`, `"Procedure"`, `"Task"`, and `"Observable"`
          - `protectData`: `(optional, boolean)` protect the observable `data` field (default: `true`)
        - For CSV exports:
          - `fields`: `(optional, array of strings)` list of field paths that replaces the default exported fields. The fields available for each model can be retrieved through the Get export fields endpoint. Two special paths are also accepted: `customFields` (or `customFieldValues`) expands to all custom fields, and `customFields.<name>` (or `customFieldValues.<name>`) targets a single custom field by name
          - `delimiter`: `(optional, character)` default: `,`
          - `quoteChar`: `(optional, character)` default: `"`
          - `escapeChar`: `(optional, character)` default: `\`
        - JSON, TXT, and MISP exports take no specific fields

        The `"txt"` and `"misp"` formats are only available for the `"Observable"` model.

        Output formats:

        - `csv`: the first row contains the field paths as headers. Each subsequent row contains the values for one entity.
        - `json`: a single JSON array containing one object per entity.
        - `txt`: one observable per line, terminated by `\r\n`. Value-based observables produce `<data>`. File-attachment observables produce `<filename>|<sha256>`.
        - `misp`: one observable per line, terminated by `\r\n`. Value-based observables produce `*<dataType>\t:<data>`. File-attachment observables produce `*filename|sha256\t:<filename>|<sha256>`.

        **Breaking changes in TheHive 5.3:**

        - The observable `data` field is protected by default.
        - The `model` field is now mandatory for all formats.
        - When the `fields` parameter is set for the `"csv"` format, those fields replace the default exported fields instead of being added to them.
      operationId: Export API - unstable route
      parameters:
      - name: query
        in: query
        required: true
        schema:
          type: string
      - name: options
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME type of the exported file, derived from the `format`
                option (`text/csv` for CSV, `application/json` for JSON, and `text/plain`
                for TXT and MISP).
              required: true
              schema:
                type: string
            X-Total:
              description: Total number of exported elements. Only returned when the
                underlying query produces a total count.
              required: false
              schema:
                type: string
            Content-Disposition:
              description: Attachment disposition carrying the encoded file name and
                the extension matching the selected `format`.
              required: true
              schema:
                type: string
            Transfer-Encoding:
              description: Always `chunked` for streamed exports.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/export/_fields:
    get:
      tags:
      - Query and Export
      description: |2

        **Warning**: This is an unstable route. Breaking changes could happen in future releases.

        Returns the list of fields available for export, grouped by model. Each entry exposes the field path, its type, and whether it is part of the default selection. Use this endpoint to discover the field paths accepted by the `fields` parameter of the **Export API** endpoint for CSV exports.
      operationId: Get export fields - unstable route
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputExportFieldsMapping'
              example:
                fieldsByModel:
                  Case:
                  - fieldPath: number
                    fieldType: number
                    selectedByDefault: true
                  - fieldPath: title
                    fieldType: string
                    selectedByDefault: true
                  - fieldPath: severityLabel
                    fieldType: string
                    selectedByDefault: true
                  - fieldPath: tags
                    fieldType: string[]
                    selectedByDefault: true
                  - fieldPath: status
                    fieldType: string
                    selectedByDefault: true
                  - fieldPath: assignee
                    fieldType: user
                    selectedByDefault: true
                  - fieldPath: startDate
                    fieldType: date
                    selectedByDefault: true
                  - fieldPath: endDate
                    fieldType: date
                    selectedByDefault: false
                  - fieldPath: customFields
                    fieldType: customFields
                    selectedByDefault: false
                  Observable:
                  - fieldPath: dataType
                    fieldType: string
                    selectedByDefault: true
                  - fieldPath: data
                    fieldType: string
                    selectedByDefault: true
                  - fieldPath: ioc
                    fieldType: boolean
                    selectedByDefault: true
                  - fieldPath: tags
                    fieldType: string[]
                    selectedByDefault: true
                  - fieldPath: attachment.name
                    fieldType: string
                    selectedByDefault: false
                  - fieldPath: attachment.hashes
                    fieldType: string[]
                    selectedByDefault: false
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case:
    post:
      tags:
      - Case
      summary: Create a case
      description: |
        Create a new case in TheHive. You can use a case template to pre-populate
        tasks, custom fields, and pages, or build the case from scratch.
        By default, sharing rules set at the organization level apply to
        the new case.

        Required permission: `manageCase/create`
      operationId: Create case
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateCase'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/create
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Suspicious Ransomware Activity",
            "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
            "severity": 3,
            "startDate": 1748736000000,
            "endDate": 1748995200000,
            "tags": [
              "file-encryption",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "status": "New",
            "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
            "assignee": "lucas@example.com",
            "access": {
              "_kind": "AllExternalAccessKind"
            },
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "caseTemplate": "Ransomware",
            "tasks": [
              {
                "title": "Isolate affected workstation from the network",
                "group": "Containment",
                "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                "status": "Waiting",
                "flag": false,
                "startDate": 1748476800000,
                "endDate": 1748563200000,
                "order": 1,
                "dueDate": 1748563200000,
                "assignee": "lucas@example.com",
                "mandatory": false
              }
            ],
            "pages": [
              {
                "title": "Investigation Notes",
                "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                "order": 0,
                "category": "Investigation"
              }
            ],
            "sharingParameters": [
              {
                "organisation": "TheOrganization",
                "share": true,
                "profile": "analyst",
                "taskRule": "autoShare",
                "observableRule": "autoShare"
              }
            ],
            "taskRule": "manual",
            "observableRule": "manual"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Suspicious Ransomware Activity",
                  "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
                  "severity": 3,
                  "startDate": 1748736000000,
                  "endDate": 1748995200000,
                  "tags": [
                      "file-encryption",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "status": "New",
                  "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
                  "assignee": "lucas@example.com",
                  "access": {
                      "_kind": "AllExternalAccessKind"
                  },
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "caseTemplate": "Ransomware",
                  "tasks": [
                      {
                          "title": "Isolate affected workstation from the network",
                          "group": "Containment",
                          "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                          "status": "Waiting",
                          "flag": False,
                          "startDate": 1748476800000,
                          "endDate": 1748563200000,
                          "order": 1,
                          "dueDate": 1748563200000,
                          "assignee": "lucas@example.com",
                          "mandatory": False
                      }
                  ],
                  "pages": [
                      {
                          "title": "Investigation Notes",
                          "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                          "order": 0,
                          "category": "Investigation"
                      }
                  ],
                  "sharingParameters": [
                      {
                          "organisation": "TheOrganization",
                          "share": True,
                          "profile": "analyst",
                          "taskRule": "autoShare",
                          "observableRule": "autoShare"
                      }
                  ],
                  "taskRule": "manual",
                  "observableRule": "manual"
              },
          )
          response.raise_for_status()
  /api/v1/case/{idOrName}:
    get:
      tags:
      - Case
      summary: Get a case
      description: |
        Returns the full details of a case, including metadata, custom fields,
        access settings, KPI metrics, and date fields.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.
      operationId: Get case
      parameters:
      - name: idOrName
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Case
      summary: Delete a case
      description: |
        Permanently delete a case from TheHive. This action is
        irreversible: once deleted, the case can't be recovered
        by anyone, including the StrangeBee Support team.

        For false positives or duplicates, consider closing the
        case rather than deleting it. Use `PATCH /api/v1/case/{idOrName}`
        to set the case to a status linked to the *Closed* stage.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/delete`
      operationId: Delete case
      parameters:
      - name: idOrName
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/delete
    patch:
      tags:
      - Case
      summary: Update a case
      description: |
        Update one or more fields of a single case. Only the fields
        included in the request body are modified. Omitted fields retain
        their current values. To update multiple cases at once, use
        `PATCH /api/v1/case/_bulk`.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Update case
      parameters:
      - name: idOrName
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCase'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/case/{idOrName}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Suspicious Ransomware Activity — CORP-LAPTOP-056",
            "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
            "severity": 3,
            "startDate": 1748736000000,
            "endDate": 1748995200000,
            "tags": [
              "file-encryption",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "status": "InProgress",
            "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
            "assignee": "sami@example.com",
            "impactStatus": "NotApplicable",
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "taskRule": "manual",
            "observableRule": "manual",
            "addTags": [
              "ransomware",
              "endpoint"
            ],
            "removeTags": [
              "file-encryption"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/case/{idOrName}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Suspicious Ransomware Activity — CORP-LAPTOP-056",
                  "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
                  "severity": 3,
                  "startDate": 1748736000000,
                  "endDate": 1748995200000,
                  "tags": [
                      "file-encryption",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "status": "InProgress",
                  "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
                  "assignee": "sami@example.com",
                  "impactStatus": "NotApplicable",
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "taskRule": "manual",
                  "observableRule": "manual",
                  "addTags": [
                      "ransomware",
                      "endpoint"
                  ],
                  "removeTags": [
                      "file-encryption"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/case/_bulk:
    patch:
      tags:
      - Case
      summary: Update multiple cases
      description: |
        Apply the same field updates to multiple cases at once. Only the fields
        included in the request body are modified on each case. Omitted fields
        retain their current values. To update a single case, use
        `PATCH /api/v1/case/{idOrName}`.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Bulk update case
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCaseWithIds'
        required: true
      responses:
        '204':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/case/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ],
            "title": "Suspicious Ransomware Activity — CORP-LAPTOP-056",
            "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
            "severity": 3,
            "startDate": 1748736000000,
            "endDate": 1748995200000,
            "tags": [
              "file-encryption",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "status": "InProgress",
            "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
            "assignee": "sami@example.com",
            "impactStatus": "NotApplicable",
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "taskRule": "manual",
            "observableRule": "manual",
            "addTags": [
              "ransomware",
              "endpoint"
            ],
            "removeTags": [
              "file-encryption"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/case/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ],
                  "title": "Suspicious Ransomware Activity — CORP-LAPTOP-056",
                  "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
                  "severity": 3,
                  "startDate": 1748736000000,
                  "endDate": 1748995200000,
                  "tags": [
                      "file-encryption",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "status": "InProgress",
                  "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
                  "assignee": "sami@example.com",
                  "impactStatus": "NotApplicable",
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "taskRule": "manual",
                  "observableRule": "manual",
                  "addTags": [
                      "ransomware",
                      "endpoint"
                  ],
                  "removeTags": [
                      "file-encryption"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/case/_merge/{ids}:
    post:
      tags:
      - Case
      summary: Merge cases into a new case
      description: |
        Merge two or more cases to consolidate related investigations
        into a single case created for the merge. Tasks, observables,
        alerts, TTPs, comments, attachments, pages, and custom
        fields from all source cases are moved into the new case,
        concatenating values for custom fields from all cases without
        duplicates. The source cases are deleted, and duplicate
        observables and tasks are automatically deduplicated.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/merge`
      operationId: Merge cases
      parameters:
      - name: ids
        in: path
        description: List of case IDs preceded by `~`, or case numbers.
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/merge
  /api/v1/case/{caseId}/alert/{alertId}:
    delete:
      tags:
      - Case
      summary: Unlink an alert from a case
      description: |
        Remove the link between an alert and a case when the alert
        no longer relates to the investigation, or if it was linked
        incorrectly. An alert is linked to a case when a case is
        created from the alert, or when the alert is added to
        an existing case.

        When unlinked, the alert status changes to a status in the
        *New* stage, regardless of its previous status. Alert data,
        including observables, TTPs, attachments, comments, and custom fields,
        remains in the case.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers, and with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageCase/update`
      operationId: Unlink alert from case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
  /api/v1/case/{caseId}/observable/_merge:
    post:
      tags:
      - Case
      summary: Deduplicate observables in a case
      description: |
        Deduplicate observables in a case. Observables sharing the
        same type and value are consolidated into one: TheHive updates
        the surviving observable with combined metadata from all
        duplicates and deletes the duplicates.

        TheHive runs deduplication automatically during case merges
        and alert imports. Use this endpoint to trigger it explicitly,
        for example after importing observables through external
        tooling.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Merge similar observables of this case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputMergeCases'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
  /api/v1/case/{caseId}/links:
    get:
      tags:
      - Case
      summary: List similar cases
      description: |
        **Deprecated.** Use the `similarCasesLight` query via `POST /api/v1/query` instead.

        Returns cases that share observables with the specified case, along with
        the matching observables for each similar case.
      operationId: Get similar cases
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputCaseWithLinks'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case/customField/{cfId}:
    delete:
      tags:
      - Case
      summary: Remove a custom field from a case
      description: |
        Remove a custom field from a case when it's no longer needed
        or was added incorrectly. The custom field definition remains
        in TheHive and can still be added to other cases.

        Use `GET /api/v1/case/{idOrName}` to retrieve the custom field ID from the `_id` field in the `customFields` array.

        Required permission: `manageCase/update`
      operationId: Delete a custom field
      parameters:
      - name: cfId
        in: path
        description: The custom field ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
  /api/v1/case/import:
    post:
      tags:
      - Case
      summary: Create a case from an archive
      description: |
        Create a case from a THAR archive file. Typical uses include basing
        a new investigation on a past one, or transferring a case
        from another TheHive instance. Observables, TTPs, tasks,
        comments, attachments, pages, and custom fields from the
        archive are restored into the new case.

        Required permission: `manageCase/create`
        Required license: Gold, Platinum, or One

        Prerequisites: A THAR archive file and its password, obtained by exporting a case
          with `GET /api/v1/case/{caseId}/export`.
      operationId: Import Case from file
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - file
              properties:
                _json:
                  $ref: '#/components/schemas/InputImportCase'
                file:
                  type: string
                  format: binary
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputImportCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.importArchive
      x-TheHive-permissions:
      - manageCase/create
  /api/v1/case/{caseId}/export:
    get:
      tags:
      - Case
      summary: Export a case as an archive
      description: |
        Export a case as a THAR archive file to preserve
        the full investigation for later reuse. Typical uses include
        basing a new investigation on a past one, or transferring a
        case to another TheHive instance. The
        archive includes all case data: tasks, observables, TTPs,
        comments, and attachments.

        To restore the archive as a new case, use
        `POST /api/v1/case/import`.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required license: Gold, Platinum, or One
      operationId: Export Case as archive
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: password
        in: query
        description: Password to encrypt the archive. Required when restoring it via
          `POST /api/v1/case/import`.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Disposition:
              description: Suggested filename for the downloaded archive, in the format
                `attachment; filename=<case-number>.thar`.
              required: true
              schema:
                type: string
            Content-Length:
              description: Size of the archive file in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Type:
              description: Always `application/octet-stream`.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.exportArchive
  /api/v1/case/_bulk/caseTemplate:
    post:
      tags:
      - Case
      summary: Apply a case template to existing cases
      description: |
        Apply a case template to one or more existing cases. For each case,
        you can choose which template elements to apply: title prefix,
        description, tags, severity, flag, TLP, PAP, and custom fields.
        You can also import specific tasks and pages from the template
        into each case.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Apply CaseTemplate on existing cases
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputApplyCaseTemplateWithIds'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/_bulk/caseTemplate" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ],
            "caseTemplate": "Ransomware",
            "updateTitlePrefix": false,
            "updateDescription": false,
            "updateTags": true,
            "updateSeverity": false,
            "updateFlag": false,
            "updateTlp": false,
            "updatePap": false,
            "updateCustomFields": true,
            "importTasks": [
              "~123456789",
              "~987654321"
            ],
            "importPages": [
              "~111111111"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/_bulk/caseTemplate",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ],
                  "caseTemplate": "Ransomware",
                  "updateTitlePrefix": False,
                  "updateDescription": False,
                  "updateTags": True,
                  "updateSeverity": False,
                  "updateFlag": False,
                  "updateTlp": False,
                  "updatePap": False,
                  "updateCustomFields": True,
                  "importTasks": [
                      "~123456789",
                      "~987654321"
                  ],
                  "importPages": [
                      "~111111111"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/owner:
    post:
      tags:
      - Case
      summary: Change the owner organization of a case
      description: |
        Transfer case ownership to another organization. The current owner loses
        access to the case unless `keepProfile` specifies a sharing profile for them.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/changeOwnership`
      operationId: Change Case owning organisation
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputChangeCaseOwnership'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/changeOwnership
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/owner" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisation": "TheOrganization",
            "keepProfile": "analyst",
            "taskRule": "manual",
            "observableRule": "manual"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/owner",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisation": "TheOrganization",
                  "keepProfile": "analyst",
                  "taskRule": "manual",
                  "observableRule": "manual"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/access:
    post:
      tags:
      - Case
      summary: Set the access mode of a case
      description: |
        Set the access mode for a case. You can restrict visibility to specific internal users,
        share with external users through [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/), or restore
        default organization-wide visibility. To update multiple
        cases, use `POST /api/v1/case/_bulk/access`.

        Direct transitions between restricted visibility and
        external access aren't allowed—restore to visible
        access first using `OrganisationAccessKind`.

        Required permission: `manageCaseAccess/restrict` to switch
        to or from restricted visibility, or
        `manageCaseAccess/external` to switch to or from external
        access.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required license: Platinum or One
      operationId: Manage Case access
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputManageCaseAccess'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseAccess/restrict
      - manageCaseAccess/external
      x-TheHive-capabilities:
      - case.access
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/access" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "access": {
              "_kind": "AllExternalAccessKind"
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/access",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "access": {
                      "_kind": "AllExternalAccessKind"
                  }
              },
          )
          response.raise_for_status()
  /api/v1/case/_bulk/access:
    post:
      tags:
      - Case
      summary: Set the access mode of multiple cases
      description: |
        Set the access mode for multiple cases at once. For each
        case, you can restrict visibility to specific internal users,
        share with external users through [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/), or restore
        default organization-wide visibility. To update a single
        case, use `POST /api/v1/case/{caseId}/access`.

        All cases must have the same initial access.

        Direct transitions between restricted visibility and
        external access aren't allowed—restore to visible
        access first using `OrganisationAccessKind`.

        Required permission: `manageCaseAccess/restrict` to switch
        to or from restricted visibility, or
        `manageCaseAccess/external` to switch to or from external
        access.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required license: Platinum or One
      operationId: Bulk Manage Case access
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputManageCaseAccessWithIds'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseAccess/restrict
      - manageCaseAccess/external
      x-TheHive-capabilities:
      - case.access
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/_bulk/access" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ],
            "access": {
              "_kind": "AllExternalAccessKind"
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/_bulk/access",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ],
                  "access": {
                      "_kind": "AllExternalAccessKind"
                  }
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/similar/{alertOrCaseId}/observables:
    get:
      tags:
      - Case
      summary: List observables shared with another case or alert
      description: |
        Returns the observables shared between a case and another case
        or alert. TheHive uses shared observables to detect related
        incidents and surface them in the **Similar cases** and **Similar alerts** tabs.

        Only observables not excluded from similarity checks are
        included. By default, at most 100 observables are returned.
        Administrators can raise this limit in `application.conf`.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers, and with `listAlert` to retrieve available alerts and their IDs.
      operationId: Get similar observables between a case and another case or alert
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: alertOrCaseId
        in: path
        description: The ID of the alert or case, preceded by `~`.
        required: true
        schema:
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputObservable'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case/{caseId}/link/case/add:
    post:
      tags:
      - Case
      summary: Link a case to another case
      description: |
        Create a directed link from a case to another TheHive case.
        Link type categorizes the relationship. Users can pick an existing
        type or create a new one by providing any string.
        Use `GET /api/v1/case/link/types` to list available types.

        This doesn't apply to alert links, which are created automatically
        when a case is created from an alert or when an alert is added to
        an existing case.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Add link with another case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCaseLink'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/link/case/add" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "Duplicate",
            "caseId": "~72637286"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/link/case/add",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "Duplicate",
                  "caseId": "~72637286"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/link/external/add:
    post:
      tags:
      - Case
      summary: Link a case to an external URL
      description: |
        Create a link from a case to an external resource URL.
        Link type categorizes the relationship. Users can pick an existing
        type or create a new one by providing any string.
        Use `GET /api/v1/case/link/types` to list available types.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Add link with an external URL
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputExternalLink'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/link/external/add" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "MITRE ATT&CK",
            "url": "https://attack.mitre.org/techniques/T1486/"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/link/external/add",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "MITRE ATT&CK",
                  "url": "https://attack.mitre.org/techniques/T1486/"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/link/case/remove:
    post:
      tags:
      - Case
      summary: Remove a link to another case
      description: |
        Remove the link from a case to another TheHive case. Provide the
        same link type and case ID or case number used when adding the link.

        Use `POST /api/v1/query` with the `getCase` operation and
        `extraData: ["links"]` to list a case's current links and their
        types.

        Deleting or merging the target case removes its links automatically.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Delete link with an another case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCaseLink'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/link/case/remove" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "Duplicate",
            "caseId": "~72637286"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/link/case/remove",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "Duplicate",
                  "caseId": "~72637286"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/link/external/remove:
    post:
      tags:
      - Case
      summary: Remove a link to an external URL
      description: |
        Remove the link from a case to an external resource URL. Provide the
        same link type and URL used when adding the link.

        Use `POST /api/v1/query` with the `getCase` operation and
        `extraData: ["links"]` to list a case's current links and their
        types.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Delete link with an external URL
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputExternalLink'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/link/external/remove" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "MITRE ATT&CK",
            "url": "https://attack.mitre.org/techniques/T1486/"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/link/external/remove",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "MITRE ATT&CK",
                  "url": "https://attack.mitre.org/techniques/T1486/"
              },
          )
          response.raise_for_status()
  /api/v1/case/link/types:
    get:
      tags:
      - Case
      summary: List all case link types
      description: |
        Returns all link type names currently in use across cases in TheHive.
        Use this to list available types before adding a link. New types are
        created automatically when a new name is provided to
        `POST /api/v1/case/{caseId}/link/case/add` or
        `POST /api/v1/case/{caseId}/link/external/add`.
      operationId: Get all link types
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
                  maxLength: 64
                  minLength: 1
              example:
              - Duplicate
              - MITRE ATT&CK
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/alert:
    post:
      tags:
      - Alert
      summary: Create an alert
      description: |
        Create a new alert in TheHive. Use either a JSON body or a multipart
        body. To attach files as observables at creation time, use multipart.

        Required permission: `manageAlert/create`

        Send a multipart request with the JSON payload in a part named `_json`.
        In `observables`, set `data` for plain-string observables, or set
        `attachment` to the name of another part in the request that holds the
        file. To reference an existing attachment already stored in TheHive,
        set `attachment` to an object containing the `name`, `contentType`,
        and `id` of that attachment.

        You can add observables after creation with
        `POST /api/v1/alert/{alertId}/observable`.

        Create an alert with a hostname observable (data) and a file observable (attachment):

        **curl**
        ```bash
        curl https://<thehive_host>/api/v1/alert \
          -H 'Authorization: Bearer <api_key>' \
          -X POST \
          -F '_json={
            "type": "Endpoint Detection",
            "source": "EDR",
            "sourceRef": "MDATP-2025-004512",
            "title": "File encrypted on CORP-LAPTOP-056",
            "description": "File encryption detected via PowerShell.",
            "observables": [
              {"dataType": "hostname", "data": "CORP-LAPTOP-056"},
              {"dataType": "file", "attachment": "malware_sample"}
            ]
          }' \
          -F 'malware_sample=@/path/to/malware_sample.exe'
        ```

        **python**
        ```python
        import json, requests

        alert = {
            "type": "Endpoint Detection",
            "source": "EDR",
            "sourceRef": "MDATP-2025-004512",
            "title": "File encrypted on CORP-LAPTOP-056",
            "description": "File encryption detected via PowerShell.",
            "observables": [
                {"dataType": "hostname", "data": "CORP-LAPTOP-056"},
                {"dataType": "file", "attachment": "malware_sample"},
            ],
        }
        response = requests.post(
            f"{thehive_host}/api/v1/alert",
            files={
                "_json": json.dumps(alert),
                "malware_sample": open("/path/to/malware_sample.exe", "rb"),
            },
            headers={"Authorization": f"Bearer {api_key}"},
        )
        response.raise_for_status()
        ```
      operationId: Create Alert
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateAlert'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - <attachment_name>
              properties:
                _json:
                  $ref: '#/components/schemas/InputCreateAlert'
                <attachment_name>:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAlert'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/create
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "Endpoint Detection",
            "source": "EDR",
            "sourceRef": "MDATP-2025-004512",
            "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
            "title": "File encrypted on CORP-LAPTOP-056",
            "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
            "severity": 3,
            "date": 1718532000000,
            "tags": [
              "threat-type:file-encryption",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "summary": "File encryption detected via PowerShell on three workstations.",
            "status": "New",
            "assignee": "lucas@example.com",
            "caseTemplate": "Ransomware Investigation",
            "observables": [
              {
                "dataType": "ip",
                "data": "00.01.002.003",
                "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                "startDate": 1640000000000,
                "attachment": {
                  "name": "malware_sample.exe",
                  "contentType": "application/octet-stream",
                  "id": "~128458762",
                  "external": false
                },
                "tlp": 2,
                "pap": 2,
                "tags": [
                  "encrypted"
                ],
                "ioc": true,
                "sighted": false,
                "sightedAt": 1748736000000,
                "ignoreSimilarity": false,
                "isZip": false,
                "zipPassword": "infected"
              }
            ],
            "procedures": [
              {
                "patternId": "T1486",
                "occurDate": 1748739600000,
                "tactic": "impact",
                "description": "PowerShell script used to encrypt files across multiple workstations."
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "Endpoint Detection",
                  "source": "EDR",
                  "sourceRef": "MDATP-2025-004512",
                  "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
                  "title": "File encrypted on CORP-LAPTOP-056",
                  "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
                  "severity": 3,
                  "date": 1718532000000,
                  "tags": [
                      "threat-type:file-encryption",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "summary": "File encryption detected via PowerShell on three workstations.",
                  "status": "New",
                  "assignee": "lucas@example.com",
                  "caseTemplate": "Ransomware Investigation",
                  "observables": [
                      {
                          "dataType": "ip",
                          "data": "00.01.002.003",
                          "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                          "startDate": 1640000000000,
                          "attachment": {
                              "name": "malware_sample.exe",
                              "contentType": "application/octet-stream",
                              "id": "~128458762",
                              "external": False
                          },
                          "tlp": 2,
                          "pap": 2,
                          "tags": [
                              "encrypted"
                          ],
                          "ioc": True,
                          "sighted": False,
                          "sightedAt": 1748736000000,
                          "ignoreSimilarity": False,
                          "isZip": False,
                          "zipPassword": "infected"
                      }
                  ],
                  "procedures": [
                      {
                          "patternId": "T1486",
                          "occurDate": 1748739600000,
                          "tactic": "impact",
                          "description": "PowerShell script used to encrypt files across multiple workstations."
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}:
    get:
      tags:
      - Alert
      summary: Get an alert
      description: |
        Returns the full details of an alert, including metadata,
        custom fields, KPI metrics, and date fields.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.
      operationId: Get Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAlert'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Alert
      summary: Delete an alert
      description: |
        Permanently delete an alert from TheHive. This action is
        irreversible: once deleted, the alert can't be recovered
        by anyone, including the StrangeBee Support team.

        For false positives or duplicates, consider closing the
        alert rather than deleting it. Use `PATCH /api/v1/alert/{alertId}`
        to set the alert to a status linked to the *Closed* stage.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/delete`
      operationId: Delete Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/delete
    patch:
      tags:
      - Alert
      summary: Update an alert
      description: |
        Update one or more fields of a single alert. Only the fields
        included in the request body are modified. Omitted fields retain
        their current values. To update multiple alerts at once, use
        `PATCH /api/v1/alert/_bulk`.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/update`
      operationId: Update Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateAlert'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/alert/{alertId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "Endpoint Detection",
            "source": "EDR",
            "sourceRef": "MDATP-2025-004512",
            "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
            "title": "File encrypted on CORP-LAPTOP-056",
            "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
            "severity": 3,
            "date": 1718532000000,
            "lastSyncDate": 1718532000000,
            "tags": [
              "threat-type:file-encryption",
              "TheOrganization"
            ],
            "tlp": 2,
            "pap": 2,
            "follow": true,
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "status": "InProgress",
            "summary": "File encryption detected via PowerShell on three workstations.",
            "assignee": "lucas@example.com",
            "addTags": [
              "threat-type:file-encryption"
            ],
            "removeTags": [
              "TheOrganization"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "Endpoint Detection",
                  "source": "EDR",
                  "sourceRef": "MDATP-2025-004512",
                  "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
                  "title": "File encrypted on CORP-LAPTOP-056",
                  "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
                  "severity": 3,
                  "date": 1718532000000,
                  "lastSyncDate": 1718532000000,
                  "tags": [
                      "threat-type:file-encryption",
                      "TheOrganization"
                  ],
                  "tlp": 2,
                  "pap": 2,
                  "follow": True,
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "status": "InProgress",
                  "summary": "File encryption detected via PowerShell on three workstations.",
                  "assignee": "lucas@example.com",
                  "addTags": [
                      "threat-type:file-encryption"
                  ],
                  "removeTags": [
                      "TheOrganization"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/_bulk:
    patch:
      tags:
      - Alert
      summary: Update multiple alerts
      description: |
        Apply the same field updates to multiple alerts at once. Only the fields
        included in the request body are modified on each alert. Omitted fields
        retain their current values. To update a single alert, use
        `PATCH /api/v1/alert/{alertId}`.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/update`
      operationId: Bulk update Alert
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateAlertWithIds'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/alert/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ],
            "type": "Endpoint Detection",
            "source": "EDR",
            "sourceRef": "MDATP-2025-004512",
            "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
            "title": "File encrypted on CORP-LAPTOP-056",
            "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
            "severity": 3,
            "date": 1718532000000,
            "lastSyncDate": 1718532000000,
            "tags": [
              "threat-type:file-encryption",
              "TheOrganization"
            ],
            "tlp": 2,
            "pap": 2,
            "follow": true,
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "status": "InProgress",
            "summary": "File encryption detected via PowerShell on three workstations.",
            "assignee": "lucas@example.com",
            "addTags": [
              "threat-type:file-encryption"
            ],
            "removeTags": [
              "TheOrganization"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/alert/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ],
                  "type": "Endpoint Detection",
                  "source": "EDR",
                  "sourceRef": "MDATP-2025-004512",
                  "externalLink": "https://defender.microsoft.com/alerts/MDATP-2025-004512",
                  "title": "File encrypted on CORP-LAPTOP-056",
                  "description": "File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.",
                  "severity": 3,
                  "date": 1718532000000,
                  "lastSyncDate": 1718532000000,
                  "tags": [
                      "threat-type:file-encryption",
                      "TheOrganization"
                  ],
                  "tlp": 2,
                  "pap": 2,
                  "follow": True,
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "status": "InProgress",
                  "summary": "File encryption detected via PowerShell on three workstations.",
                  "assignee": "lucas@example.com",
                  "addTags": [
                      "threat-type:file-encryption"
                  ],
                  "removeTags": [
                      "TheOrganization"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/case:
    post:
      tags:
      - Alert
      summary: Create a case from an alert
      description: |
        Promote an alert to a case during triage. Data from the alert,
        including observables, tactics, techniques, and procedures (TTPs),
        attachments, comments, and custom fields, is automatically transferred
        to the case. The alert is then linked to the new case.

        All fields in the request body are optional. When omitted, the case
        inherits values from the alert. If a `caseTemplate` is provided,
        the template's tasks, custom fields, and pages override the defaults
        inherited from the alert.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/import`
      operationId: Create Case from Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateCaseFromAlert'
        required: false
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/import
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/{alertId}/case" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Suspicious Ransomware Activity",
            "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
            "severity": 3,
            "startDate": 1748736000000,
            "endDate": 1748995200000,
            "tags": [
              "file-encryption",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "status": "New",
            "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
            "assignee": "lucas@example.com",
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "caseTemplate": "Ransomware",
            "tasks": [
              {
                "title": "Isolate affected workstation from the network",
                "group": "Containment",
                "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                "status": "Waiting",
                "flag": false,
                "startDate": 1748476800000,
                "endDate": 1748563200000,
                "order": 1,
                "dueDate": 1748563200000,
                "assignee": "lucas@example.com",
                "mandatory": false
              }
            ],
            "pages": [
              {
                "title": "Investigation Notes",
                "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                "order": 0,
                "category": "Investigation"
              }
            ],
            "sharingParameters": [
              {
                "organisation": "TheOrganization",
                "share": true,
                "profile": "analyst",
                "taskRule": "autoShare",
                "observableRule": "autoShare"
              }
            ],
            "taskRule": "manual",
            "observableRule": "manual"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}/case",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Suspicious Ransomware Activity",
                  "description": "File encryption via PowerShell script (encrypt.ps1) detected on multiple workstations.",
                  "severity": 3,
                  "startDate": 1748736000000,
                  "endDate": 1748995200000,
                  "tags": [
                      "file-encryption",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "status": "New",
                  "summary": "File encryption via PowerShell script (encrypt.ps1) on multiple workstations. Propagation detected before isolation. 632 files encrypted.",
                  "assignee": "lucas@example.com",
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "caseTemplate": "Ransomware",
                  "tasks": [
                      {
                          "title": "Isolate affected workstation from the network",
                          "group": "Containment",
                          "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                          "status": "Waiting",
                          "flag": False,
                          "startDate": 1748476800000,
                          "endDate": 1748563200000,
                          "order": 1,
                          "dueDate": 1748563200000,
                          "assignee": "lucas@example.com",
                          "mandatory": False
                      }
                  ],
                  "pages": [
                      {
                          "title": "Investigation Notes",
                          "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                          "order": 0,
                          "category": "Investigation"
                      }
                  ],
                  "sharingParameters": [
                      {
                          "organisation": "TheOrganization",
                          "share": True,
                          "profile": "analyst",
                          "taskRule": "autoShare",
                          "observableRule": "autoShare"
                      }
                  ],
                  "taskRule": "manual",
                  "observableRule": "manual"
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/follow:
    post:
      tags:
      - Alert
      summary: Follow an alert
      description: |
        Mark an alert as followed so TheHive resumes automatic
        updates from MISP when the corresponding MISP event changes.
        This is the counterpart to `POST /api/v1/alert/{alertId}/unfollow`.
        Alerts created from MISP events are followed by default.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/update`
      operationId: Follow Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
  /api/v1/alert/{alertId}/unfollow:
    post:
      tags:
      - Alert
      summary: Unfollow an alert
      description: |
        Mark an alert as unfollowed to stop automatic updates from
        MISP when the corresponding MISP event changes. This is the
        counterpart to `POST /api/v1/alert/{alertId}/follow`.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/update`
      operationId: Unfollow Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
  /api/v1/alert/{alertId}/merge/{caseId}:
    post:
      tags:
      - Alert
      summary: Merge an alert into an existing case
      description: |
        Add an alert into an existing case during triage. Observables,
        procedures (TTPs), attachments, tags, and
        custom fields from the alert are transferred to the case, and the
        alert description is appended to the case description. The alert is
        then linked to the case and set to the *Imported* status.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageAlert/import`
      operationId: Merge Alert with Case
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/import
  /api/v1/alert/{alertId}/import/{caseId}:
    post:
      tags:
      - Alert
      summary: Import alert observables and procedures into a case
      description: |
        Import the observables and procedures (TTPs) from an alert into an
        existing case, along with attachments, tags, and custom fields. Unlike
        `POST /api/v1/alert/{alertId}/merge/{caseId}`, this operation doesn't
        append the alert description to the case description. The alert is
        linked to the case and set to the *Imported* status.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageAlert/import`
      operationId: Import Alert observables and procedures in Case
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/import
  /api/v1/alert/merge/_bulk:
    post:
      tags:
      - Alert
      summary: Merge multiple alerts into a case
      description: |
        Merge multiple alerts into an existing case during triage. Observables,
        procedures (TTPs), attachments, tags, and
        custom fields from each alert are transferred to the case, and each
        alert description is appended to the case description. Each alert is
        then linked to the case and set to the *Imported* status.

        By default, you can merge up to 50 alerts at once. You can change
        this limit using the `alert.maxMergeInCase` setting in the
        `application.conf` file.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageAlert/import`
      operationId: Merge bulk Alerts with Case
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputAlertsMergeWithCase'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/import
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/merge/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "caseId": "~216513541",
            "alertIds": [
              "~128458762",
              "~216513542",
              "~354"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/merge/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "caseId": "~216513541",
                  "alertIds": [
                      "~128458762",
                      "~216513542",
                      "~354"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/delete/_bulk:
    post:
      tags:
      - Alert
      summary: Delete multiple alerts
      description: |
        Permanently delete multiple alerts at once. This action is
        irreversible: once deleted, the alerts can't be recovered by
        anyone, including the StrangeBee Support team.

        For false positives or duplicates, consider closing the alerts
        rather than deleting them. Use `PATCH /api/v1/alert/_bulk` to
        set multiple alerts to a status linked to the *Closed* stage.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/delete`
      operationId: Delete Alert in bulk
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - ids
              properties:
                ids:
                  description: Identifiers of the entities to target. IDs must be
                    prefixed with `~`. Case numbers and names are passed as plain
                    strings without a prefix.
                  examples:
                  - - ~128458762
                    - ~216513541
                  type: array
                  items:
                    description: The _id of the entity or its 'name' (depends of the
                      entity)
                    examples:
                    - ~354
                    type: string
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/delete
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/delete/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/delete/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/similar/{alertOrCaseId}/observables:
    get:
      tags:
      - Alert
      summary: List observables shared with another alert or case
      description: |
        Returns the observables shared between an alert and another
        alert or case. TheHive uses shared observables to detect
        related incidents and surface them in the **Similar cases**
        and **Similar alerts** tabs.

        Only observables not excluded from similarity checks are
        included. By default, at most 100 observables are returned.
        Administrators can raise this limit in `application.conf`.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `listCase` to retrieve available cases, their IDs, and numbers.
      operationId: Get similar observables between alert and another alert or case
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: alertOrCaseId
        in: path
        description: The ID of the alert or case, preceded by `~`.
        required: true
        schema:
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputObservable'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case/{caseId}/observable:
    post:
      tags:
      - Observable
      summary: Add an observable to a case
      description: |
        Add one or more observables to an existing case. For observable
        types that hold a string value, send a JSON request. For types that require a file
        attachment (`isAttachment` is `true`), send a multipart request
        with the JSON payload in `_json` and each file in `attachment`.
        Repeat the `attachment` part to upload several files at once.

        When `isZip` is `true`, TheHive unpacks the zip archive and
        creates one observable per file it contains.

        Use `POST /api/v1/query` with `listCase` to retrieve available
        cases, their IDs, and numbers.

        Required permission: `manageObservable`

        Upload a file observable:

        curl
        ```bash
        curl https://<thehive_host>/api/v1/case/{caseId}/observable \
          -H 'Authorization: Bearer <api_key>' \
          -X POST \
          -F '_json={"dataType": "file", "tlp": 2}' \
          -F attachment=@<file_path>
        ```

        python
        ```python
        import json, requests

        response = requests.post(
            f"{thehive_host}/api/v1/case/{caseId}/observable",
            files={
                "_json": json.dumps({"dataType": "file", "tlp": 2}),
                "attachment": open("<file_path>", "rb"),
            },
            headers={"Authorization": f"Bearer {api_key}"},
        )
        response.raise_for_status()
        ```
      operationId: Create Observable in Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: dataType
        in: query
        description: |-
          Observable type name, used only when the `dataType` field is missing from the request body.
          When the request body does include a `dataType` field, that value takes priority and this parameter is ignored.
          Must match an existing observable type defined in TheHive.
          Use `POST /api/v1/query` with `listObservableType` to list available types.
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateObservable'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - attachment
              properties:
                _json:
                  $ref: '#/components/schemas/InputCreateObservable'
                attachment:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputObservable'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservable
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/observable" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "dataType": "ip",
            "data": "00.01.002.003",
            "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
            "startDate": 1640000000000,
            "attachment": {
              "name": "malware_sample.exe",
              "contentType": "application/octet-stream",
              "id": "~128458762",
              "external": false
            },
            "tlp": 2,
            "pap": 2,
            "tags": [
              "encrypted"
            ],
            "ioc": true,
            "sighted": false,
            "sightedAt": 1748736000000,
            "ignoreSimilarity": false,
            "isZip": false,
            "zipPassword": "infected"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/observable",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "dataType": "ip",
                  "data": "00.01.002.003",
                  "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                  "startDate": 1640000000000,
                  "attachment": {
                      "name": "malware_sample.exe",
                      "contentType": "application/octet-stream",
                      "id": "~128458762",
                      "external": False
                  },
                  "tlp": 2,
                  "pap": 2,
                  "tags": [
                      "encrypted"
                  ],
                  "ioc": True,
                  "sighted": False,
                  "sightedAt": 1748736000000,
                  "ignoreSimilarity": False,
                  "isZip": False,
                  "zipPassword": "infected"
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/observable:
    post:
      tags:
      - Observable
      summary: Add an observable to an alert
      description: |
        Add one or more observables to an existing alert. For observable
        types that hold a string value, send a JSON request. For types that require a file
        attachment (`isAttachment` is `true`), send a multipart request
        with the JSON payload in `_json` and each file in `attachment`.
        Repeat the `attachment` part to upload several files at once.

        When `isZip` is `true`, TheHive unpacks the zip archive and
        creates one observable per file it contains.

        Use `POST /api/v1/query` with `listAlert` to retrieve available
        alerts and their IDs.

        Required permission: `manageObservable`

        Upload a file observable:

        curl
        ```bash
        curl https://<thehive_host>/api/v1/alert/{alertId}/observable \
          -H 'Authorization: Bearer <api_key>' \
          -X POST \
          -F '_json={"dataType": "file", "tlp": 2}' \
          -F attachment=@<file_path>
        ```

        python
        ```python
        import json, requests

        response = requests.post(
            f"{thehive_host}/api/v1/alert/{alertId}/observable",
            files={
                "_json": json.dumps({"dataType": "file", "tlp": 2}),
                "attachment": open("<file_path>", "rb"),
            },
            headers={"Authorization": f"Bearer {api_key}"},
        )
        response.raise_for_status()
        ```
      operationId: Create Observable in Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: dataType
        in: query
        description: |-
          Observable type name, used only when the `dataType` field is missing from the request body.
          When the request body does include a `dataType` field, that value takes priority and this parameter is ignored.
          Must match an existing observable type defined in TheHive.
          Use `POST /api/v1/query` with `listObservableType` to list available types.
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateObservable'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - attachment
              properties:
                _json:
                  $ref: '#/components/schemas/InputCreateObservable'
                attachment:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputObservable'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservable
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/{alertId}/observable" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "dataType": "ip",
            "data": "00.01.002.003",
            "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
            "startDate": 1640000000000,
            "attachment": {
              "name": "malware_sample.exe",
              "contentType": "application/octet-stream",
              "id": "~128458762",
              "external": false
            },
            "tlp": 2,
            "pap": 2,
            "tags": [
              "encrypted"
            ],
            "ioc": true,
            "sighted": false,
            "sightedAt": 1748736000000,
            "ignoreSimilarity": false,
            "isZip": false,
            "zipPassword": "infected"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}/observable",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "dataType": "ip",
                  "data": "00.01.002.003",
                  "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                  "startDate": 1640000000000,
                  "attachment": {
                      "name": "malware_sample.exe",
                      "contentType": "application/octet-stream",
                      "id": "~128458762",
                      "external": False
                  },
                  "tlp": 2,
                  "pap": 2,
                  "tags": [
                      "encrypted"
                  ],
                  "ioc": True,
                  "sighted": False,
                  "sightedAt": 1748736000000,
                  "ignoreSimilarity": False,
                  "isZip": False,
                  "zipPassword": "infected"
              },
          )
          response.raise_for_status()
  /api/v1/observable/{observableId}:
    get:
      tags:
      - Observable
      summary: Get an observable
      description: |
        Returns the full details of an observable, including type, value,
        threat indicators, tags, and Cortex analysis reports.
      operationId: Get Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputObservable'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Observable
      summary: Delete an observable
      description: |
        Permanently delete an observable from a case or alert. This action is
        irreversible.

        To keep the observable but exclude it from threat correlation, use
        `PATCH /api/v1/observable/{observableId}` to set `ignoreSimilarity`
        to `true`.

        Use `POST /api/v1/query` with `listObservable` to retrieve observables and their IDs.

        Required permission: `manageObservable`
      operationId: Delete Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservable
    patch:
      tags:
      - Observable
      summary: Update an observable
      description: |
        Update one or more fields of a single observable. Only the fields
        included in the request body are modified. Omitted fields retain
        their current values. To update multiple observables at once, use
        `PATCH /api/v1/observable/_bulk`.

        Use `POST /api/v1/query` with `listObservable` to retrieve observables and their IDs.

        Required permission: `manageObservable`
      operationId: Update Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateObservable'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservable
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/observable/{observableId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "dataType": "domain",
            "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
            "tlp": 2,
            "pap": 2,
            "tags": [
              "threat-type:file-encryption",
              "TheOrganization"
            ],
            "ioc": true,
            "sighted": false,
            "sightedAt": 1748822400000,
            "ignoreSimilarity": false,
            "addTags": [
              "threat-type:file-encryption"
            ],
            "removeTags": [
              "TheOrganization"
            ],
            "external": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/observable/{observableId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "dataType": "domain",
                  "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                  "tlp": 2,
                  "pap": 2,
                  "tags": [
                      "threat-type:file-encryption",
                      "TheOrganization"
                  ],
                  "ioc": True,
                  "sighted": False,
                  "sightedAt": 1748822400000,
                  "ignoreSimilarity": False,
                  "addTags": [
                      "threat-type:file-encryption"
                  ],
                  "removeTags": [
                      "TheOrganization"
                  ],
                  "external": False
              },
          )
          response.raise_for_status()
  /api/v1/observable/_bulk:
    patch:
      tags:
      - Observable
      summary: Update multiple observables
      description: |
        Apply the same field updates to multiple observables at once. Only the fields
        included in the request body are modified on each observable. Omitted fields
        retain their current values. To update a single observable, use
        `PATCH /api/v1/observable/{observableId}`.

        Use `POST /api/v1/query` with `listObservable` to retrieve observables and their IDs.

        Required permission: `manageObservable`
      operationId: Update bulk of Observables
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateObservableWithIds'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservable
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/observable/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ],
            "dataType": "domain",
            "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
            "tlp": 2,
            "pap": 2,
            "tags": [
              "threat-type:file-encryption",
              "TheOrganization"
            ],
            "ioc": true,
            "sighted": false,
            "sightedAt": 1748822400000,
            "ignoreSimilarity": false,
            "addTags": [
              "threat-type:file-encryption"
            ],
            "removeTags": [
              "TheOrganization"
            ],
            "external": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/observable/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ],
                  "dataType": "domain",
                  "message": "Source IP of the ransomware C2 server detected on CORP-LAPTOP-056",
                  "tlp": 2,
                  "pap": 2,
                  "tags": [
                      "threat-type:file-encryption",
                      "TheOrganization"
                  ],
                  "ioc": True,
                  "sighted": False,
                  "sightedAt": 1748822400000,
                  "ignoreSimilarity": False,
                  "addTags": [
                      "threat-type:file-encryption"
                  ],
                  "removeTags": [
                      "TheOrganization"
                  ],
                  "external": False
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/task:
    post:
      tags:
      - Task
      summary: Create a task in a case
      description: |
        Create a new task in the specified case. Tasks organize investigative
        activities and can be grouped by category for easier navigation.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageTask`
      operationId: Create Task in Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateTask'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTask'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/task" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Isolate affected workstation from the network",
            "group": "Containment",
            "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
            "status": "Waiting",
            "flag": false,
            "startDate": 1748476800000,
            "endDate": 1748563200000,
            "order": 1,
            "dueDate": 1748563200000,
            "assignee": "lucas@example.com",
            "mandatory": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/task",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Isolate affected workstation from the network",
                  "group": "Containment",
                  "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                  "status": "Waiting",
                  "flag": False,
                  "startDate": 1748476800000,
                  "endDate": 1748563200000,
                  "order": 1,
                  "dueDate": 1748563200000,
                  "assignee": "lucas@example.com",
                  "mandatory": False
              },
          )
          response.raise_for_status()
  /api/v1/task/{taskId}:
    get:
      tags:
      - Task
      summary: Get a task
      description: |
        Returns the full details of a task, including its status,
        assignee, dates, group, and metadata.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.
      operationId: Get Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTask'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Task
      summary: Delete a task
      description: |
        Permanently delete a task from TheHive. This action is
        irreversible: once deleted, the task can't be recovered
        by anyone, including the StrangeBee Support team.

        For finished or abandoned work, consider updating the task
        status instead. Use `PATCH /api/v1/task/{taskId}` to set the
        task to `Completed` or `Cancel`.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.

        Required permission: `manageTask`
      operationId: Delete Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
    patch:
      tags:
      - Task
      summary: Update a task
      description: |
        Update one or more fields of a single task. Only the fields
        included in the request body are modified. Omitted fields retain
        their current values. To update multiple tasks at once, use
        `PATCH /api/v1/task/_bulk`.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.

        Required permission: `manageTask`
      operationId: Update Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateTask'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/task/{taskId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Isolate affected workstation from the network",
            "group": "Containment",
            "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
            "status": "InProgress",
            "flag": false,
            "startDate": 1748476800000,
            "endDate": 1748563200000,
            "order": 1,
            "dueDate": 1748563200000,
            "assignee": "sami@example.com",
            "mandatory": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/task/{taskId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Isolate affected workstation from the network",
                  "group": "Containment",
                  "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                  "status": "InProgress",
                  "flag": False,
                  "startDate": 1748476800000,
                  "endDate": 1748563200000,
                  "order": 1,
                  "dueDate": 1748563200000,
                  "assignee": "sami@example.com",
                  "mandatory": False
              },
          )
          response.raise_for_status()
  /api/v1/task/_bulk:
    patch:
      tags:
      - Task
      summary: Update multiple tasks
      description: |
        Apply the same field updates to multiple tasks at once. Only the
        fields included in the request body are modified on each task.
        Omitted fields retain their current values. To update a single
        task, use `PATCH /api/v1/task/{taskId}`.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.

        Required permission: `manageTask`
      operationId: Update bulk of Task
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateTaskWithIds'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
  /api/v1/task/{taskId}/actionRequired:
    get:
      tags:
      - Task
      summary: Check action required for a task
      description: |
        Returns whether action is required on a task for each organization
        sharing it. The response maps each organization name to `true` if
        action is required, or `false` otherwise.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.
      operationId: Task actions required
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Map_Boolean'
              example:
                TheOrganization1: true
                TheOrganization2: false
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/task/{taskId}/actionRequired/{orgId}:
    put:
      tags:
      - Task
      summary: Set action required on a task
      description: |
        Mark a task as requiring action from the specified organization.
        Action required is tracked independently and doesn't change the
        task status. This lets you request input or assistance from other
        teams without disrupting the task's progress.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs,
        and `listOrganisation` to retrieve available organizations, their IDs, and names.

        Use `PUT /api/v1/task/{taskId}/actionDone/{orgId}` to clear
        action required once the organization has acted.
      operationId: Set Task as required by organisation
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/task/{taskId}/actionDone/{orgId}:
    put:
      tags:
      - Task
      summary: Set action done on a task
      description: |
        Clear action required for the specified organization on a task,
        indicating that the organization has taken the required action.
        This doesn't change the task status.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs,
        and `listOrganisation` to retrieve available organizations, their IDs, and names.
      operationId: Set Task as done by organisation
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/task/{taskId}/log:
    post:
      tags:
      - Task Log
      summary: Create a task log
      description: |
        Create a task log to record actions, observations, and
        decisions in response to a task. Task logs can be created
        at any time, regardless of the task's current status.

        Use `GET /api/v1/query` with `listTask` to retrieve
        available tasks and their IDs.

        Required permission: `manageTask`
      operationId: Create Task Log
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateLog'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - attachments
              properties:
                _json:
                  $ref: '#/components/schemas/InputCreateLog'
                attachments:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputLog'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/task/{taskId}/log" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "message": "Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence of code injection into explorer.exe.",
            "startDate": 1742048580000,
            "includeInTimeline": 1742046000000
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/task/{taskId}/log",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "message": "Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence of code injection into explorer.exe.",
                  "startDate": 1742048580000,
                  "includeInTimeline": 1742046000000
              },
          )
          response.raise_for_status()
  /api/v1/log/{logId}:
    delete:
      tags:
      - Task Log
      summary: Delete a task log
      description: |
        Delete a task log from TheHive when it's no longer needed.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve
        the task's logs and their IDs.

        Required permission: `manageTask`
      operationId: Delete Task Log
      parameters:
      - name: logId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
    patch:
      tags:
      - Task Log
      summary: Update a task log
      description: |
        Update the content or timeline pin of a task log.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve
        the task's logs and their IDs.

        Required permission: `manageTask`
      operationId: Update Task Log
      parameters:
      - name: logId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateLog'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/log/{logId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "message": "Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence of code injection into explorer.exe.",
            "includeInTimeline": 1742046000000
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/log/{logId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "message": "Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence of code injection into explorer.exe.",
                  "includeInTimeline": 1742046000000
              },
          )
          response.raise_for_status()
  /api/v1/log/{logId}/attachments:
    post:
      tags:
      - Task Log
      summary: Add attachments to a task log
      description: |
        Add one or more files to an existing task log.
        Send a `multipart/form-data` request with files
        in the `attachments` field.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve
        the task's logs and their IDs.

        Required permission: `manageTask`
      operationId: Add attachments to Task Log
      parameters:
      - name: logId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAddAttachments'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
  /api/v1/log/{logId}/attachments/{attachmentId}:
    delete:
      tags:
      - Task Log
      summary: Delete an attachment from a task log
      description: |
        Permanently delete an attachment from a task log.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve
        the task's logs and their IDs. Use `getLog` followed by `attachments`
        to retrieve the task log's attachment IDs.

        Required permission: `manageTask`
      operationId: Delete attachment from Task Log
      parameters:
      - name: logId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTask
  /api/v1/page:
    post:
      tags:
      - Page
      summary: Create a Knowledge Base page
      description: |
        Create a Knowledge Base page in the organization.
        Knowledge Base pages are shared across the entire organization and are
        intended for long-term reference, such as lessons learned, reports, and
        meeting notes. They support
        [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/)
        for formatting.

        To create a temporary page scoped to a specific case investigation,
        use `POST /api/v1/case/{caseId}/page` instead.

        Required permission: `manageKnowledgeBase`
      operationId: Create a Page
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreatePage'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputPage'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageKnowledgeBase
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/page" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 0,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/page",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 0,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/page/{pageId}:
    delete:
      tags:
      - Page
      summary: Delete a Knowledge Base page
      description: |
        Delete a Knowledge Base page from the organization.

        Use `POST /api/v1/query` with `listOrganisationPage` to retrieve available
        Knowledge Base pages and their IDs.

        Required permission: `manageKnowledgeBase`
      operationId: Delete a Page
      parameters:
      - name: pageId
        in: path
        description: The page ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageKnowledgeBase
    patch:
      tags:
      - Page
      summary: Update a Knowledge Base page
      description: |
        Update one or more fields of a Knowledge Base page.
        Only the fields provided in the request body are updated.

        Use `POST /api/v1/query` with `listOrganisationPage` to retrieve available
        Knowledge Base pages and their IDs.

        Required permission: `manageKnowledgeBase`
      operationId: Update a Page
      parameters:
      - name: pageId
        in: path
        description: The page ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdatePage'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageKnowledgeBase
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/page/{pageId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 1,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/page/{pageId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 1,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/page:
    post:
      tags:
      - Page
      summary: Create a case page
      description: |
        Create a page attached to a specific case in TheHive.
        Case pages are intended for temporary documentation
        useful during investigations. They support
        [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/)
        for formatting.

        To create a page intended for long-term reference across the organization,
        use `POST /api/v1/page` instead.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases and their IDs.

        Required permission: `managePage`
      operationId: Create a Page in a Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreatePage'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputPage'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePage
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/page" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 0,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/page",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 0,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/page/{pageId}:
    delete:
      tags:
      - Page
      summary: Delete a case page
      description: |
        Delete a case page from a case.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        then with `getCase` followed by `pages` to retrieve the pages attached to that case and their IDs.

        Required permission: `managePage`
      operationId: Delete a Page in a Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: pageId
        in: path
        description: The page ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePage
    patch:
      tags:
      - Page
      summary: Update a case page
      description: |
        Update one or more fields of a case page.
        Only the fields provided in the request body are updated.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        then with `getCase` followed by `pages` to retrieve the pages attached to that case and their IDs.

        Required permission: `managePage`
      operationId: Update a Page in a Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: pageId
        in: path
        description: The page ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdatePage'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePage
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/case/{caseId}/page/{pageId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 1,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/page/{pageId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 1,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/comment:
    post:
      tags:
      - Comment
      summary: Add a comment to a case
      description: |
        Add a comment to a case. Comments are short conversational notes—unlike
        pages, which are structured Markdown documents—used to document investigation
        progress, share findings with team members, or provide updates to stakeholders.
        Comments are visible to all organizations sharing the case. For cases shared through
        [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/),
        you can share the comment with external portal users by setting `external` to `true`
        (requires a Platinum or One license).

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageComment`
      operationId: Create Comment in Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputComment'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputComment'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageComment
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/comment" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "message": "Confirmed as ransomware. Containment measures initiated.",
            "external": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/comment",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "message": "Confirmed as ransomware. Containment measures initiated.",
                  "external": False
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/comment:
    post:
      tags:
      - Comment
      summary: Add a comment to an alert
      description: |
        Add a comment to an alert. Comments are short conversational notes—unlike
        pages, which are structured Markdown documents—used to document triage decisions,
        share initial findings, or provide context for escalation decisions.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageComment`
      operationId: Create Comment in Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputComment'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputComment'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageComment
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/{alertId}/comment" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "message": "Confirmed as ransomware. Containment measures initiated.",
            "external": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}/comment",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "message": "Confirmed as ransomware. Containment measures initiated.",
                  "external": False
              },
          )
          response.raise_for_status()
  /api/v1/comment/{commentId}:
    delete:
      tags:
      - Comment
      summary: Delete a comment
      description: |
        Delete a comment from a case or alert.

        Use `POST /api/v1/query` with `getCase` followed by `comments`, or
        with `getAlert` followed by `comments`, to retrieve comment IDs.

        Required permission: `manageComment`
      operationId: Delete Comment
      parameters:
      - name: commentId
        in: path
        description: The comment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageComment
    patch:
      tags:
      - Comment
      summary: Update a comment
      description: |
        Update the text or portal visibility of a comment. Only the comment author
        can update the text. An internal user with `manageComment` permission can
        change the portal visibility of an external comment without modifying the text.

        Use `POST /api/v1/query` with `getCase` followed by `comments`, or
        with `getAlert` followed by `comments`, to retrieve comment IDs.

        Required permission: `manageComment`
      operationId: Update Comment
      parameters:
      - name: commentId
        in: path
        description: The comment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputComment'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageComment
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/comment/{commentId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "message": "Confirmed as ransomware. Containment measures initiated.",
            "external": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/comment/{commentId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "message": "Confirmed as ransomware. Containment measures initiated.",
                  "external": False
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/timeline:
    get:
      tags:
      - Case
      - Timeline
      summary: Get the timeline of a case
      description: |+
        Returns the activity timeline of a case—a chronological list of
        events that occurred during the case lifecycle. Events include
        case status changes, alert occurrences, task activity, flagged
        task logs, IOC sightings, TTPs occurrences, and custom events.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required license: Gold, Platinum, or One

      operationId: Get Case Timeline
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTimeline'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.timeline
  /api/v1/case/{caseId}/customEvent:
    post:
      tags:
      - Timeline
      summary: Add a custom event to a case timeline
      description: |+
        Add a custom event to a case timeline to mark
        significant milestones or activities during an
        investigation in addition to automatically added events.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCustomEvent`

      operationId: Create Custom Event
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCustomEvent'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCustomEvent'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomEvent
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/customEvent" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "date": 1737020400000,
            "endDate": 1737025800000,
            "title": "Ransom demand received via email",
            "description": "Attacker sent a ransom demand to the security team requesting payment in exchange for the decryption key."
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/customEvent",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "date": 1737020400000,
                  "endDate": 1737025800000,
                  "title": "Ransom demand received via email",
                  "description": "Attacker sent a ransom demand to the security team requesting payment in exchange for the decryption key."
              },
          )
          response.raise_for_status()
  /api/v1/customEvent/{eventId}:
    delete:
      tags:
      - Timeline
      summary: Delete a custom event
      description: |+
        Delete a custom event from a case timeline.

        Use `POST /api/v1/query` with `listCustomEvent` to
        retrieve available custom events and their IDs.

        Required permission: `manageCustomEvent`

      operationId: Delete a Custom Event
      parameters:
      - name: eventId
        in: path
        description: The custom event ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomEvent
    patch:
      tags:
      - Timeline
      summary: Update a custom event
      description: |+
        Update a custom event in a case timeline. Omit any
        field to leave it unchanged. Set a nullable field to
        `null` to remove its value.

        Use `POST /api/v1/query` with `listCustomEvent` to
        retrieve available custom events and their IDs.

        Required permission: `manageCustomEvent`

      operationId: Update a Custom Event
      parameters:
      - name: eventId
        in: path
        description: The custom event ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCustomEvent'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomEvent
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/customEvent/{eventId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "date": 1737020400000,
            "endDate": 1737025800000,
            "title": "Ransom demand received via email",
            "description": "Attacker sent a ransom demand to the security team requesting payment in exchange for the decryption key."
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/customEvent/{eventId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "date": 1737020400000,
                  "endDate": 1737025800000,
                  "title": "Ransom demand received via email",
                  "description": "Attacker sent a ransom demand to the security team requesting payment in exchange for the decryption key."
              },
          )
          response.raise_for_status()
  /api/v1/caseTemplate:
    post:
      tags:
      - CaseTemplate
      summary: Create a case template
      description: |
        Create a new case template in your organization.
        A case template pre-fills fields when creating a case or
        applying the template to an existing case.

        Required permission: `manageCaseTemplate`
      operationId: Create CaseTemplate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateCaseTemplate'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/caseTemplate" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "Ransomware Response",
            "displayName": "Ransomware Response",
            "titlePrefix": "RAN-",
            "description": "## Summary\n\nRansomware infection detected. Containment and eradication required.",
            "severity": 3,
            "tags": [
              "ransomware",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "summary": "Ransomware case opened following detection of file encryption activity.",
            "tasks": [
              {
                "title": "Isolate affected workstation from the network",
                "group": "Containment",
                "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                "status": "Waiting",
                "flag": false,
                "startDate": 1748476800000,
                "endDate": 1748563200000,
                "order": 1,
                "dueDate": 1748563200000,
                "assignee": "lucas@example.com",
                "mandatory": false
              }
            ],
            "pageTemplateIds": [
              "~354"
            ],
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "pageTemplates": [
              {
                "title": "Investigation Notes",
                "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                "order": 0,
                "category": "Investigation"
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/caseTemplate",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "Ransomware Response",
                  "displayName": "Ransomware Response",
                  "titlePrefix": "RAN-",
                  "description": "## Summary\n\nRansomware infection detected. Containment and eradication required.",
                  "severity": 3,
                  "tags": [
                      "ransomware",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "summary": "Ransomware case opened following detection of file encryption activity.",
                  "tasks": [
                      {
                          "title": "Isolate affected workstation from the network",
                          "group": "Containment",
                          "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                          "status": "Waiting",
                          "flag": False,
                          "startDate": 1748476800000,
                          "endDate": 1748563200000,
                          "order": 1,
                          "dueDate": 1748563200000,
                          "assignee": "lucas@example.com",
                          "mandatory": False
                      }
                  ],
                  "pageTemplateIds": [
                      "~354"
                  ],
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "pageTemplates": [
                      {
                          "title": "Investigation Notes",
                          "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                          "order": 0,
                          "category": "Investigation"
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/caseTemplate/{caseTemplateNameOrId}:
    get:
      tags:
      - CaseTemplate
      summary: Get a case template
      description: |
        Retrieve a case template by name or ID.

        Use `POST /api/v1/query` with `listCaseTemplate` to retrieve
        available case templates and their names.
      operationId: Get CaseTemplate
      parameters:
      - name: caseTemplateNameOrId
        in: path
        description: The case template ID preceded by `~`, or its name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - CaseTemplate
      summary: Delete a case template
      description: |
        Delete a case template permanently. Deleting a template
        doesn't affect cases already created from it.

        Use `POST /api/v1/query` with `listCaseTemplate` to retrieve
        available case templates and their names.

        Required permission: `manageCaseTemplate`
      operationId: Delete CaseTemplate
      parameters:
      - name: caseTemplateNameOrId
        in: path
        description: The case template ID preceded by `~`, or its name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseTemplate
    patch:
      tags:
      - CaseTemplate
      summary: Update a case template
      description: |
        Update fields of an existing case template.
        Only the fields provided in the request body are modified.

        Use `POST /api/v1/query` with `listCaseTemplate` to retrieve
        available case templates and their names.

        Required permission: `manageCaseTemplate`
      operationId: Update CaseTemplate
      parameters:
      - name: caseTemplateNameOrId
        in: path
        description: The case template ID preceded by `~`, or its name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCaseTemplate'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/caseTemplate/{caseTemplateNameOrId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "Ransomware Response",
            "displayName": "Ransomware Response",
            "titlePrefix": "RAN-",
            "description": "## Summary\n\nRansomware infection detected. Containment and eradication required.",
            "severity": 3,
            "tags": [
              "ransomware",
              "TheOrganization"
            ],
            "flag": false,
            "tlp": 2,
            "pap": 2,
            "summary": "Ransomware case opened following detection of file encryption activity.",
            "customFields": {
              "threat-type": "Malware",
              "severity": 3
            },
            "tasks": [
              {
                "title": "Isolate affected workstation from the network",
                "group": "Containment",
                "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                "status": "Waiting",
                "flag": false,
                "startDate": 1748476800000,
                "endDate": 1748563200000,
                "order": 1,
                "dueDate": 1748563200000,
                "assignee": "lucas@example.com",
                "mandatory": false
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/caseTemplate/{caseTemplateNameOrId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "Ransomware Response",
                  "displayName": "Ransomware Response",
                  "titlePrefix": "RAN-",
                  "description": "## Summary\n\nRansomware infection detected. Containment and eradication required.",
                  "severity": 3,
                  "tags": [
                      "ransomware",
                      "TheOrganization"
                  ],
                  "flag": False,
                  "tlp": 2,
                  "pap": 2,
                  "summary": "Ransomware case opened following detection of file encryption activity.",
                  "customFields": {
                      "threat-type": "Malware",
                      "severity": 3
                  },
                  "tasks": [
                      {
                          "title": "Isolate affected workstation from the network",
                          "group": "Containment",
                          "description": "Disconnect CORP-LAPTOP-056 from the network immediately.",
                          "status": "Waiting",
                          "flag": False,
                          "startDate": 1748476800000,
                          "endDate": 1748563200000,
                          "order": 1,
                          "dueDate": 1748563200000,
                          "assignee": "lucas@example.com",
                          "mandatory": False
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/caseTemplate/{caseTemplateNameOrId}/pageTemplate/link:
    put:
      tags:
      - CaseTemplate
      summary: Link page templates to a case template
      description: |
        Replace the full list of page templates linked to a case template.
        All previously linked page templates are detached and replaced
        by the new list. Pass an empty array to remove all links.

        Pages enable creating and sharing information within a team on a case.
        Page templates linked to a case template are automatically created
        on cases when the template is applied.

        Use `POST /api/v1/query` with `listCaseTemplate` to retrieve
        available case templates and their names.

        Required permission: `manageCaseTemplate`
      operationId: Link PageTemplates to a CaseTemplate
      parameters:
      - name: caseTemplateNameOrId
        in: path
        description: The case template ID preceded by `~`, or its name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputLinkPageTemplatesToCaseTemplate'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/caseTemplate/{caseTemplateNameOrId}/pageTemplate/link" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "pageTemplateIds": [
              "~84123",
              "~84456"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/caseTemplate/{caseTemplateNameOrId}/pageTemplate/link",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "pageTemplateIds": [
                      "~84123",
                      "~84456"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/pageTemplate:
    post:
      tags:
      - PageTemplate
      summary: Create a case page template
      description: |
        Create a case page template. Case pages are documents attached to a case for sharing
        notes, reports, and investigation findings. Case page templates predefine a title,
        category, and Markdown content to reuse when adding those pages. Once created,
        a template is available to all users in the organization.

        Required permission: `managePageTemplate`
      operationId: Create a Page Template
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreatePage'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputPage'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePageTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/pageTemplate" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 0,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/pageTemplate",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 0,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/pageTemplate/{pageTemplateId}:
    delete:
      tags:
      - PageTemplate
      summary: Delete a case page template
      description: |
        Delete a case page template. Deleting a template has no effect on pages
        already created from it in cases.

        Use `POST /api/v1/query` with `listPageTemplate` to retrieve available
        page templates and their IDs.

        Required permission: `managePageTemplate`
      operationId: Delete a Page Template
      parameters:
      - name: pageTemplateId
        in: path
        description: The ID of the case page template preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePageTemplate
    patch:
      tags:
      - PageTemplate
      summary: Update a case page template
      description: |
        Update fields of a case page template. All fields are optional—omit any field
        to leave it unchanged.

        Use `POST /api/v1/query` with `listPageTemplate` to retrieve available
        page templates and their IDs.

        Required permission: `managePageTemplate`
      operationId: Update a Page Template
      parameters:
      - name: pageTemplateId
        in: path
        description: The ID of the case page template preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdatePage'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePageTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/pageTemplate/{pageTemplateId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Investigation Notes",
            "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
            "order": 1,
            "category": "Investigation"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/pageTemplate/{pageTemplateId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Investigation Notes",
                  "content": "## Summary\n\nFile encryption via PowerShell script detected on multiple workstations.",
                  "order": 1,
                  "category": "Investigation"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/procedure:
    post:
      tags:
      - TTP
      summary: Add a TTP to a case
      description: |
        Add a TTP record to a case. A TTP links a technique and tactic to the
        case, with the occurrence date and an optional description of how the
        technique was carried out, referred to as the procedure.
        By default, TheHive uses the MITRE ATT&CK catalog, but custom catalogs
        are also supported.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases,
        their IDs, and numbers.

        Required permission: `manageProcedure`
      operationId: Create Procedure for Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputProcedure'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputProcedure'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/procedure" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "patternId": "T1486",
            "occurDate": 1748739600000,
            "tactic": "impact",
            "description": "PowerShell script used to encrypt files across multiple workstations."
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/procedure",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "patternId": "T1486",
                  "occurDate": 1748739600000,
                  "tactic": "impact",
                  "description": "PowerShell script used to encrypt files across multiple workstations."
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/procedures:
    post:
      tags:
      - TTP
      summary: Add multiple TTPs to a case
      description: |
        Add multiple TTP records to a case in a single request. Each entry links
        a technique and tactic to the case, with the occurrence date and an
        optional procedure. By default, TheHive uses the MITRE ATT&CK catalog,
        but custom catalogs are also supported.
        Equivalent to calling `POST /api/v1/case/{caseId}/procedure` once per TTP.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases,
        their IDs, and numbers.

        Required permission: `manageProcedure`
      operationId: Create several Procedures for Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputBulkProcedure'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputProcedure'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/procedures" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "procedures": [
              {
                "patternId": "T1486",
                "occurDate": 1748739600000,
                "tactic": "impact",
                "description": "PowerShell script used to encrypt files across multiple workstations."
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/procedures",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "procedures": [
                      {
                          "patternId": "T1486",
                          "occurDate": 1748739600000,
                          "tactic": "impact",
                          "description": "PowerShell script used to encrypt files across multiple workstations."
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/procedure:
    post:
      tags:
      - TTP
      summary: Add a TTP to an alert
      description: |
        Add a TTP record to an alert. A TTP links a technique and tactic to the
        alert, with the occurrence date and an optional description of how the
        technique was carried out, referred to as the procedure.
        By default, TheHive uses the MITRE ATT&CK catalog, but custom catalogs
        are also supported.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts
        and their IDs.

        Required permission: `manageProcedure`
      operationId: Create Procedure for Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputProcedure'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputProcedure'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/{alertId}/procedure" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "patternId": "T1486",
            "occurDate": 1748739600000,
            "tactic": "impact",
            "description": "PowerShell script used to encrypt files across multiple workstations."
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}/procedure",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "patternId": "T1486",
                  "occurDate": 1748739600000,
                  "tactic": "impact",
                  "description": "PowerShell script used to encrypt files across multiple workstations."
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/procedures:
    post:
      tags:
      - TTP
      summary: Add multiple TTPs to an alert
      description: |
        Add multiple TTP records to an alert in a single request. Each entry links
        a technique and tactic to the alert, with the occurrence date and an
        optional procedure. By default, TheHive uses the MITRE ATT&CK catalog,
        but custom catalogs are also supported.
        Equivalent to calling `POST /api/v1/alert/{alertId}/procedure` once per TTP.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts
        and their IDs.

        Required permission: `manageProcedure`
      operationId: Create several Procedures for Alert
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputBulkProcedure'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputProcedure'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alert/{alertId}/procedures" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "procedures": [
              {
                "patternId": "T1486",
                "occurDate": 1748739600000,
                "tactic": "impact",
                "description": "PowerShell script used to encrypt files across multiple workstations."
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alert/{alertId}/procedures",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "procedures": [
                      {
                          "patternId": "T1486",
                          "occurDate": 1748739600000,
                          "tactic": "impact",
                          "description": "PowerShell script used to encrypt files across multiple workstations."
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/procedure/{procedureId}:
    delete:
      tags:
      - TTP
      summary: Delete a TTP
      description: |
        Permanently delete a TTP from a case or alert. This action can't be undone.

        Use `POST /api/v1/query` with `listProcedure` to retrieve available
        TTPs and their IDs.

        Required permission: `manageProcedure`
      operationId: Delete Procedure
      parameters:
      - name: procedureId
        in: path
        description: The TTP ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
    patch:
      tags:
      - TTP
      summary: Update a TTP
      description: |
        Update the fields of an existing TTP in a case or alert. Only the
        fields included in the request body are modified. Omitted fields
        retain their current values.

        Use `POST /api/v1/query` with `listProcedure` to retrieve available
        TTPs and their IDs.

        Required permission: `manageProcedure`
      operationId: Update Procedure
      parameters:
      - name: procedureId
        in: path
        description: The TTP ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateProcedure'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/procedure/{procedureId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "description": "PowerShell script used to encrypt files across multiple workstations.",
            "occurDate": 1748739600000,
            "patternId": "T1059.001",
            "tactic": "execution"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/procedure/{procedureId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "description": "PowerShell script used to encrypt files across multiple workstations.",
                  "occurDate": 1748739600000,
                  "patternId": "T1059.001",
                  "tactic": "execution"
              },
          )
          response.raise_for_status()
  /api/v1/procedure/delete/_bulk:
    post:
      tags:
      - TTP
      summary: Delete multiple TTPs
      description: |
        Permanently delete multiple TTPs in a single request. This action can't be undone.

        Required permission: `manageProcedure`
      operationId: Delete Procedures in bulk
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - ids
              properties:
                ids:
                  description: Identifiers of the entities to target. IDs must be
                    prefixed with `~`. Case numbers and names are passed as plain
                    strings without a prefix.
                  examples:
                  - - ~128458762
                    - ~216513541
                  type: array
                  items:
                    description: The _id of the entity or its 'name' (depends of the
                      entity)
                    examples:
                    - ~354
                    type: string
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageProcedure
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/procedure/delete/_bulk" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/procedure/delete/_bulk",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/dashboard:
    post:
      tags:
      - Dashboard
      summary: Create a dashboard
      description: |
        Create a dashboard to compile and visualize case, alert,
        observable, and TTP data for your organization. Configure
        widgets from TheHive web interface after creation.

        Required permission: `manageDashboard`
      operationId: Create Dashboard
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateDashboard'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputDashboard'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageDashboard
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/dashboard" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Cases overview",
            "group": "Security operations",
            "description": "Overview of open cases across the organization, grouped by severity and status.",
            "status": "Private",
            "definition": {
              "period": "last3Months",
              "items": [
                {
                  "type": "container",
                  "items": [
                    {
                      "id": "wdgt-1a2b3c",
                      "type": "counter",
                      "options": {
                        "title": "Open cases",
                        "entity": "case",
                        "periodDateField": "_createdAt",
                        "filters": [],
                        "series": [
                          {
                            "agg": "count",
                            "type": "bar",
                            "query": {},
                            "label": "Open cases"
                          }
                        ]
                      }
                    }
                  ]
                }
              ]
            },
            "version": 1
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/dashboard",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Cases overview",
                  "group": "Security operations",
                  "description": "Overview of open cases across the organization, grouped by severity and status.",
                  "status": "Private",
                  "definition": {
                      "period": "last3Months",
                      "items": [
                          {
                              "type": "container",
                              "items": [
                                  {
                                      "id": "wdgt-1a2b3c",
                                      "type": "counter",
                                      "options": {
                                          "title": "Open cases",
                                          "entity": "case",
                                          "periodDateField": "_createdAt",
                                          "filters": [],
                                          "series": [
                                              {
                                                  "agg": "count",
                                                  "type": "bar",
                                                  "query": {},
                                                  "label": "Open cases"
                                              }
                                          ]
                                      }
                                  }
                              ]
                          }
                      ]
                  },
                  "version": 1
              },
          )
          response.raise_for_status()
  /api/v1/dashboard/{dashboardId}:
    get:
      tags:
      - Dashboard
      summary: Get a dashboard
      description: |
        Get a single dashboard by its ID. Any user can view a
        dashboard shared with their organization, or a private
        dashboard they own.

        Use `POST /api/v1/query` with `listDashboard` to retrieve available dashboards and their IDs.
      operationId: Get Dashboard
      parameters:
      - name: dashboardId
        in: path
        description: The dashboard ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputDashboard'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Dashboard
      summary: Delete a dashboard
      description: |
        Delete a dashboard. This action can't be undone.

        Use `POST /api/v1/query` with `listDashboard` to retrieve available dashboards and their IDs.

        Required permission: `manageDashboard`
      operationId: Delete Dashboard
      parameters:
      - name: dashboardId
        in: path
        description: The dashboard ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageDashboard
    patch:
      tags:
      - Dashboard
      summary: Update a dashboard
      description: |
        Update one or more fields of a dashboard. Only the fields
        included in the request body are modified. Omitted fields
        retain their current values. Setting `status` to `Deleted`
        deletes the dashboard.

        Use `POST /api/v1/query` with `listDashboard` to retrieve available dashboards and their IDs.

        Required permission: `manageDashboard`
      operationId: Update Dashboard
      parameters:
      - name: dashboardId
        in: path
        description: The dashboard ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateDashboard'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageDashboard
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/dashboard/{dashboardId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Cases overview",
            "group": "Security operations",
            "description": "Overview of open cases across the organization, grouped by severity and status.",
            "definition": {
              "period": "last3Months",
              "items": [
                {
                  "type": "container",
                  "items": [
                    {
                      "id": "wdgt-1a2b3c",
                      "type": "counter",
                      "options": {
                        "title": "Open cases",
                        "entity": "case",
                        "periodDateField": "_createdAt",
                        "filters": [],
                        "series": [
                          {
                            "agg": "count",
                            "type": "bar",
                            "query": {},
                            "label": "Open cases"
                          }
                        ]
                      }
                    }
                  ]
                }
              ]
            },
            "status": "Private",
            "version": 1
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/dashboard/{dashboardId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Cases overview",
                  "group": "Security operations",
                  "description": "Overview of open cases across the organization, grouped by severity and status.",
                  "definition": {
                      "period": "last3Months",
                      "items": [
                          {
                              "type": "container",
                              "items": [
                                  {
                                      "id": "wdgt-1a2b3c",
                                      "type": "counter",
                                      "options": {
                                          "title": "Open cases",
                                          "entity": "case",
                                          "periodDateField": "_createdAt",
                                          "filters": [],
                                          "series": [
                                              {
                                                  "agg": "count",
                                                  "type": "bar",
                                                  "query": {},
                                                  "label": "Open cases"
                                              }
                                          ]
                                      }
                                  }
                              ]
                          }
                      ]
                  },
                  "status": "Private",
                  "version": 1
              },
          )
          response.raise_for_status()
  /api/v1/dashboard/{dashboardId}/owner:
    post:
      tags:
      - Dashboard
      summary: Change the owner of a dashboard
      description: |
        Transfer ownership of a dashboard to another user.

        Use `POST /api/v1/query` with `listDashboard` to retrieve available dashboards and their IDs.

        Required permission: `manageDashboard` and `manageUser`

        Prerequisites: The dashboard must be shared with your
        organization. Ownership of a private dashboard can't be
        transferred. Use `PATCH /api/v1/dashboard/{dashboardId}`
        with `status` set to `Shared` to share it first.
      operationId: Change Dashboard ownership
      parameters:
      - name: dashboardId
        in: path
        description: The dashboard ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputChangeDashboardOwnership'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageDashboard
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/dashboard/{dashboardId}/owner" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "user": "lucas@example.com"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/dashboard/{dashboardId}/owner",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "user": "lucas@example.com"
              },
          )
          response.raise_for_status()
  /api/v1/alert/{alertId}/attachments:
    post:
      tags:
      - Alert
      summary: Add attachments to an alert
      description: |
        Add one or more files to an alert as attachments. Files are uploaded as
        a multipart form and saved to the configured storage backend.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs.

        Required permission: `manageAlert/update`
      operationId: Add Alert Attachment
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAttachmentsFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAttachments'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
  /api/v1/alert/{alertId}/attachment/{attachmentId}:
    get:
      tags:
      - Alert
      summary: Get an attachment from an alert
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}` instead.

        Stream the binary content of an attachment linked to an alert. Supports
        conditional requests with the `If-None-Match` header: if the attachment
        hasn't changed since the last request, returns `304 Not Modified` with
        an empty body.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `getAlert` followed by `attachments` to retrieve attachment IDs.
      operationId: Get Alert Attachment
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Alert
      summary: Remove an attachment from an alert
      description: |
        Remove an attachment from an alert. The file is unlinked from the alert
        but may still exist in the storage backend if referenced by other objects.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `getAlert` followed by `attachments` to retrieve attachment IDs.

        Required permission: `manageAlert/update`
      operationId: Delete Alert Attachment
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAlert/update
  /api/v1/alert/{alertId}/attachment/{attachmentId}/download:
    get:
      tags:
      - Alert
      summary: Download an attachment from an alert
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}/download` instead.

        Stream the binary content of an attachment linked to an alert. The response
        includes content-type, content-length, and content-disposition headers.

        Use `POST /api/v1/query` with `listAlert` to retrieve available alerts and their IDs,
        and `getAlert` followed by `attachments` to retrieve attachment IDs.
      operationId: Download Alert Attachment
      parameters:
      - name: alertId
        in: path
        description: The alert ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case/{caseId}/attachments:
    post:
      tags:
      - Case
      summary: Add attachments to a case
      description: |
        Add one or more files to a case as attachments. Files are uploaded as
        a multipart form and saved to the configured storage backend.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageCase/update`
      operationId: Add Attachment to Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAttachmentsFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAttachments'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
  /api/v1/case/{caseId}/attachment/{attachmentId}/download:
    get:
      tags:
      - Case
      summary: Download an attachment from a case
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}/download` instead.

        Stream the binary content of an attachment linked to a case. The response
        includes content-type, content-length, and content-disposition headers.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        and `getCase` followed by `attachments` to retrieve attachment IDs.
      operationId: Download Attachment from case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/case/{caseId}/attachment/{attachmentId}:
    get:
      tags:
      - Case
      summary: Get an attachment from a case
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}` instead.

        Stream the binary content of an attachment linked to a case. Supports
        conditional requests with the `If-None-Match` header: if the attachment
        hasn't changed since the last request, returns `304 Not Modified` with
        an empty body.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        and `getCase` followed by `attachments` to retrieve attachment IDs.
      operationId: Get Attachment from case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Case
      summary: Remove an attachment from a case
      description: |
        Remove an attachment from a case. The file is unlinked from the case
        but may still exist in the storage backend if referenced by other objects.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        and `getCase` followed by `attachments` to retrieve attachment IDs.

        Required permission: `manageCase/update`
      operationId: Delete Case Attachment
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
    patch:
      tags:
      - Case
      summary: Update a case attachment
      description: |
        Update the properties of an attachment in a case. Currently, only the
        `external` flag can be changed, which controls whether the attachment
        is accessible to external users through
        [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers,
        and `getCase` followed by `attachments` to retrieve attachment IDs.

        Required permission: `manageCase/update`

        Required license: Platinum or One
      operationId: Update Attachment
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateAttachment'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/update
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/case/{caseId}/attachment/{attachmentId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "external": true
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/attachment/{attachmentId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "external": True
              },
          )
          response.raise_for_status()
  /api/v1/log/{logId}/attachment/{attachmentId}/download:
    get:
      tags:
      - Task Log
      summary: Download an attachment from a task log
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}/download` instead.

        Stream the binary content of an attachment linked to a task log.
        The response includes content-type, content-length, and
        content-disposition headers.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve the task's
        logs and their IDs, and `getLog` followed by `attachments` to retrieve attachment IDs.
      operationId: Download Attachment from log
      parameters:
      - name: logId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/log/{caseId}/attachment/{attachmentId}:
    get:
      tags:
      - Task Log
      summary: Get an attachment from a task log
      description: |
        Deprecated. Use `GET /api/v1/attachment/{attachmentId}` instead.

        Stream the binary content of an attachment linked to a task log.
        Supports conditional requests with the `If-None-Match` header: if
        the attachment hasn't changed since the last request, returns
        `304 Not Modified` with an empty body.

        Use `POST /api/v1/query` with `getTask` and then `logs` to retrieve the task's
        logs and their IDs, and `getLog` followed by `attachments` to retrieve attachment IDs.
      operationId: Get Attachment from log
      parameters:
      - name: caseId
        in: path
        description: The task log ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/observable/{observableId}/attachment/{attachmentId}/download:
    get:
      tags:
      - Observable
      summary: Download an attachment from an observable
      description: |
        Download the file attached to a file-type observable. The response body
        is the raw file content, streamed as binary data.

        Use `POST /api/v1/query` with `listObservable` to retrieve observable IDs,
        and `getObservable` followed by `attachments` to retrieve attachment IDs.
      operationId: Download Attachment from observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: asZip
        in: query
        description: When set, wraps the file in a password-protected ZIP archive.
          The default password is `malware`.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/observable/{observableId}/attachment/{attachmentId}:
    get:
      tags:
      - Task Log
      summary: Get an observable attachment
      description: |
        Retrieve the binary content of an attachment linked to an observable.
        Supports conditional requests with the `If-None-Match` header: if
        the attachment hasn't changed since the last request, returns
        `304 Not Modified` with an empty body.

        Use `POST /api/v1/query` with `listObservable` to retrieve available observables
        and their IDs, and `getObservable` followed by `attachments` to retrieve attachment IDs.
      operationId: Get Attachment from observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/attachment:
    post:
      tags:
      - Organization
      summary: Add files to an organization
      description: |
        Add one or more files to an organization. Unlike case attachments,
        which are scoped to a single investigation, organization files are
        permanent.
        Files are uploaded as a multipart form and saved to the configured
        storage backend.

        Required permission: `manageKnowledgeBase`
      operationId: Add Attachment to Organisation
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAttachmentsFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAttachments'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageKnowledgeBase
  /api/v1/attachment/{attachmentId}:
    get:
      tags:
      - Organization
      summary: Get a file from an organization
      description: |
        Stream the binary content of an organization file. Supports
        conditional requests with the `If-None-Match` header: if the
        attachment hasn't changed since the last request, returns
        `304 Not Modified` with an empty body.

        Use `POST /api/v1/query` with `listOrganisation` followed by
        `attachments` to retrieve available attachment IDs.
      operationId: Get Attachment
      parameters:
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
    delete:
      tags:
      - Organization
      summary: Remove a file from an organization
      description: |
        Remove a file from an organization. The file is
        unlinked from the organization but may still exist in the storage
        backend if referenced by other objects.

        Use `POST /api/v1/query` with `listOrganisation` followed by
        `attachments` to retrieve available attachment IDs.

        Required permission: `manageKnowledgeBase`
      operationId: Delete Attachment
      parameters:
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageKnowledgeBase
  /api/v1/attachment/{attachmentId}/download:
    get:
      tags:
      - Organization
      summary: Download a file from an organization
      description: |
        Stream the binary content of an organization file. The response
        includes content-type, content-length, and content-disposition headers.

        Use `POST /api/v1/query` with `listOrganisation` followed by
        `attachments` to retrieve available attachment IDs.
      operationId: Download Attachment
      parameters:
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/user/current/attachments:
    post:
      tags:
      - User
      summary: Upload temporary attachments
      description: |
        Upload one or more files as temporary attachments. Temporary attachments
        aren't linked to any entity yet. Reference them when creating or
        updating a case, alert, or other entity that accepts attachments.
      operationId: Add Temporary Attachment
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAttachmentsFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAttachments'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/login:
    post:
      tags:
      - Authentication
      summary: Log in to TheHive
      description: |
        Log in to TheHive with your login, password, and organization.
        Include a `code` field with the current code from your
        authenticator app if multifactor authentication is enabled
        for your account.

        After too many failed attempts, TheHive temporarily locks
        your account.

        Returns a session cookie for subsequent requests and your
        user profile.
      operationId: Login
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginInput'
        required: true
      responses:
        '200':
          description: Success
          headers:
            Set-Cookie:
              description: Session cookie used to authenticate subsequent requests.
              required: false
              schema:
                type: array
                items:
                  type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputUser'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
  /api/v1/logout:
    get:
      tags:
      - Authentication
      summary: Log out of your session
      description: |
        End your current session and revoke the session cookie. Use
        this GET variant for clients that trigger logout through a
        simple link or redirect.
      operationId: Logout GET
      responses:
        '200':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
    post:
      tags:
      - Authentication
      summary: Log out of your session
      description: |
        End your current session and revoke the session cookie. Use
        this POST variant for clients that avoid sending
        state-changing requests as GET.
      operationId: Logout POST
      responses:
        '200':
          description: ''
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
  /api/v1/auth/totp/get:
    get:
      tags:
      - Authentication
      summary: Get a TOTP secret to set up multifactor authentication
      description: |
        Generate a new secret and one-time password URI to set up
        multifactor authentication on your account. Scan the URI as
        a QR code with your authenticator app, then use
        `POST /api/v1/auth/totp/set` with the secret and a generated
        code to activate it.

        Prerequisites: Multifactor authentication mustn't already
        be configured for your account. Use
        `POST /api/v1/auth/totp/unset` to remove an existing
        configuration first.
      operationId: Get TOTP secret
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTOTPSecret'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/auth/totp/set:
    post:
      tags:
      - Authentication
      summary: Activate multifactor authentication with a TOTP code
      description: |
        Confirm and activate the secret returned by
        `GET /api/v1/auth/totp/get` by verifying the current code
        from your authenticator app.

        Prerequisites: Use `GET /api/v1/auth/totp/get` to obtain
        the secret to confirm.
      operationId: Set TOTP secret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputTOTPCode'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/auth/totp/set" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "code": 123456,
            "secret": "JBSWY3DPEHPK3PXP"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/auth/totp/set",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "code": 123456,
                  "secret": "JBSWY3DPEHPK3PXP"
              },
          )
          response.raise_for_status()
  /api/v1/auth/totp/unset:
    post:
      tags:
      - Authentication
      summary: Deactivate multifactor authentication for your account
      description: |
        Remove the multifactor authentication configuration from
        your account. You can't deactivate multifactor authentication
        for yourself if an administrator enforces it for all users.
      operationId: Unset TOTP secret
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/auth/totp/unset/{user}:
    post:
      tags:
      - Authentication
      summary: Deactivate multifactor authentication for another user
      description: |
        Remove the multifactor authentication configuration from
        another user's account.

        Use `POST /api/v1/query` with `listUser` to retrieve
        available users and their logins.

        If `user` is your own login, this endpoint behaves like
        `POST /api/v1/auth/totp/unset`. Otherwise, it requires the
        `manageUser` permission in any organization you belong to
        that also includes the target user, regardless of which
        organization is selected with `X-Organisation`. Having
        `manageUser` in the `admin` organization lets you target
        any user in any organization.
      operationId: Unset TOTP secret for user
      parameters:
      - name: user
        in: path
        description: ID or login of the user.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/auth/local/passwordPolicy:
    get:
      tags:
      - Authentication
      summary: Get the local authentication password policy
      description: |
        Retrieves the password policy enforced by the local
        authentication provider, applied when a password is set or
        changed:

        - `enabled`: whether a password policy is enforced.
        - `minLength`: minimum number of characters.
        - `minLowerCase`: minimum number of lowercase characters.
        - `minUpperCase`: minimum number of uppercase characters.
        - `minDigit`: minimum number of digits.
        - `minSpecial`: minimum number of special characters.
        - `cannotContainUsername`: whether a password can't contain
          the user's login.

        `minLength`, `minLowerCase`, `minUpperCase`, `minDigit`,
        `minSpecial`, and `cannotContainUsername` are absent from
        the response when no rule is configured for them.
      operationId: Get current password policy
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsObject'
              example:
                enabled: true
                minLength: 12
                minLowerCase: 1
                minUpperCase: 1
                minDigit: 1
                minSpecial: 1
                cannotContainUsername: true
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
  /api/v1/user/current:
    get:
      tags:
      - User
      summary: Get current user info
      description: |
        Returns the user account of the currently authenticated user, including
        their profile, permissions, and organization memberships.
      operationId: Get current User info
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputUser'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/user:
    post:
      tags:
      - User
      summary: Create a user account
      description: |
        Create a new user account in TheHive and add it to the specified
        organization with the given profile. The avatar can't be set
        at creation time. Use `PATCH /api/v1/user/{userId}` after
        creation to set it.

        Required permission: `manageUser`
      operationId: Create User
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateUser'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputUser'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageUser
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/user" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "login": "sami@example.com",
            "name": "Sami Analyst",
            "email": "sami@example.com",
            "password": "Str0ngP@ssw0rd!",
            "profile": "analyst",
            "organisation": "TheOrganization",
            "type": "Normal"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/user",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "login": "sami@example.com",
                  "name": "Sami Analyst",
                  "email": "sami@example.com",
                  "password": "Str0ngP@ssw0rd!",
                  "profile": "analyst",
                  "organisation": "TheOrganization",
                  "type": "Normal"
              },
          )
          response.raise_for_status()
  /api/v1/user/{userId}:
    get:
      tags:
      - User
      summary: Get a user account
      description: |
        Returns a user account by ID or login.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Get User
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputUser'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - User
      summary: Lock a user account
      description: '**Deprecated.** Lock a user account by setting `locked` to `true`.
        Use `PATCH /api/v1/user/{userId}` with `locked: true` instead, which also
        supports unlocking.'
      operationId: Lock User
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      deprecated: true
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageUser
    patch:
      tags:
      - User
      summary: Update a user account
      description: |
        Update one or more fields of a user account. Only the fields included in
        the request body are changed.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Update User
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateUser'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/user/{userId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "Emma Analyst",
            "organisation": "TheOrganization",
            "profile": "analyst",
            "locked": false,
            "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
            "email": "emma@example.com",
            "defaultOrganisation": "TheOrganization",
            "type": "Normal"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/user/{userId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "Emma Analyst",
                  "organisation": "TheOrganization",
                  "profile": "analyst",
                  "locked": False,
                  "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
                  "email": "emma@example.com",
                  "defaultOrganisation": "TheOrganization",
                  "type": "Normal"
              },
          )
          response.raise_for_status()
  /api/v1/user/{userId}/force:
    delete:
      tags:
      - User
      summary: Delete a user account
      description: |
        Permanently delete a user account from TheHive. If an organization is
        specified, the user is removed only from that organization. If no
        organization is specified, the user is deleted from all organizations.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.

        Required permissions: `manageUser`. Deleting a user from all
        organizations at once, by omitting the `organisation`
        parameter, requires calling it with the
        `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete User
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: organisation
        in: query
        description: Name or ID of the organization to remove the user from. Use `POST
          /api/v1/query` with `listOrganisation` to retrieve available organizations.
          If omitted, the user is deleted from all organizations.
        required: false
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
        example: TheOrganization
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageUser
  /api/v1/user/{userId}/organisations:
    put:
      tags:
      - User
      summary: Set user account organizations
      description: |
        Replace the full list of organizations a user account belongs to. Each
        entry specifies an organization, a profile, and whether it is the user's
        default organization. Existing memberships not in the request are removed.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.

        Required permission: `manageUser`
      operationId: Set User Organisations
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputSetUserOrganisations'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputSetUserOrganisations'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageUser
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/user/{userId}/organisations" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              {
                "organisation": "TheOrganization",
                "profile": "analyst",
                "default": true
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/user/{userId}/organisations",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      {
                          "organisation": "TheOrganization",
                          "profile": "analyst",
                          "default": True
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/user/{userId}/password/set:
    post:
      tags:
      - User
      summary: Set a user account password
      description: |
        Set or reset the password of a user account without requiring the current
        password. Use this to assign a new password on behalf of a user.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.

        Required permission: `manageUser`
      operationId: Set user password
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputSetUserPassword'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageUser
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/user/{userId}/password/set" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "password": "Str0ngP@ssw0rd!"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/user/{userId}/password/set",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "password": "Str0ngP@ssw0rd!"
              },
          )
          response.raise_for_status()
  /api/v1/user/{userId}/password/change:
    post:
      tags:
      - User
      summary: Change a user account password
      description: |
        Change the password of the currently authenticated user. Requires
        the current password. The `{userId}` path parameter must be the
        caller's own user ID or login. This endpoint can't be used to
        change another user's password. To reset a password without
        knowing the current one, use
        `POST /api/v1/user/{userId}/password/set`.
      operationId: Change user password
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputChangeUserPassword'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/user/{userId}/password/change" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "password": "N3wStr0ngP@ss!",
            "currentPassword": "Str0ngP@ssw0rd!"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/user/{userId}/password/change",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "password": "N3wStr0ngP@ss!",
                  "currentPassword": "Str0ngP@ssw0rd!"
              },
          )
          response.raise_for_status()
  /api/v1/user/{userId}/key:
    get:
      tags:
      - User
      summary: Get a user API key
      description: |
        Returns the API key of a user account as a plain text string. The key
        can be used as a bearer token to authenticate API requests.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Get User api key
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            text/plain:
              schema:
                type: string
              example: GbxDw3j3qXi5MMCJmLEetMn5ilIjjWtZ
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - User
      summary: Revoke a user API key
      description: |
        Revoke the API key of a user account. After revocation, the key can no
        longer be used to authenticate API requests. Use
        `POST /api/v1/user/{userId}/key/renew` to generate a new key.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Remove User api key
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/user/{userId}/key/renew:
    post:
      tags:
      - User
      summary: Renew a user API key
      description: |
        Generate a new API key for a user account, invalidating any existing key.
        The previous key stops working immediately.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Renew User api key
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            text/plain:
              schema:
                type: string
              example: GbxDw3j3qXi5MMCJmLEetMn5ilIjjWtZ
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/user/{userId}/avatar/{file}:
    get:
      tags:
      - User
      summary: Get a user avatar
      description: |
        Stream the binary content of a user account's avatar image. Supports
        conditional requests with the `If-None-Match` header: if the avatar
        hasn't changed since the last request, returns `304 Not Modified`
        with an empty body.

        Use `POST /api/v1/query` with `listUser` to retrieve available users, their IDs, and their logins.
      operationId: Get User avatar
      parameters:
      - name: userId
        in: path
        description: The user ID preceded by `~`, or the user login.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: file
        in: path
        description: The avatar filename returned in the user's `avatar` field.
        required: true
        schema:
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/organisation:
    post:
      tags:
      - Organization
      summary: Create an organization
      description: |
        Create a new organization. An organization is an independent tenant
        in TheHive with its own users, cases, alerts, and settings. The
        request body can be sent as JSON or as a multipart form to include
        an avatar image file.

        Required permissions: `manageOrganisation`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create Organisation
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateOrganisation'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - avatar
              properties:
                _json:
                  $ref: '#/components/schemas/InputCreateOrganisation'
                avatar:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputOrganisation'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageOrganisation
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/organisation" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "TheOrganization",
            "description": "The primary investigation organization.",
            "taskRule": "manual",
            "observableRule": "manual",
            "locked": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/organisation",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "TheOrganization",
                  "description": "The primary investigation organization.",
                  "taskRule": "manual",
                  "observableRule": "manual",
                  "locked": False
              },
          )
          response.raise_for_status()
  /api/v1/organisation/{orgId}:
    get:
      tags:
      - Organization
      summary: Get an organization
      description: |
        Retrieve the details of an organization by ID or name.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.
      operationId: Get Organisation
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputOrganisation'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    patch:
      tags:
      - Organization
      summary: Update an organization
      description: |
        Update the properties of an organization. Include only the fields
        you want to change—absent fields are left unchanged.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.

        Required permissions: `manageOrganisation`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update Organisation
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateOrganisation'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageOrganisation
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/organisation/{orgId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "TheOrganization",
            "description": "The primary investigation organization.",
            "taskRule": "manual",
            "observableRule": "manual",
            "locked": false,
            "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/organisation/{orgId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "TheOrganization",
                  "description": "The primary investigation organization.",
                  "taskRule": "manual",
                  "observableRule": "manual",
                  "locked": False,
                  "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
              },
          )
          response.raise_for_status()
  /api/v1/organisation/{orgId}/avatar/{fileHash}:
    get:
      tags:
      - Organization
      summary: Get the avatar of an organization
      description: |
        Stream the avatar image of an organization. Supports conditional
        requests with the `If-None-Match` header: if the avatar hasn't
        changed since the last request, returns `304 Not Modified` with
        an empty body.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.
      operationId: Get Organisation avatar
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: fileHash
        in: path
        description: The hash of the avatar file.
        required: true
        schema:
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the image content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/organisation/{orgId}/link/{otherOrgId}:
    put:
      tags:
      - Organization
      summary: Link two organizations
      description: |
        Create a sharing link between two organizations to enable case sharing. The request body
        defines the sharing profiles applied in each direction of the link.
        If no body is provided, the `default` sharing profile is used for
        both directions.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.

        Required permissions: `manageOrganisation`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Link Organisations
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: otherOrgId
        in: path
        description: The ID preceded by `~`, or name of the organization to link with.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputOrganisationLink'
        required: false
      responses:
        '201':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageOrganisation
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/organisation/{orgId}/link/{otherOrgId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "linkType": "default",
            "otherLinkType": "default"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/organisation/{orgId}/link/{otherOrgId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "linkType": "default",
                  "otherLinkType": "default"
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Organization
      summary: Remove a link between two organizations
      description: |
        Remove the sharing link between two organizations. After the link
        is removed, the organizations can no longer share cases with each
        other.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.

        Required permissions: `manageOrganisation`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Unlink Organisations
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: otherOrgId
        in: path
        description: The ID preceded by `~`, or name of the organization to unlink.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageOrganisation
  /api/v1/organisation/{orgId}/links:
    get:
      tags:
      - Organization
      summary: List organization links
      description: |
        Retrieve all organizations linked to a given organization,
        including the sharing profiles applied in each direction.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.
      operationId: List Organisation links
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputOrganisationLink'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    put:
      tags:
      - Organization
      summary: Replace all links for an organization
      description: |
        Replace the complete set of sharing links for an organization.
        All existing links are removed and replaced with the provided list.

        Use `POST /api/v1/query` with `listOrganisation` to retrieve
        available organizations, their IDs, and names.

        Required permissions: `manageOrganisation`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Bulk link Organisations
      parameters:
      - name: orgId
        in: path
        description: The organization ID preceded by `~`, or organization name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputOrganisationBulkLink'
        required: true
      responses:
        '201':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageOrganisation
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/organisation/{orgId}/links" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "links": [
              {
                "toOrganisation": "TheOrganization",
                "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
                "linkType": "default",
                "otherLinkType": "supervised"
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/organisation/{orgId}/links",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "links": [
                      {
                          "toOrganisation": "TheOrganization",
                          "avatar": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
                          "linkType": "default",
                          "otherLinkType": "supervised"
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/sharingProfile:
    get:
      tags:
      - Organization
      summary: List sharing profiles
      description: |
        Retrieve all sharing profiles defined in the platform configuration.
        Sharing profiles determine the default permission level and
        task/observable sharing rules applied when an organization shares
        a case with another.
      operationId: List Sharing Profiles
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputSharingProfile'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/customField:
    get:
      tags:
      - CustomField
      summary: List all custom fields
      description: |+
        Returns all custom fields defined in TheHive. Custom fields
        extend the default set of fields in cases and alerts to
        capture company-specific context such as threat type,
        affected business unit, or incident classification.

      operationId: List CustomFields
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputCustomField'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
    post:
      tags:
      - CustomField
      summary: Create a custom field
      description: |
        Create a new custom field in TheHive. Custom fields extend
        the default set of fields in cases and alerts to capture
        company-specific context such as threat type, affected
        business unit, or incident classification.

        Required permissions: `manageCustomField`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create CustomField
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCustomField'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCustomField'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomField
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/customField" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "threat-type",
            "displayName": "Threat Type",
            "group": "Classification",
            "description": "Type of threat detected in the case.",
            "type": "string",
            "mandatory": true,
            "options": [
              "Malware",
              "Intrusion",
              "Data Leak"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/customField",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "threat-type",
                  "displayName": "Threat Type",
                  "group": "Classification",
                  "description": "Type of threat detected in the case.",
                  "type": "string",
                  "mandatory": True,
                  "options": [
                      "Malware",
                      "Intrusion",
                      "Data Leak"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/customField/{customFieldId}:
    delete:
      tags:
      - CustomField
      summary: Delete a custom field
      description: |
        Delete a custom field from TheHive. If the custom field is
        assigned to one or more cases or alerts, set the `force`
        query parameter to `true` to delete it regardless.

        Use `POST /api/v1/query` with `listCustomField` to retrieve
        available custom fields, their IDs, and names.

        Required permissions: `manageCustomField`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete CustomField
      parameters:
      - name: customFieldId
        in: path
        description: The custom field ID preceded by `~`, or custom field name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: force
        in: query
        description: If `true`, deletes the custom field even when assigned to cases
          or alerts.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomField
    patch:
      tags:
      - CustomField
      summary: Update a custom field
      description: |
        Update an existing custom field in TheHive. Only the fields
        included in the request body are updated—omitted fields
        remain unchanged.

        Use `POST /api/v1/query` with `listCustomField` to retrieve
        available custom fields, their IDs, and names.

        Required permissions: `manageCustomField`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update CustomField
      parameters:
      - name: customFieldId
        in: path
        description: The custom field ID preceded by `~`, or custom field name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCustomField'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCustomField
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/customField/{customFieldId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "displayName": "Threat Type",
            "group": "Classification",
            "description": "Type of threat detected in the case.",
            "type": "string",
            "options": [
              "Malware",
              "Intrusion",
              "Data Leak"
            ],
            "mandatory": true
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/customField/{customFieldId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "displayName": "Threat Type",
                  "group": "Classification",
                  "description": "Type of threat detected in the case.",
                  "type": "string",
                  "options": [
                      "Malware",
                      "Intrusion",
                      "Data Leak"
                  ],
                  "mandatory": True
              },
          )
          response.raise_for_status()
  /api/v1/alertStatus:
    post:
      tags:
      - AlertStatus
      summary: Create an alert status
      description: |
        Create a custom alert status for your organization. An alert status
        represents the current state of an alert and belongs to a stage
        *New*, *In progress*, *Closed*, or *Imported*. The `value` and `stage` fields are immutable and
        can't be changed after creation. Delete and recreate the status if you
        need to change its stage or value.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Create AlertStatus
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateAlertStatus'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAlertStatus'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - alert.customStatus
      x-TheHive-permissions:
      - managePlatform
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/alertStatus" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "value": "FalsePositive",
            "stage": "Closed",
            "order": 2,
            "description": "Alert was analyzed and confirmed as a false positive.",
            "colour": "#52c41a",
            "hidden": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/alertStatus",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "value": "FalsePositive",
                  "stage": "Closed",
                  "order": 2,
                  "description": "Alert was analyzed and confirmed as a false positive.",
                  "colour": "#52c41a",
                  "hidden": False
              },
          )
          response.raise_for_status()
  /api/v1/alertStatus/{id}:
    delete:
      tags:
      - AlertStatus
      summary: Delete an alert status
      description: |
        Delete an alert status from your organization. Predefined TheHive
        statuses and statuses still assigned to alerts can't be
        deleted—use the visibility feature to hide them instead.

        Use `POST /api/v1/query` with `listAlertStatus` to retrieve
        available alert statuses, their IDs, and values.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Delete AlertStatus
      parameters:
      - name: id
        in: path
        description: The alert status ID preceded by `~`, or the status value.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - alert.customStatus
      x-TheHive-permissions:
      - managePlatform
    patch:
      tags:
      - AlertStatus
      summary: Update an alert status
      description: |
        Update the order, description, color, or visibility of an existing
        alert status. The `value` and `stage` fields are immutable and
        can't be changed after creation.

        Use `POST /api/v1/query` with `listAlertStatus` to retrieve
        available alert statuses, their IDs, and values.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Update AlertStatus
      parameters:
      - name: id
        in: path
        description: The alert status ID preceded by `~`, or the status value.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateAlertStatus'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - alert.customStatus
      x-TheHive-permissions:
      - managePlatform
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/alertStatus/{id}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "order": 2,
            "description": "Alert was analyzed and confirmed as a false positive.",
            "colour": "#52c41a",
            "hidden": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/alertStatus/{id}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "order": 2,
                  "description": "Alert was analyzed and confirmed as a false positive.",
                  "colour": "#52c41a",
                  "hidden": False
              },
          )
          response.raise_for_status()
  /api/v1/caseStatus:
    post:
      tags:
      - CaseStatus
      summary: Create a case status
      description: |
        Create a custom case status for your organization. A case status
        represents the current state of a case and belongs to a stage
        *New*, *In progress*, or *Closed*. The `value` and `stage` fields
        are immutable and can't be changed after creation. Delete and
        recreate the status if you need to change its stage or value.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Create CaseStatus
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateCaseStatus'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseStatus'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.customStatus
      x-TheHive-permissions:
      - managePlatform
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/caseStatus" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "value": "Contained",
            "stage": "InProgress",
            "order": 2,
            "description": "Case has been contained but investigation continues.",
            "colour": "#ffa940",
            "hidden": false,
            "requiresImpact": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/caseStatus",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "value": "Contained",
                  "stage": "InProgress",
                  "order": 2,
                  "description": "Case has been contained but investigation continues.",
                  "colour": "#ffa940",
                  "hidden": False,
                  "requiresImpact": False
              },
          )
          response.raise_for_status()
  /api/v1/caseStatus/{id}:
    delete:
      tags:
      - CaseStatus
      summary: Delete a case status
      description: |
        Delete a case status from your organization. Predefined TheHive
        statuses and statuses still assigned to cases can't be
        deleted—use the visibility feature to hide them instead.

        Use `POST /api/v1/query` with `listCaseStatus` to retrieve
        available case statuses, their IDs, and values.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Delete CaseStatus
      parameters:
      - name: id
        in: path
        description: The case status ID preceded by `~`, or the status value.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.customStatus
      x-TheHive-permissions:
      - managePlatform
    patch:
      tags:
      - CaseStatus
      summary: Update a case status
      description: |
        Update the order, description, color, visibility, or impact
        requirement of an existing case status. The `value` and `stage`
        fields are immutable and can't be changed after creation.

        Use `POST /api/v1/query` with `listCaseStatus` to retrieve
        available case statuses, their IDs, and values.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Update CaseStatus
      parameters:
      - name: id
        in: path
        description: The case status ID preceded by `~`, or the status value.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCaseStatus'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.customStatus
      x-TheHive-permissions:
      - managePlatform
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/caseStatus/{id}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "order": 2,
            "description": "Case has been contained but investigation continues.",
            "colour": "#ffa940",
            "hidden": false,
            "requiresImpact": true
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/caseStatus/{id}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "order": 2,
                  "description": "Case has been contained but investigation continues.",
                  "colour": "#ffa940",
                  "hidden": False,
                  "requiresImpact": True
              },
          )
          response.raise_for_status()
  /api/v1/taxonomy:
    post:
      tags:
      - Taxonomy
      summary: Create a taxonomy
      description: |
        Create a taxonomy in TheHive using the MISP taxonomy format.
        Taxonomies are inactive by default after creation. Use
        `PUT /api/v1/taxonomy/{taxonomyId}/activate` to make the
        taxonomy's tags available.

        Required permissions: `manageTaxonomy`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create Taxonomy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputTaxonomy'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTaxonomy'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTaxonomy
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/taxonomy" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "namespace": "tlp",
            "description": "Traffic Light Protocol for information sharing",
            "version": 6,
            "predicates": [
              {
                "value": "white",
                "expanded": "TLP:WHITE",
                "description": "Disclosure is not limited.",
                "colour": "#ffffff"
              }
            ],
            "values": [
              {
                "predicate": "amber",
                "entry": [
                  {
                    "value": "strict",
                    "expanded": "Recipients may share information only within their organization.",
                    "colour": "#ffa800",
                    "description": "Disclosure is restricted to participants'\'' organizations only.",
                    "numerical_value": 50
                  }
                ]
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/taxonomy",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "namespace": "tlp",
                  "description": "Traffic Light Protocol for information sharing",
                  "version": 6,
                  "predicates": [
                      {
                          "value": "white",
                          "expanded": "TLP:WHITE",
                          "description": "Disclosure is not limited.",
                          "colour": "#ffffff"
                      }
                  ],
                  "values": [
                      {
                          "predicate": "amber",
                          "entry": [
                              {
                                  "value": "strict",
                                  "expanded": "Recipients may share information only within their organization.",
                                  "colour": "#ffa800",
                                  "description": "Disclosure is restricted to participants' organizations only.",
                                  "numerical_value": 50
                              }
                          ]
                      }
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/taxonomy/import-zip:
    post:
      tags:
      - Taxonomy
      summary: Import taxonomies from a ZIP archive
      description: |
        Import one or more taxonomies from a ZIP archive. The archive
        must contain at least one file named `machinetag.json` following
        the [MISP taxonomy JSON schema](https://www.misp-standard.org/rfc/misp-standard-taxonomy-format.html). Existing taxonomies with the same
        namespace are updated, new ones are created. Imported taxonomies
        are inactive by default. Use
        `PUT /api/v1/taxonomy/{taxonomyId}/activate` to make each
        taxonomy's tags available.

        Required permissions: `manageTaxonomy`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Import from zip file
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputTaxonomyFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ok'
        '207':
          description: Partial success—some taxonomies were imported and others failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OkWithErrors'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTaxonomy
  /api/v1/taxonomy/{taxonomyId}/activate:
    put:
      tags:
      - Taxonomy
      summary: Activate a taxonomy
      description: |
        Activate a taxonomy, making its tags available on cases,
        alerts, and observables. Activation applies to every
        organization in TheHive.

        Use `POST /api/v1/query` with `listTaxonomy` to retrieve
        available taxonomies, their IDs, and namespaces.

        Required permissions: `manageTaxonomy`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Activate Taxonomy
      parameters:
      - name: taxonomyId
        in: path
        description: The taxonomy ID preceded by `~`, or namespace name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTaxonomy
  /api/v1/taxonomy/{taxonomyId}/deactivate:
    put:
      tags:
      - Taxonomy
      summary: Deactivate a taxonomy
      description: |
        Deactivate a taxonomy, removing its tags from the available
        tag catalog. Deactivation applies to every organization in
        TheHive. The taxonomy data is preserved, you can reactivate
        it later. Tags already added to cases, alerts, and
        observables stay attached.

        Use `POST /api/v1/query` with `listTaxonomy` to retrieve
        available taxonomies, their IDs, and namespaces.

        Required permissions: `manageTaxonomy`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Deactivate Taxonomy
      parameters:
      - name: taxonomyId
        in: path
        description: The taxonomy ID preceded by `~`, or namespace name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTaxonomy
  /api/v1/taxonomy/{taxonomyId}:
    get:
      tags:
      - Taxonomy
      summary: Get a taxonomy
      description: |
        Retrieve a single taxonomy by its ID or namespace name.

        Use `POST /api/v1/query` with `listTaxonomy` to retrieve
        available taxonomies, their IDs, and namespaces.
      operationId: Get Taxonomy
      parameters:
      - name: taxonomyId
        in: path
        description: The taxonomy ID preceded by `~`, or namespace name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTaxonomy'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Taxonomy
      summary: Delete a taxonomy
      description: |
        Delete a taxonomy from TheHive permanently. This action can't be
        undone. The taxonomy's tags are deleted along with it and removed
        from every case, case template, alert, and observable that uses
        them.
        Use `PUT /api/v1/taxonomy/{taxonomyId}/deactivate` instead if you
        want to preserve the taxonomy for future use.

        Use `POST /api/v1/query` with `listTaxonomy` to retrieve
        available taxonomies, their IDs, and namespaces.

        Required permissions: `manageTaxonomy`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete Taxonomy
      parameters:
      - name: taxonomyId
        in: path
        description: The taxonomy ID preceded by `~`, or namespace name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTaxonomy
  /api/v1/permission:
    get:
      tags:
      - Permission
      summary: List all permissions
      description: |
        Returns all permissions available in TheHive, including their names,
        labels, license consumption status, and applicable scopes.
      operationId: List permissions
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionDesc'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/views:
    post:
      tags:
      - Views
      summary: Create a view
      description: |
        Create a view to save the filters, sort order,
        displayed columns, and display options currently
        applied to a list, so you can reapply them without
        rebuilding them each time.

        A view applies to a single list, identified by the
        `entity` field, and is either private to you or
        shared with your entire organization.

        For `entity` values `User`, `Organisation`, `Profiles`,
        `CustomFields`, `ObservableTypes`, `Taxonomies`, or
        `AttackPatterns`, call this endpoint with the
        `X-Organisation: admin` header to target the `admin`
        organization.

        The request body must not exceed 1 MB.
      operationId: Create views
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateListView'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputListView'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/views" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "High severity cases",
            "entity": "Case",
            "filter": {
              "_and": [
                {
                  "_eq": {
                    "_field": "status",
                    "_value": "InProgress"
                  }
                }
              ]
            },
            "listOptions": {
              "itemsPerPage": 50,
              "listAsGroup": false,
              "autoRefresh": true,
              "statsIsOpen": true
            },
            "sortList": [
              "-_createdAt"
            ],
            "showColumns": [
              "tlp",
              "tags"
            ],
            "isShared": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/views",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "High severity cases",
                  "entity": "Case",
                  "filter": {
                      "_and": [
                          {
                              "_eq": {
                                  "_field": "status",
                                  "_value": "InProgress"
                              }
                          }
                      ]
                  },
                  "listOptions": {
                      "itemsPerPage": 50,
                      "listAsGroup": False,
                      "autoRefresh": True,
                      "statsIsOpen": True
                  },
                  "sortList": [
                      "-_createdAt"
                  ],
                  "showColumns": [
                      "tlp",
                      "tags"
                  ],
                  "isShared": False
              },
          )
          response.raise_for_status()
  /api/v1/views/{viewsId}:
    get:
      tags:
      - Views
      summary: Get a view
      description: Returns the view with the given ID.
      operationId: Get views
      parameters:
      - name: viewsId
        in: path
        description: The view ID, with or without being preceded by `~`.
        required: true
        schema:
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputListView'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Views
      summary: Delete a view
      description: |
        Delete a view when you no longer need it.

        You can't delete the *Default* view.

        If you delete a view shared with your
        organization, it's permanently removed for all
        users in the organization.
      operationId: Delete views
      parameters:
      - name: viewsId
        in: path
        description: The view ID, with or without being preceded by `~`.
        required: true
        schema:
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    patch:
      tags:
      - Views
      summary: Update a view
      description: |
        Update the name, filters, sort order, displayed
        columns, display options, or visibility saved in a
        view.

        Only the fields you provide are updated. Fields
        you leave unset keep their current value.

        You can't update the *Default* view.

        If you update a view shared with your
        organization, your changes affect all users in
        the organization.
      operationId: Update views
      parameters:
      - name: viewsId
        in: path
        description: The view ID, with or without being preceded by `~`.
        required: true
        schema:
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateListView'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/views/{viewsId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "High severity cases",
            "filter": {
              "_and": [
                {
                  "_eq": {
                    "_field": "status",
                    "_value": "InProgress"
                  }
                }
              ]
            },
            "listOptions": {
              "itemsPerPage": 50,
              "listAsGroup": false,
              "autoRefresh": true,
              "statsIsOpen": true
            },
            "sortList": [
              "-_createdAt"
            ],
            "showColumns": [
              "tlp",
              "tags"
            ],
            "isShared": true
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/views/{viewsId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "High severity cases",
                  "filter": {
                      "_and": [
                          {
                              "_eq": {
                                  "_field": "status",
                                  "_value": "InProgress"
                              }
                          }
                      ]
                  },
                  "listOptions": {
                      "itemsPerPage": 50,
                      "listAsGroup": False,
                      "autoRefresh": True,
                      "statsIsOpen": True
                  },
                  "sortList": [
                      "-_createdAt"
                  ],
                  "showColumns": [
                      "tlp",
                      "tags"
                  ],
                  "isShared": True
              },
          )
          response.raise_for_status()
  /api/v1/profile:
    post:
      tags:
      - Profile
      summary: Create a profile
      description: |
        Create a custom permission profile in TheHive. Profiles define the
        permissions available to a user within an organization and are assigned
        per user-organization pair.

        Required permissions: `manageProfile`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Create Profile
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateProfile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputProfile'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - users.customProfiles
      x-TheHive-permissions:
      - manageProfile
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/profile" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "type": "Organisation",
            "name": "SOC-Tier1-Analyst",
            "permissions": [
              "manageCase/create",
              "manageCase/update",
              "manageObservable",
              "manageTask"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/profile",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "type": "Organisation",
                  "name": "SOC-Tier1-Analyst",
                  "permissions": [
                      "manageCase/create",
                      "manageCase/update",
                      "manageObservable",
                      "manageTask"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/profile/{profileId}:
    get:
      tags:
      - Profile
      summary: Get a profile
      description: |
        Returns a profile by ID or name.

        Use `POST /api/v1/query` with `listProfile` to retrieve available profiles, their IDs, and names.
      operationId: Get Profile
      parameters:
      - name: profileId
        in: path
        description: The profile ID preceded by `~`, or profile name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputProfile'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Profile
      summary: Delete a profile
      description: |
        Delete a custom permission profile from TheHive. You can't delete a
        profile that's assigned to a user account, or the predefined Admin,
        Org-Admin, Read-Only, External-Reader, or External-Actor profiles.

        Use `POST /api/v1/query` with `listProfile` to retrieve available profiles, their IDs, and names.

        Required permissions: `manageProfile`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Delete Profile
      parameters:
      - name: profileId
        in: path
        description: The profile ID preceded by `~`, or profile name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - users.customProfiles
      x-TheHive-permissions:
      - manageProfile
    patch:
      tags:
      - Profile
      summary: Update a profile
      description: |
        Update a custom permission profile in TheHive. Predefined profiles
        Admin, Org-Admin, Read-Only, External-Reader, and External-Actor can't
        be modified, except the Analyst profile.

        Use `POST /api/v1/query` with `listProfile` to retrieve available profiles, their IDs, and names.

        Required permissions: `manageProfile`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Update Profile
      parameters:
      - name: profileId
        in: path
        description: The profile ID preceded by `~`, or profile name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateProfile'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - users.customProfiles
      x-TheHive-permissions:
      - manageProfile
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/profile/{profileId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "SOC-Tier1-Analyst",
            "permissions": [
              "manageCase/create",
              "manageCase/update",
              "manageObservable",
              "manageTask"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/profile/{profileId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "SOC-Tier1-Analyst",
                  "permissions": [
                      "manageCase/create",
                      "manageCase/update",
                      "manageObservable",
                      "manageTask"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/shares:
    get:
      tags:
      - Share
      - Case
      summary: List shares of a case
      description: |
        Returns all sharing configurations for a case, including each
        organization's permission profile and sharing rules for tasks
        and observables.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.
      operationId: List Shares of Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputShare'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    put:
      tags:
      - Share
      - Case
      summary: Set all shares for a case
      description: |
        Set the sharing configurations of a case to exactly match the
        provided list. Creates new shares, updates existing ones, and
        removes any not included in the request.

        Unlike `POST /api/v1/case/{caseId}/shares`, which only adds
        new shares, this endpoint can also update and delete existing
        shares.

        Use this when [global sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) don't cover an existing case,
        or when a case needs sharing settings that differ from the global
        defaults.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageShare`

        Prerequisites: Each target organization must be linked to your organization.
          Use `GET /api/v1/organisation/{orgId}/links` to list linked
          organizations.
      operationId: Set shares for Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateShares'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputShare'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/case/{caseId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "shares": [
              {
                "organisation": "TheOrganization",
                "share": true,
                "profile": "analyst",
                "taskRule": "autoShare",
                "observableRule": "autoShare"
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "shares": [
                      {
                          "organisation": "TheOrganization",
                          "share": True,
                          "profile": "analyst",
                          "taskRule": "autoShare",
                          "observableRule": "autoShare"
                      }
                  ]
              },
          )
          response.raise_for_status()
    post:
      tags:
      - Share
      - Case
      summary: Share a case with other organizations
      description: |
        Share a case with one or more linked organizations. For each
        organization, you can specify a permission profile and sharing
        rules for tasks and observables.

        Use this when [global sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/) don't cover an existing case,
        or when a case needs sharing settings that differ from the global
        defaults.

        This endpoint only creates new shares. It won't update or delete
        existing shares. Use `PUT /api/v1/case/{caseId}/shares` to
        replace all shares at once.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageShare`

        Prerequisites: Each target organization must be linked to your organization.
          Use `GET /api/v1/organisation/{orgId}/links` to list linked
          organizations.
      operationId: Share a Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateShares'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputShare'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "shares": [
              {
                "organisation": "TheOrganization",
                "share": true,
                "profile": "analyst",
                "taskRule": "autoShare",
                "observableRule": "autoShare"
              }
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "shares": [
                      {
                          "organisation": "TheOrganization",
                          "share": True,
                          "profile": "analyst",
                          "taskRule": "autoShare",
                          "observableRule": "autoShare"
                      }
                  ]
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Share
      - Case
      summary: Unshare a case from organizations
      description: |
        Remove sharing access for the specified organizations from
        a case.

        Use `POST /api/v1/query` with `listCase` to retrieve available cases, their IDs, and numbers.

        Required permission: `manageShare`
      operationId: Unshare a Case
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputRemoveShares'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X DELETE "$THEHIVE_HOST/api/v1/case/{caseId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              "TheOrganization1",
              "TheOrganization2"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.delete(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      "TheOrganization1",
                      "TheOrganization2"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/task/{taskId}/shares:
    get:
      tags:
      - Share
      - Task
      summary: List shares of a task
      description: |
        Returns all [sharing configurations](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
        for a task, including each organization's permission profile.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.
      operationId: List Shares of Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputShare'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    post:
      tags:
      - Share
      - Task
      summary: Share a task with organizations
      description: |
        Manually share a task with one or more linked organizations within a shared case.
        Useful when [task sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
        are set to `manual`, letting you share only the relevant tasks.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.

        Required permission: `manageShare`

        Prerequisites: The case that contains the task must already be shared with
          each target organization. Use `POST /api/v1/case/{caseId}/shares` to share the case first.
      operationId: Share a Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateShare'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/task/{taskId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              "TheOrganization1",
              "TheOrganization2"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/task/{taskId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      "TheOrganization1",
                      "TheOrganization2"
                  ]
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Share
      - Task
      summary: Unshare a task from organizations
      description: |
        Remove sharing access for the specified organizations from a task.

        Use `POST /api/v1/query` with `listTask` to retrieve available tasks and their IDs.

        Required permission: `manageShare`
      operationId: Unshare a Task
      parameters:
      - name: taskId
        in: path
        description: The task ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputRemoveShares'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X DELETE "$THEHIVE_HOST/api/v1/task/{taskId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              "TheOrganization1",
              "TheOrganization2"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.delete(
              f"{THEHIVE_HOST}/api/v1/task/{taskId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      "TheOrganization1",
                      "TheOrganization2"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/observable/{observableId}/shares:
    get:
      tags:
      - Share
      - Observable
      summary: List shares of an observable
      description: |
        Returns all [sharing configurations](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
        for an observable, including each organization's permission profile.

        Use `POST /api/v1/query` with `listObservable` to retrieve available observables and their IDs.
      operationId: List Shares of Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputShare'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    post:
      tags:
      - Share
      - Observable
      summary: Share an observable with organizations
      description: |
        Manually share an observable with one or more linked organizations within a shared case.
        Useful when [observable sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
        are set to `manual`, letting you share only the relevant observables.

        Use `POST /api/v1/query` with `listObservable` to retrieve available observables and their IDs.

        Required permission: `manageShare`

        Prerequisites: The case that contains the observable must already be shared with
          each target organization. Use `POST /api/v1/case/{caseId}/shares` to share the case first.
      operationId: Share an Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateShare'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/observable/{observableId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              "TheOrganization1",
              "TheOrganization2"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/observable/{observableId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      "TheOrganization1",
                      "TheOrganization2"
                  ]
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Share
      - Observable
      summary: Unshare an observable from organizations
      description: |
        Remove sharing access for the specified organizations from an observable.

        Use `POST /api/v1/query` with `listObservable` to retrieve available observables and their IDs.

        Required permission: `manageShare`
      operationId: Unshare an Observable
      parameters:
      - name: observableId
        in: path
        description: The observable ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputRemoveShares'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X DELETE "$THEHIVE_HOST/api/v1/observable/{observableId}/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "organisations": [
              "TheOrganization1",
              "TheOrganization2"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.delete(
              f"{THEHIVE_HOST}/api/v1/observable/{observableId}/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "organisations": [
                      "TheOrganization1",
                      "TheOrganization2"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/case/share/{shareId}:
    delete:
      tags:
      - Share
      - Case
      summary: Remove a share by ID
      description: |
        Remove a single share by its ID. Use
        `GET /api/v1/case/{caseId}/shares` to retrieve the share IDs
        for a case.

        Required permission: `manageShare`
      operationId: Remove a Share from Case
      parameters:
      - name: shareId
        in: path
        description: The share ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
    patch:
      tags:
      - Share
      summary: Update a share's permission profile
      description: |
        Update the permission profile of a share. Use
        `GET /api/v1/case/{caseId}/shares` to retrieve the share IDs
        for a case.

        Required permission: `manageShare`
      operationId: Update a Share
      parameters:
      - name: shareId
        in: path
        description: The share ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateShare'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/case/share/{shareId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "profile": "analyst"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/case/share/{shareId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "profile": "analyst"
              },
          )
          response.raise_for_status()
  /api/v1/case/shares:
    delete:
      tags:
      - Share
      summary: Delete multiple shares
      description: |
        Remove one or more case-level shares by their IDs. Removing a share
        revokes access for the target organization to the case and all its tasks
        and observables.

        Use `GET /api/v1/case/{caseId}/shares` to retrieve the share IDs for a case.

        Required permission: `manageShare`
      operationId: Delete Shares by shareId
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - ids
              properties:
                ids:
                  description: Identifiers of the entities to target. IDs must be
                    prefixed with `~`. Case numbers and names are passed as plain
                    strings without a prefix.
                  examples:
                  - - ~128458762
                    - ~216513541
                  type: array
                  items:
                    description: The _id of the entity or its 'name' (depends of the
                      entity)
                    examples:
                    - ~354
                    type: string
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageShare
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X DELETE "$THEHIVE_HOST/api/v1/case/shares" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "ids": [
              "~128458762",
              "~216513541"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.delete(
              f"{THEHIVE_HOST}/api/v1/case/shares",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "ids": [
                      "~128458762",
                      "~216513541"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/config/user:
    get:
      tags:
      - Config
      summary: List your configuration items
      description: |
        Returns your configuration as a single JSON object, merging
        your saved overrides with TheHive default values.

        Configuration items are stored under keys such as `dashboards`,
        `list-views-cases`, `list-views-tasks`, `list-views-alerts`,
        `notification.items`, `organisation`, and `profile`. Each key
        can hold any JSON value: an object, an array, a string, or a
        boolean.
      operationId: List user configuration items
      parameters:
      - name: path
        in: query
        description: Key of a single configuration item. Omit it to return your full
          configuration.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema: {}
              example:
                dashboards: {}
                organisation: TheOrganization
                profile: analyst
                list-views-cases: []
                list-views-tasks: []
                list-views-alerts: []
                notification:
                  items: []
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/config/user/{path}:
    get:
      tags:
      - Config
      summary: Get a configuration item
      description: |+
        Returns a single configuration item, identified by its key.

        Use `GET /api/v1/config/user` to list your current
        configuration items and their keys.

      operationId: Get user configuration item
      parameters:
      - name: path
        in: path
        description: Key of the configuration item.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputConfig'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    put:
      tags:
      - Config
      summary: Set a configuration item
      description: |+
        Creates or replaces one of your configuration items, identified
        by its key.

        Use `GET /api/v1/config/user` to list your current
        configuration items and their keys.

      operationId: Set user configuration item
      parameters:
      - name: path
        in: path
        description: Key of the configuration item.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputConfig'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputConfig'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/config/user/{path}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "value": {
              "~7741591688": {
                "period": "Last7Days",
                "refresh": 30
              }
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/config/user/{path}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "value": {
                      "~7741591688": {
                          "period": "Last7Days",
                          "refresh": 30
                      }
                  }
              },
          )
          response.raise_for_status()
  /api/v1/admin/log/set/{packageName}/{level}:
    put:
      tags:
      - Admin
      summary: Set the log level for a package
      description: |
        Set the log level for the specified logger at runtime, without restarting TheHive.
        Changes take effect immediately and are lost when TheHive restarts.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update Log Level
      parameters:
      - name: packageName
        in: path
        description: The logger name.
        required: true
        schema:
          type: string
      - name: level
        in: path
        description: '`ALL` and `TRACE` log the most detailed information. `DEBUG`
          logs debugging information. `INFO` logs general information. `WARN` logs
          warnings and errors. `ERROR` logs errors only. `OFF` turns off logging entirely.'
        required: true
        schema:
          $ref: '#/components/schemas/InputLogLevel'
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
  /api/v1/describe/{model}:
    get:
      tags:
      - Describe
      summary: Get the property metadata of an entity model
      description: |
        A model is an entity type stored and exposed by TheHive API,
        such as `case`, `alert`, `task`, `observable`, or `user`.

        Returns metadata about `model`: its label, the `initialQuery`
        primary operation name to use with [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API) to
        list entities of this model, and the list of its properties.
        Each property entry includes its name, data type, cardinality,
        whether it's aggregable, its index type, and, for enumerated
        properties, the list of allowed values.

        `initialQuery` names only the primary `list` operation. It
        doesn't include the corresponding `get` operation, or any
        related object operations available for `model`, such as
        navigating from a case to its tasks. Those are listed in that
        entity's own section of the API reference.

        Use this endpoint to discover which fields you can reference in
        `filter`, `sort`, or aggregation steps when building a query
        with [`POST /api/v1/query`](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export/operation/Query%20API).

        Use `GET /api/v1/describe/_all` to list every model name
        available for this parameter.
      operationId: Describe a model
      parameters:
      - name: model
        in: path
        description: 'Name of the entity type to describe: the kind of object TheHive
          stores and exposes through the API, for example `case`, `alert`, `task`,
          `observable`, or `user`.'
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityDescription'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/describe/_all:
    get:
      tags:
      - Describe
      summary: Get the property metadata of every entity model
      description: |
        Returns the same metadata as `GET /api/v1/describe/{model}`,
        for every entity model at once. The response is a map keyed
        by model name.
      operationId: Describe all models
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/modelDescriptions'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      - name: Portal
  /api/v1/license/current:
    get:
      tags:
      - License
      summary: Get the current license status
      description: |
        Returns the current license status of this TheHive instance.

        The response varies depending on the license state:

        - If a valid active license is configured, the response contains
          the license details.
        - If no active license is configured, it contains a fallback
          placeholder.
        - If a license is configured but fails validation, it contains
          the error and the fallback.

        This endpoint is accessible to all authenticated users.
      operationId: Get current License
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputLicenseCurrent'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/license/{licenseId}:
    get:
      tags:
      - License
      summary: Get a license
      description: |
        Returns the details of a specific license stored in TheHive.

        Use `GET /api/v1/license` to retrieve all licenses and their IDs.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Get License
      parameters:
      - name: licenseId
        in: path
        description: The ID of the license preceded by `~`, or the license file identifier.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputLicense'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
  /api/v1/license:
    get:
      tags:
      - License
      summary: List all licenses
      description: |
        Returns all licenses stored in TheHive as a JSON array.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: List all licenses
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/List_OutputLicense'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
    post:
      tags:
      - License
      summary: Add and activate a license
      description: |
        Add a new license to TheHive and attempt to activate it.

        If the license is added successfully but activation fails because
        the license has expired or because usage limits are exceeded,
        the response returns `200 OK` with an error payload instead of
        `204 No Content`.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Prerequisites: Use `GET /api/v1/license/challenge` to obtain
        the challenge token, then submit it to the
        [StrangeBee license portal](https://docs.strangebee.com/thehive/installation/licenses/license/#step-2-generate-your-license-key)
        to generate a license key for this instance.
      operationId: Add License and Activate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputLicense'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/license" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "license": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.abc123"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/license",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "license": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.abc123"
              },
          )
          response.raise_for_status()
  /api/v1/license/{licenseId}/activate:
    put:
      tags:
      - License
      summary: Activate an existing license
      description: |
        Activate a license that was previously added to TheHive.

        Use `GET /api/v1/license` to retrieve available licenses and
        their IDs.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Activate License
      parameters:
      - name: licenseId
        in: path
        description: The ID of the license preceded by `~`, or the license file identifier.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
  /api/v1/license/challenge:
    get:
      tags:
      - License
      summary: Get the license challenge token
      description: |
        Returns an encrypted challenge token specific to this TheHive
        instance.

        Send this challenge token to the
        [StrangeBee license portal](https://docs.strangebee.com/thehive/installation/licenses/license/#step-2-generate-your-license-key)
        to obtain a license key for this instance. Use `POST /api/v1/license`
        to add and activate the license key once received.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Get Challenge
      responses:
        '200':
          description: Success
          content:
            text/plain:
              schema:
                type: string
              example: eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.abc123
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePlatform
  /api/v1/catalog:
    post:
      tags:
      - Att&ck
      summary: Create an attack technique catalog
      description: |
        Create a new attack technique catalog to group patterns.
        TheHive includes the [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/) by default.
        Use this endpoint to add custom catalogs alongside it.

        Required permissions: `managePattern`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create Catalog of TTP
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCatalogOfPattern'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCatalogOfPattern'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePattern
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/catalog" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "Enterprise Attack",
            "description": "Covers all standard enterprise-level attack techniques from the MITRE ATT&CK framework.",
            "variant": "2025-04-15"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/catalog",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "Enterprise Attack",
                  "description": "Covers all standard enterprise-level attack techniques from the MITRE ATT&CK framework.",
                  "variant": "2025-04-15"
              },
          )
          response.raise_for_status()
  /api/v1/catalog/{catalogId}:
    delete:
      tags:
      - Att&ck
      summary: Delete an attack technique catalog
      description: |
        Delete an attack technique catalog.

        Use `POST /api/v1/query` with `listCatalog` to retrieve
        available catalogs, their IDs, and names.

        Required permissions: `managePattern`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete a Catalog of TTP
      parameters:
      - name: catalogId
        in: path
        description: The catalog ID preceded by `~`, or the catalog name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePattern
    patch:
      tags:
      - Att&ck
      summary: Update an attack technique catalog
      description: |
        Update the name, description, or variant of an existing
        attack technique catalog.

        Use `POST /api/v1/query` with `listCatalog` to retrieve
        available catalogs, their IDs, and names.

        Required permissions: `managePattern`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update Catalog of TTP
      parameters:
      - name: catalogId
        in: path
        description: The catalog ID preceded by `~`, or the catalog name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCatalogOfPattern'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePattern
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/catalog/{catalogId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "Enterprise Attack v2",
            "description": "Covers all standard enterprise-level attack techniques from the MITRE ATT&CK framework.",
            "variant": "2025-04-15"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/catalog/{catalogId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "Enterprise Attack v2",
                  "description": "Covers all standard enterprise-level attack techniques from the MITRE ATT&CK framework.",
                  "variant": "2025-04-15"
              },
          )
          response.raise_for_status()
  /api/v1/pattern/import/attack:
    post:
      tags:
      - Att&ck
      summary: Import MITRE ATT&CK techniques
      description: |
        Import MITRE ATT&CK techniques, also called patterns, into a catalog from either a
        JSON file upload or a URL pointing to a catalog JSON file.
        Provide a catalog name or ID. If the catalog doesn't exist,
        TheHive creates it automatically.

        Required permissions: `managePattern`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Import MITRE Att&ck file
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputPatternImportMitre'
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - file
              properties:
                _json:
                  $ref: '#/components/schemas/InputPatternImportMitre'
                file:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsObject'
              example:
                success: 678
        '207':
          description: Partial success — some techniques were imported, others were
            skipped.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsObject'
              example:
                success: 672
                errors:
                - Pattern T1099 is already in the catalog
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePattern
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/pattern/import/attack" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "url": "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json",
            "catalog": "Enterprise Attack",
            "variant": "2025-06-26"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/pattern/import/attack",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "url": "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json",
                  "catalog": "Enterprise Attack",
                  "variant": "2025-06-26"
              },
          )
          response.raise_for_status()
  /api/v1/pattern/{patternId}:
    get:
      tags:
      - Att&ck
      summary: Get an attack technique
      description: |
        Returns a single attack technique by its ID or name.

        Use `POST /api/v1/query` with `listPattern` to retrieve
        available attack techniques and their IDs.
      operationId: Get Pattern
      parameters:
      - name: patternId
        in: path
        description: The attack technique ID preceded by `~`, or its MITRE identifier.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputPattern'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Att&ck
      summary: Delete an attack technique
      description: |
        Delete an attack technique.

        Use `POST /api/v1/query` with `listPattern` to retrieve
        available attack techniques and their IDs.

        Required permissions: `managePattern`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete Pattern
      parameters:
      - name: patternId
        in: path
        description: The attack technique ID preceded by `~`, or its MITRE identifier.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - managePattern
  /api/v1/pattern/case/{caseId}:
    get:
      tags:
      - Att&ck
      summary: List attack techniques linked to a case
      description: |
        Returns all attack techniques linked to a case.

        Use `POST /api/v1/query` with `listCase` to retrieve
        available cases and their IDs.
      operationId: Get Case Patterns
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputPattern'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/observable/type/{typeId}:
    get:
      tags:
      - Observable Type
      summary: Get an observable type
      description: |
        Returns an observable type by ID or name.

        Use `POST /api/v1/query` with `listObservableType` to retrieve available
        observable types, their IDs, and names.
      operationId: Get Observable Type
      parameters:
      - name: typeId
        in: path
        description: The observable type ID preceded by `~`, or the observable type
          name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputObservableType'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Observable Type
      summary: Delete an observable type
      description: |
        Delete an observable type.

        An observable type can't be deleted while at least one observable uses
        it.

        Use `POST /api/v1/query` with `listObservableType` to retrieve available
        observable types, their IDs, and names.

        Required permissions: `manageObservableTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete Observable Type
      parameters:
      - name: typeId
        in: path
        description: The observable type ID preceded by `~`, or the observable type
          name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservableTemplate
    patch:
      tags:
      - Observable Type
      summary: Update the case sensitivity of an observable type
      description: |
        Update the case sensitivity of an observable type.

        Changes apply only to new observables. Existing observables aren't
        affected retroactively.

        Use `POST /api/v1/query` with `listObservableType` to retrieve available
        observable types, their IDs, and names.

        Required permissions: `manageObservableTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update Observable Type
      parameters:
      - name: typeId
        in: path
        description: The observable type ID preceded by `~`, or the observable type
          name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateObservableType'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservableTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/observable/type/{typeId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "isCaseSensitive": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/observable/type/{typeId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "isCaseSensitive": False
              },
          )
          response.raise_for_status()
  /api/v1/observable/type:
    post:
      tags:
      - Observable Type
      summary: Create an observable type
      description: |
        Create a custom observable type in TheHive to extend the predefined list.

        When `isCaseSensitive` is `false`, new observables of this type are
        automatically normalized to lowercase upon creation. Existing observables
        aren't affected.

        Once created, this type's name becomes a valid `dataType` value when
        creating or updating observables.

        Required permissions: `manageObservableTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create Observable Type
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputObservableType'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputObservableType'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageObservableTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/observable/type" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "ja4-fingerprint",
            "isAttachment": false,
            "isCaseSensitive": false
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/observable/type",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "ja4-fingerprint",
                  "isAttachment": False,
                  "isCaseSensitive": False
              },
          )
          response.raise_for_status()
  /api/v1/status/public:
    get:
      tags:
      - Status
      summary: Get the public platform status
      description: |
        Returns platform information that doesn't require authentication.

        Use this endpoint to check whether single sign-on is turned on,
        list the available SSO providers, and read the platform version
        and MITRE ATT&CK catalog import status before a user signs in.
      operationId: Get platform public status
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputPublicStatus'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
  /api/v1/status:
    get:
      tags:
      - Status
      summary: Get the platform status
      description: |
        Returns the current status of your TheHive instance.

        Use it to check the platform version, license validity, the
        status of each connector, and which feature flags are turned
        on. Set `verbose` to `true` to also include the cluster state
        and the database schema version of each module.
      operationId: Get platform status
      parameters:
      - name: verbose
        in: query
        description: When `true`, include the cluster state and the database schema
          version of each module in the response.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputStatus'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/flow:
    get:
      tags:
      - Audit
      summary: Get the audit trail of an object
      description: |
        Returns the most recent audit trail entries for a case and its
        linked objects, or the most recent entries across supported
        object types when no case is specified. TheHive interface
        uses this endpoint to build the case **History** tab and the
        Live Feed.

        Without `rootId`, only actions on cases, alerts, tasks,
        observables, organizations, case templates, dashboards,
        shares, jobs, attachments, actions, and comments appear in
        the results.
      operationId: Get flow of audit
      parameters:
      - name: rootId
        in: query
        description: |-
          Case ID to scope the audit trail to a single case and its
          linked objects. Unlike other case parameters, this doesn't
          accept the case number. Must match an existing case. Use
          `POST /api/v1/query` with `listCase` to retrieve available
          cases and their IDs. Omit this parameter, or set it to
          `any`, to retrieve the most recent audit entries across all
          object types visible to you.
        required: false
        schema:
          type: string
      - name: count
        in: query
        description: Maximum number of audit entries to return.
        required: false
        schema:
          default: 10
          type: integer
          format: int32
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputStreamAudit'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/action:
    post:
      tags:
      - Cortex
      summary: Run a responder
      description: |
        Run a Cortex responder against a case, an alert, an
        observable, a task, or a task log to execute an automated
        action, such as blocking an IP address on a firewall or
        closing an external ticket. Cortex processes the responder
        asynchronously, so the response returns the action with
        `status` set to `Waiting`. Poll `POST /api/v1/query` with
        `getAction` to follow its progress.

        Required permission: `manageAction`

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: Create an action
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputAction'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAction'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAction
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/cortex/action" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "responderId": "b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab",
            "cortexId": "Cortex1",
            "objectType": "case",
            "objectId": "~276824",
            "parameters": {
              "to": "sami@example.com"
            },
            "tlp": 2
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/cortex/action",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "responderId": "b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab",
                  "cortexId": "Cortex1",
                  "objectType": "case",
                  "objectId": "~276824",
                  "parameters": {
                      "to": "sami@example.com"
                  },
                  "tlp": 2
              },
          )
          response.raise_for_status()
  /api/v1/connector/cortex/actions:
    post:
      tags:
      - Cortex
      summary: Run responders in bulk
      description: |
        Run multiple Cortex responders in a single call. Each
        item in the request body targets its own case, alert,
        observable, task, or task log, and is processed
        independently. Cortex processes the responders
        asynchronously, so the response returns every action with
        `status` set to `Waiting`. Poll `POST /api/v1/query` with
        `listAction` to follow their progress.

        Required permission: `manageAction`

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: Create several actions
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/InputAction'
        required: false
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputAction'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAction
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/cortex/actions" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '[
            {
              "responderId": "b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab",
              "cortexId": "Cortex1",
              "objectType": "case",
              "objectId": "~276824",
              "parameters": {
                "to": "sami@example.com"
              },
              "tlp": 2
            }
          ]'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/cortex/actions",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json=[
                  {
                      "responderId": "b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab",
                      "cortexId": "Cortex1",
                      "objectType": "case",
                      "objectId": "~276824",
                      "parameters": {
                          "to": "sami@example.com"
                      },
                      "tlp": 2
                  }
              ],
          )
          response.raise_for_status()
  /api/v1/responder-execution/{scope}/{rootId}/count:
    get:
      tags:
      - Cortex
      summary: Count responder executions for a case or alert
      description: |
        Counts the responder executions, called actions, linked to a
        case and its tasks, observables, and task logs, or to an
        alert and its observables, matching the optional filter.
        Actions that ran before this endpoint was introduced aren't
        counted.

        Use `POST /api/v1/query` with `listCase` to retrieve
        available cases, their IDs, and numbers, and with
        `listAlert` to retrieve available alerts and their IDs.

        Filter with the `filter` query parameter, URL-encoded as
        shown below.

        #### Example

        ```
        curl -G 'https://<thehive_host>/api/v1/responder-execution/case/~276824/count' -H 'Authorization: Bearer <api_key>' \
        --data-urlencode 'filter={"_eq": {"_field": "status", "_value": "Success"}}'
        ```
      operationId: Count actions scoped to a case or alert
      parameters:
      - name: scope
        in: path
        description: 'Type of the target: `case` for a case, or `alert` for an alert.'
        required: true
        schema:
          $ref: '#/components/schemas/ActionScope'
      - name: rootId
        in: path
        description: The case ID preceded by `~` or the case number when `scope` is
          `case`, or the alert ID preceded by `~` when `scope` is `alert`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: filter
        in: query
        description: Filter expression, using the JSON syntax of the `filter` operation
          of `POST /api/v1/query` without its `_name` field.
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JsObject'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: integer
                format: int32
              example: 4
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/responder-execution/{scope}/{rootId}:
    get:
      tags:
      - Cortex
      summary: List responder executions for a case or alert
      description: |
        Retrieves the responder executions, called actions, linked to
        a case and its tasks, observables, and task logs, or to an
        alert and its observables. Actions that ran before this
        endpoint was introduced aren't returned.

        Use `POST /api/v1/query` with `listCase` to retrieve
        available cases, their IDs, and numbers, and with
        `listAlert` to retrieve available alerts and their IDs.

        Filter, sort, and paginate with the `filter`, `sort`,
        `pageFrom`, and `pageTo` query parameters, URL-encoded as
        shown below. Results are limited to 30 actions by default
        and 300 at most. The response carries no total count and no
        `X-Total` header. Use
        `GET /api/v1/responder-execution/{scope}/{rootId}/count` with
        the same `filter` value to retrieve the number of matching
        actions.

        #### Example

        ```
        curl -G 'https://<thehive_host>/api/v1/responder-execution/case/~276824?pageFrom=0&pageTo=30' -H 'Authorization: Bearer <api_key>' \
        --data-urlencode 'filter={"_eq": {"_field": "status", "_value": "Success"}}' \
        --data-urlencode 'sort=[{"field": "responderId", "direction": "asc"}]'
        ```
      operationId: List actions scoped to a case or alert
      parameters:
      - name: scope
        in: path
        description: 'Type of the target: `case` for a case, or `alert` for an alert.'
        required: true
        schema:
          $ref: '#/components/schemas/ActionScope'
      - name: rootId
        in: path
        description: The case ID preceded by `~` or the case number when `scope` is
          `case`, or the alert ID preceded by `~` when `scope` is `alert`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: filter
        in: query
        description: Filter expression, using the JSON syntax of the `filter` operation
          of `POST /api/v1/query` without its `_name` field.
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JsObject'
      - name: sort
        in: query
        description: Sort criteria, using the JSON syntax of the `_fields` value of
          the `sort` operation of `POST /api/v1/query`.
        required: false
        content:
          application/json:
            schema:
              type: array
              items:
                examples:
                - +_createdAt
                oneOf:
                - $ref: '#/components/schemas/FieldDirection'
                - $ref: '#/components/schemas/Map_Direction'
                - examples:
                  - +_createdAt
                  type: string
      - name: pageFrom
        in: query
        description: Index of the first result to return, 0-based. Defaults to `0`.
        required: false
        content:
          application/json:
            schema:
              type: integer
              format: int32
      - name: pageTo
        in: query
        description: Index of the last result to return, exclusive. Defaults to `pageFrom`
          plus 30. The range between `pageFrom` and `pageTo` can't exceed 300.
        required: false
        content:
          application/json:
            schema:
              type: integer
              format: int32
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputAction'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer:
    get:
      tags:
      - Cortex
      summary: List available analyzers
      description: |
        Lists the analyzers available to your organization across
        every connected Cortex server.

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: List Analyzers
      parameters:
      - name: range
        in: query
        description: 'Range of analyzers to return: `all` to return every available
          analyzer, or Cortex''s `<start>-<end>` range syntax, for example `0-25`.
          Omitting this parameter defaults to Cortex''s `0-10` range, returning only
          the first 10 analyzers.'
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnalyzerOutput'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer/type/{dataType}:
    get:
      tags:
      - Cortex
      summary: List analyzers by observable data type
      description: |
        Lists the analyzers that support a given observable data
        type and are available to your organization across every
        connected Cortex server.

        Use `POST /api/v1/query` with
        `listObservableType` to retrieve available data types.

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: List Analyzers by type
      parameters:
      - name: dataType
        in: path
        description: The observable data type analyzers must support.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputWorker'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer/{analyzerId}:
    get:
      tags:
      - Cortex
      summary: Get an analyzer
      description: |
        Retrieves an analyzer by its ID, searching across every
        Cortex server available to your organization.

        Use `GET /api/v1/connector/cortex/analyzer` to list available
        analyzers.

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: Get Analyzer by id
      parameters:
      - name: analyzerId
        in: path
        description: The analyzer ID.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputWorker'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/job:
    post:
      tags:
      - Cortex
      summary: Run an analyzer on an observable
      description: |
        Runs an analyzer on an observable, creating a job that
        Cortex processes asynchronously.

        Required permission: `manageAnalyse`

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: Create Cortex job
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputJob'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputJob'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAnalyse
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/cortex/job" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "analyzerId": "220483fde9608c580fb6a2508ff3d2d3",
            "cortexId": "Cortex1",
            "artifactId": "~344112",
            "parameters": {
              "comment": "Investigating phishing campaign"
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/cortex/job",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "analyzerId": "220483fde9608c580fb6a2508ff3d2d3",
                  "cortexId": "Cortex1",
                  "artifactId": "~344112",
                  "parameters": {
                      "comment": "Investigating phishing campaign"
                  }
              },
          )
          response.raise_for_status()
  /api/v1/connector/cortex/job/{jobId}:
    get:
      tags:
      - Cortex
      summary: Get a Cortex job
      description: |
        Retrieves an analyzer job, including its status and report
        once the analyzer has completed.

        Use `POST /api/v1/query` with `listJob` to retrieve available
        Cortex jobs and their IDs.
      operationId: Get Cortex Job
      parameters:
      - name: jobId
        in: path
        description: The job ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputJob'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer/template/content/{analyzerId}:
    get:
      tags:
      - Cortex
      summary: Get an analyzer template's content
      description: |
        Retrieves the HTML content of an analyzer template.

        Use `POST /api/v1/query` with `listAnalyzerTemplate` to
        retrieve available analyzer templates and their IDs, or
        `GET /api/v1/connector/cortex/analyzer` to list available
        analyzers and their names.
      operationId: Get Analyzer Template content
      parameters:
      - name: analyzerId
        in: path
        description: The analyzer template ID preceded by `~`, or the name of the
          analyzer it's linked to.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            text/plain:
              schema:
                type: string
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer/template/_import:
    post:
      tags:
      - Cortex
      summary: Import analyzer templates in bulk
      description: |
        Imports one or more analyzer templates from a ZIP archive, such
        as the official templates archive available at
        `https://catalogs.download.strangebee.com/latest/zip/report-templates.zip?version=${org.thp.thehive.build.version}`.

        Required permissions: `manageAnalyzerTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Import Analyzer Templates
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAnalyzerTemplateFiles'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Map_Boolean'
              example:
                VirusTotal_GetReport: true
                Abuse_Finder: false
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/analyzer/template:
    post:
      tags:
      - Cortex
      summary: Create an analyzer template
      description: |
        Create an analyzer template that defines how reports from an
        analyzer are displayed once the analyzer runs on an
        observable.

        Required permissions: `manageAnalyzerTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Create Analyzer Template
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputAnalyzerTemplate'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAnalyzerTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/cortex/analyzer/template" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "analyzerId": "VirusTotal_GetReport",
            "content": "<div class=\"panel-content\">{{summary.taxonomies}}</div>"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/cortex/analyzer/template",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "analyzerId": "VirusTotal_GetReport",
                  "content": "<div class=\"panel-content\">{{summary.taxonomies}}</div>"
              },
          )
          response.raise_for_status()
  /api/v1/connector/cortex/analyzer/template/{analyzerTemplateId}:
    delete:
      tags:
      - Cortex
      summary: Delete an analyzer template
      description: |
        Delete an analyzer template. Reports from the corresponding
        analyzer then fall back to the default rendering.

        Use `POST /api/v1/query` with `listAnalyzerTemplate` to
        retrieve available analyzer templates and their IDs.

        Required permissions: `manageAnalyzerTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Delete Analyzer Template
      parameters:
      - name: analyzerTemplateId
        in: path
        description: The analyzer template ID preceded by `~`, or the name of the
          analyzer it's linked to.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    patch:
      tags:
      - Cortex
      summary: Update an analyzer template
      description: |
        Update the HTML content of an analyzer template.

        Use `POST /api/v1/query` with `listAnalyzerTemplate` to
        retrieve available analyzer templates and their IDs.

        Required permissions: `manageAnalyzerTemplate`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.
      operationId: Update Analyzer Template
      parameters:
      - name: analyzerTemplateId
        in: path
        description: The analyzer template ID preceded by `~`, or the name of the
          analyzer it's linked to.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputAnalyzerTemplateUpdate'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAnalyzerTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/connector/cortex/analyzer/template/{analyzerTemplateId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "content": "<div class=\"panel-content\">{{summary.taxonomies}}</div>"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/connector/cortex/analyzer/template/{analyzerTemplateId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "content": "<div class=\"panel-content\">{{summary.taxonomies}}</div>"
              },
          )
          response.raise_for_status()
  /api/v1/connector/cortex/responder/{entityType}/{entityId}:
    get:
      tags:
      - Cortex
      summary: List responders available for an entity
      description: |
        Lists the responders available for a case, an observable,
        a task, a task log, or an alert, across every Cortex server
        available to your organization. Only responders matching the
        entity's TLP and PAP levels are returned.

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: List responders
      parameters:
      - name: entityType
        in: path
        description: 'Type of the target: `case` for a case, `case_artifact` for an
          observable, `case_task` for a task, `case_task_log` for a task log, or `alert`
          for an alert.'
        required: true
        schema:
          type: string
      - name: entityId
        in: path
        description: The ID of the entity preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ListRespondersOutput'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/cortex/responders/{entityType}:
    get:
      tags:
      - Cortex
      summary: List responders available for an entity type
      description: |
        Lists the responders that can run on a given entity type,
        across every Cortex server available to your organization,
        regardless of any specific entity's TLP or PAP level.

        To retrieve every responder across every entity type at once,
        call `GET /api/responder?range=all` directly on Cortex. See
        [Cortex paging and sorting documentation](https://docs.strangebee.com/cortex/api/api-guide/#paging-and-sorting)
        for details on the `range` parameter convention.

        Required permission: `manageAction`

        Prerequisites: a Cortex server must be connected to
        TheHive. See [Add a Cortex Server](https://docs.strangebee.com/thehive/administration/cortex/add-a-cortex-server/).
      operationId: List responders for entity type
      parameters:
      - name: entityType
        in: path
        description: 'Type of the target: `case` for a case, `case_artifact` for an
          observable, `case_task` for a task, `case_task_log` for a task log, or `alert`
          for an alert.'
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputWorker1'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageAction
  /api/v1/connector/misp/status:
    get:
      tags:
      - MISP
      summary: Get MISP server sync status
      description: |+
        Returns the synchronization status for each MISP server
        visible to the current organization, including the last
        sync time, the last event time, and whether the most
        recent sync completed only partially.

      operationId: Get MISP status
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsObject'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/misp/_syncAlerts:
    get:
      tags:
      - MISP
      summary: Trigger a MISP event synchronization
      description: |+
        Trigger a delta synchronization of events from all [MISP
        servers connected](https://docs.strangebee.com/thehive/administration/misp-integration/connect-a-misp-server/) to the current organization. TheHive
        fetches events published since the last sync and converts
        them into alerts.

        Required permission: `manageOrganisation`

      operationId: Sync with MISP servers
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/misp/export/{caseId}/{mispName}:
    post:
      tags:
      - MISP
      summary: Export a case to a MISP server
      description: |+
        Export a case to a MISP server as an event. Only
        observables marked as indicators of compromise (IOCs) are
        included. Once exported, TheHive automatically synchronizes
        subsequent IOC updates to the MISP event without manual
        intervention.

        Use `POST /api/v1/query` with `listCase` to retrieve
        available cases, their IDs, and numbers.
        Use `GET /api/v1/connector/misp/status` to retrieve
        available MISP servers and their names.

        Required permission: `manageShare`

        Prerequisites: The target MISP server must be configured
        with *Export only* or *Import and export* purpose.
        See [Connect a MISP Server](https://docs.strangebee.com/thehive/administration/misp-integration/connect-a-misp-server/)
        to set up a server connection.

      operationId: Export Case to MISP
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: mispName
        in: path
        description: Name of the MISP server to export the case to. Must match a server
          configured in TheHive.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/connector/misp/case/import:
    post:
      tags:
      - MISP
      summary: Import a MISP event as a case
      description: |+
        Create a case from a MISP event JSON file. Observables
        from the event are automatically transferred to the case.

        Required permission: `manageCase/create`

      operationId: Import Case from MISP
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - file
              properties:
                _json:
                  $ref: '#/components/schemas/InputImportCase1'
                file:
                  type: string
                  format: binary
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCase'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCase/create
  /api/v1/function:
    post:
      tags:
      - Function
      summary: Create a function
      description: |
        Create a JavaScript function that processes data and calls TheHive API.
        All API calls inside the function run with the permissions of the user who invokes it.

        The code must define a `handle(input, context)` function, where `input` is the
        JSON payload passed at invocation and `context` exposes TheHive API methods.
        Use `GET /api/v1/function/_context/documentation` to list the available context
        methods and fields.

        The following example creates a TheHive alert from data passed as input to the function:

        ```javascript
        function handle(input, context) {
          const alert = context.alert.create({
            type: "myScript",
            source: input.source,
            sourceRef: input.ref,
            title: input.title || "Default title",
            description: "Alert from myScript " + input.ref,
            observables: input.data.map(a => ({
              dataType: a.type,
              data: a.value
            }))
          });
          console.log(`Alert created with id ${alert && alert._id}`);
          return alert;
        }
        ```

        Functions support JavaScript only.

        See [About Functions](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/) for the available function types, execution modes, and trigger sources.

        Use `POST /api/v1/function/_test` to test your code before saving.

        Required permission: `manageFunction/create`

        Required license: Platinum or One
      operationId: Create Function
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputFunction'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputFunction'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
      x-TheHive-permissions:
      - manageFunction/create
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/function" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "airtable-to-alert",
            "mode": "Enabled",
            "definition": "function handle(input, context) { return []; }",
            "description": "Fetches records from Airtable and creates alerts in TheHive.",
            "config": {
              "apiKey": "<api_key>"
            },
            "types": [
              "api"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/function",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "airtable-to-alert",
                  "mode": "Enabled",
                  "definition": "function handle(input, context) { return []; }",
                  "description": "Fetches records from Airtable and creates alerts in TheHive.",
                  "config": {
                      "apiKey": "<api_key>"
                  },
                  "types": [
                      "api"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/function/{function}:
    post:
      tags:
      - Function
      summary: Invoke a function
      description: |
        Invoke a function by its ID or name, optionally passing a JSON payload as input.

        TheHive processes the input using the function code and returns the value from
        the `handle` function.

        Use `POST /api/v1/query` with `listFunction` to retrieve available functions, their IDs, and names.

        Set `dryRun=true` to run the function without persisting any changes.

        Required permission: `manageFunction/invoke`

        Required license: Platinum or One
      operationId: Invoke Function
      parameters:
      - name: function
        in: path
        description: The function ID preceded by `~`, or the function name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: dryRun
        in: query
        description: Set to `true` to simulate the execution without persisting any
          changes.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          application/json:
            schema: {}
        required: false
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputInvokeFunctionOk'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: InternalError
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/OutputInvokeFunctionKo'
                - type: object
                  required:
                  - type
                  - message
                  properties:
                    type:
                      type: string
                    message:
                      type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
      x-TheHive-permissions:
      - manageFunction/invoke
  /api/v1/function/{function}/{objectType}/{objectIdOrName}:
    post:
      tags:
      - Function
      summary: Invoke a function on a case or alert
      description: |
        Invoke a function on a specific case or alert, passing the object as input
        to the `handle` function.

        The function must have type `action:case` or `action:alert` matching the
        `objectType` path parameter.

        Use `POST /api/v1/query` with `listFunction` to retrieve available functions, their IDs, and names.

        Use `POST /api/v1/query` with `listCase` or `listAlert` to retrieve the IDs
        of available cases and alerts.

        Set `sync=false` (default) to run the function in the background and return
        immediately. Set `sync=true` to wait for the function to complete and return
        its result.

        Set `dryRun=true` to run the function without persisting any changes.

        Required permission: `manageFunction/invoke`

        Required license: Platinum or One
      operationId: Invoke Function on an object
      parameters:
      - name: function
        in: path
        description: The function ID preceded by `~`, or the function name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: objectType
        in: path
        description: 'Type of the object to pass as input. Accepted values: `case`,
          `alert`.'
        required: true
        schema:
          type: string
      - name: objectIdOrName
        in: path
        description: 'The object ID preceded by `~`, or a type-specific identifier:
          the case number for cases, or the alert reference (`type;source;sourceRef`)
          for alerts.'
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: dryRun
        in: query
        description: Set to `true` to simulate the execution without persisting any
          changes.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      - name: sync
        in: query
        description: Set to `true` to wait for the function to complete and return
          its result. Defaults to `false` to run the function in the background and
          return immediately.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/OutputInvokeFunctionOk'
                - $ref: '#/components/schemas/OutputInvokeFunctionBackground'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: InternalError
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/OutputInvokeFunctionKo'
                - type: object
                  required:
                  - type
                  - message
                  properties:
                    type:
                      type: string
                    message:
                      type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
      x-TheHive-permissions:
      - manageFunction/invoke
  /api/v1/function/{functionId}:
    get:
      tags:
      - Function
      summary: Get a function
      description: |
        Retrieve a function by its ID or name.

        Use `POST /api/v1/query` with `listFunction` to retrieve available functions, their IDs, and names.

        Required license: Platinum or One
      operationId: Get Function
      parameters:
      - name: functionId
        in: path
        description: The function ID preceded by `~`, or the function name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputFunction'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
    delete:
      tags:
      - Function
      summary: Delete a function
      description: |
        Delete a function by its ID or name.

        Use `POST /api/v1/query` with `listFunction` to retrieve available functions, their IDs, and names.

        Required permission: `manageFunction/create`

        Required license: Platinum or One
      operationId: Delete Function
      parameters:
      - name: functionId
        in: path
        description: The function ID preceded by `~`, or the function name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
      x-TheHive-permissions:
      - manageFunction/create
    patch:
      tags:
      - Function
      summary: Update a function
      description: |
        Update one or more fields of a function.

        Use `POST /api/v1/query` with `listFunction` to retrieve available functions, their IDs, and names.

        Use `GET /api/v1/function/_context/documentation` to list the available context
        methods and fields when updating the function code.

        Required permission: `manageFunction/create`

        Required license: Platinum or One
      operationId: Update Function
      parameters:
      - name: functionId
        in: path
        description: The function ID preceded by `~`, or the function name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateFunction'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - functions
      x-TheHive-permissions:
      - manageFunction/create
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/function/{functionId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "mode": "Enabled",
            "definition": "function handle(input, context) { return []; }",
            "description": "Fetches records from Airtable and creates alerts in TheHive.",
            "config": {
              "apiKey": "<api_key>"
            },
            "types": [
              "api"
            ]
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/function/{functionId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "mode": "Enabled",
                  "definition": "function handle(input, context) { return []; }",
                  "description": "Fetches records from Airtable and creates alerts in TheHive.",
                  "config": {
                      "apiKey": "<api_key>"
                  },
                  "types": [
                      "api"
                  ]
              },
          )
          response.raise_for_status()
  /api/v1/function/_test:
    post:
      tags:
      - Function
      summary: Test a function
      description: |
        Test function code without saving it to the database.

        Returns the same output as invoking a saved function: the value returned by
        `handle`, execution time in milliseconds, and stdout/stderr content.

        Use `GET /api/v1/function/_context/documentation` to list the available context
        methods and fields.

        Set `dryRun=true` to simulate the function without persisting any changes.

        Required permission: `manageFunction/create`
      operationId: Test Function
      parameters:
      - name: dryRun
        in: query
        description: Set to `true` to simulate the execution without persisting any
          changes.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputTestFunction'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputInvokeFunctionOk'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: InternalError
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/OutputInvokeFunctionKo'
                - type: object
                  required:
                  - type
                  - message
                  properties:
                    type:
                      type: string
                    message:
                      type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageFunction/create
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/function/_test" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "airtable-to-alert",
            "definition": "function handle(input, context) { return \"Hello world\"; }",
            "config": {
              "threshold": 10
            },
            "input": {
              "source": "test-source",
              "title": "Test input"
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/function/_test",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "airtable-to-alert",
                  "definition": "function handle(input, context) { return \"Hello world\"; }",
                  "config": {
                      "threshold": 10
                  },
                  "input": {
                      "source": "test-source",
                      "title": "Test input"
                  }
              },
          )
          response.raise_for_status()
  /api/v1/function/_context/documentation:
    get:
      tags:
      - Function
      summary: Get context object documentation
      description: |
        List the fields and methods available on the `context` object passed to function
        code at runtime.
      operationId: Get documentation for the context object
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputContextDocumentation'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/caseReportTemplate:
    post:
      tags:
      - Case Report Template
      summary: Create a case report template
      description: |
        Create a new case report template. Case report templates define the layout
        used to generate reports from case descriptions, including widgets, header,
        footer, and date formats.

        Required permission: `manageCaseReportTemplate`

        Required license: Platinum or One
      operationId: Create case report template
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputCreateCaseReportTemplate'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReportTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-TheHive-permissions:
      - manageCaseReportTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/caseReportTemplate" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Ransomware Investigation Report",
            "group": "Incident Response",
            "description": "Standard template for ransomware incident investigations.",
            "definition": {
              "widgets": [
                {
                  "_kind": "ObservableTable",
                  "title": "Observables",
                  "columns": [
                    "dataType",
                    "data",
                    "tlp"
                  ],
                  "filter": {
                    "_eq": {
                      "_field": "ioc",
                      "_value": true
                    }
                  },
                  "sort": [
                    "+_createdAt"
                  ]
                }
              ],
              "header": {
                "template": "Incident Report — {{case.title}}"
              },
              "footer": {
                "template": "Confidential — {{case.title}}"
              },
              "dateFormat": "yyyy-MM-dd",
              "dateTimeFormat": "yyyy-MM-dd HH:mm",
              "i18n": {
                "lang": "en"
              }
            },
            "version": 1
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/caseReportTemplate",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Ransomware Investigation Report",
                  "group": "Incident Response",
                  "description": "Standard template for ransomware incident investigations.",
                  "definition": {
                      "widgets": [
                          {
                              "_kind": "ObservableTable",
                              "title": "Observables",
                              "columns": [
                                  "dataType",
                                  "data",
                                  "tlp"
                              ],
                              "filter": {
                                  "_eq": {
                                      "_field": "ioc",
                                      "_value": True
                                  }
                              },
                              "sort": [
                                  "+_createdAt"
                              ]
                          }
                      ],
                      "header": {
                          "template": "Incident Report — {{case.title}}"
                      },
                      "footer": {
                          "template": "Confidential — {{case.title}}"
                      },
                      "dateFormat": "yyyy-MM-dd",
                      "dateTimeFormat": "yyyy-MM-dd HH:mm",
                      "i18n": {
                          "lang": "en"
                      }
                  },
                  "version": 1
              },
          )
          response.raise_for_status()
  /api/v1/caseReportTemplate/{templateId}:
    get:
      tags:
      - Case Report Template
      summary: Get a case report template
      description: |
        Retrieves a single case report template by its ID.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs.

        Required license: Platinum or One
      operationId: Get case report template
      parameters:
      - name: templateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReportTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/caseReportTemplate/{idOrName}:
    delete:
      tags:
      - Case Report Template
      summary: Delete a case report template
      description: |
        Delete a case report template. This operation is irreversible.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs.

        Required permission: `manageCaseReportTemplate`

        Required license: Platinum or One
      operationId: Delete case report template
      parameters:
      - name: idOrName
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-TheHive-permissions:
      - manageCaseReportTemplate
    patch:
      tags:
      - Case Report Template
      summary: Update a case report template
      description: |
        Update one or more fields of an existing case report template.
        Only the fields provided in the request body are updated.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs.

        Required permission: `manageCaseReportTemplate`

        Required license: Platinum or One
      operationId: Update case report template
      parameters:
      - name: idOrName
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateCaseReportTemplate'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-TheHive-permissions:
      - manageCaseReportTemplate
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/caseReportTemplate/{idOrName}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "title": "Ransomware Investigation Report",
            "group": "Incident Response",
            "description": "Standard template for ransomware incident investigations.",
            "definition": {
              "widgets": [
                {
                  "_kind": "ObservableTable",
                  "title": "Observables",
                  "columns": [
                    "dataType",
                    "data",
                    "tlp"
                  ],
                  "filter": {
                    "_eq": {
                      "_field": "ioc",
                      "_value": true
                    }
                  },
                  "sort": [
                    "+_createdAt"
                  ]
                }
              ],
              "header": {
                "template": "Incident Report — {{case.title}}"
              },
              "footer": {
                "template": "Confidential — {{case.title}}"
              },
              "dateFormat": "yyyy-MM-dd",
              "dateTimeFormat": "yyyy-MM-dd HH:mm",
              "i18n": {
                "lang": "en"
              }
            },
            "version": 2
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/caseReportTemplate/{idOrName}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "title": "Ransomware Investigation Report",
                  "group": "Incident Response",
                  "description": "Standard template for ransomware incident investigations.",
                  "definition": {
                      "widgets": [
                          {
                              "_kind": "ObservableTable",
                              "title": "Observables",
                              "columns": [
                                  "dataType",
                                  "data",
                                  "tlp"
                              ],
                              "filter": {
                                  "_eq": {
                                      "_field": "ioc",
                                      "_value": True
                                  }
                              },
                              "sort": [
                                  "+_createdAt"
                              ]
                          }
                      ],
                      "header": {
                          "template": "Incident Report — {{case.title}}"
                      },
                      "footer": {
                          "template": "Confidential — {{case.title}}"
                      },
                      "dateFormat": "yyyy-MM-dd",
                      "dateTimeFormat": "yyyy-MM-dd HH:mm",
                      "i18n": {
                          "lang": "en"
                      }
                  },
                  "version": 2
              },
          )
          response.raise_for_status()
  /api/v1/caseReportTemplate/_info:
    get:
      tags:
      - Case Report Template
      summary: List available widget types and field options
      description: |
        Returns all available widget types and the fields supported by each
        widget category (alert, observable, task, TTP, log, and timeline event fields).
        Use this endpoint to discover valid values before building or updating a
        case report template definition.

        Required license: Platinum or One
      operationId: Get case report template options
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReportTemplateObjects'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/caseReportTemplate/{caseReportTemplateId}/export:
    get:
      tags:
      - Case Report Template
      summary: Export a case report template as a file
      description: |
        Download a case report template as a TheHive template file with the
        `.thtp` extension. The file is a zip archive containing the template
        title, description, and definition as JSON. Use
        `POST /api/v1/caseReportTemplate/import` to import the file into
        another TheHive instance.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs.

        Required permission: `manageCaseReportTemplate`

        Required license: Platinum or One
      operationId: Export Case Report Template as archive
      parameters:
      - name: caseReportTemplateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseReportTemplate
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/caseReportTemplate/import:
    post:
      tags:
      - Case Report Template
      summary: Import a case report template from a file
      description: |
        Create a new case report template from a TheHive template file with the
        `.thtp` extension, uploaded as a multipart form. The file is a zip
        archive containing the template as JSON. Use
        `GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export` to produce
        the file from an existing template. Files with an unsupported template
        format version are rejected.

        Required permission: `manageCaseReportTemplate`

        Required license: Platinum or One
      operationId: Import Case Report Template from file
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              required:
              - _json
              - file
              properties:
                _json:
                  $ref: '#/components/schemas/ImportCaseReportTemplate'
                file:
                  type: string
                  format: binary
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReportTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseReportTemplate
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/caseReportTemplate/{templateId}/attachment:
    post:
      tags:
      - Case Report Template
      summary: Add an attachment to a case report template
      description: |
        Upload a file as an attachment to a case report template. Files are uploaded
        as a multipart form and saved to the configured storage backend. Attachments
        can then be used in `Image` widgets within the template definition.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs.

        Required permission: `manageCaseReportTemplate`
      operationId: Create Attachment to Case Report Template
      parameters:
      - name: templateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputAttachmentsFile'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAttachments'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseReportTemplate
  /api/v1/caseReportTemplate/{templateId}/attachment/{attachmentId}:
    get:
      tags:
      - Case Report Template
      summary: Get an attachment from a case report template
      description: |
        Stream the binary content of an attachment linked to a case report template.
        Supports conditional requests with the `If-None-Match` header: if the
        attachment hasn't changed since the last request, returns `304 Not Modified`
        with an empty body.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs, and `getCaseReportTemplate` followed
        by `attachments` to retrieve attachment IDs.
      operationId: Get Attachment for Case Report Template
      parameters:
      - name: templateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Case Report Template
      summary: Remove an attachment from a case report template
      description: |
        Remove an attachment from a case report template. The file is unlinked
        from the template but may still exist in the storage backend if
        referenced by other objects.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs, and `getCaseReportTemplate` followed
        by `attachments` to retrieve attachment IDs.

        Required permission: `manageCaseReportTemplate`
      operationId: Delete Attachment for Case Report Template
      parameters:
      - name: templateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageCaseReportTemplate
  /api/v1/caseReportTemplate/{templateId}/attachment/{attachmentId}/download:
    get:
      tags:
      - Case Report Template
      summary: Download an attachment from a case report template
      description: |
        Download the binary content of an attachment from a case report template.
        The response includes a `Content-Disposition: attachment` header so
        the browser saves the file to disk rather than rendering it inline.

        Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
        available templates and their IDs, and `getCaseReportTemplate` followed
        by `attachments` to retrieve attachment IDs.
      operationId: Download Attachment for Case Report Template
      parameters:
      - name: templateId
        in: path
        description: The case report template ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: attachmentId
        in: path
        description: The attachment ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Formatted as `attachment; filename=<filename>`.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
  /api/v1/caseReport/render:
    get:
      tags:
      - Case Report
      summary: Preview a case report without saving
      description: |
        Renders a case report and returns the output without saving it.
        Use this endpoint to get a URL you can open directly in a browser,
        for example to embed a preview in an iframe. This GET variant only
        accepts a saved case report template via `caseReportTemplateId`.
        To provide a custom inline definition, use the POST variant instead:
        `POST /api/v1/caseReport/render`.

        If `caseId` is omitted, TheHive uses fake data to fill the report.

        The response includes a `Content-Security-Policy: script-src 'none'` header,
        which blocks JavaScript execution in compliant browsers, and a `Referrer-Policy: no-referrer`
        header to prevent the browser from sending the `Referer` header.

        Required license: Platinum or One
      operationId: Render Case Report Template (GET)
      parameters:
      - name: format
        in: query
        description: 'Output format for the rendered report. Accepted values: `html`,
          `markdown`, `word`.'
        required: true
        schema:
          type: string
      - name: caseReportTemplateId
        in: query
        description: ID of the case report template to use. Must match an existing
          template. Use `POST /api/v1/query` with `listCaseReportTemplate` to retrieve
          available templates and their IDs.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: caseId
        in: query
        description: ID of the case to use for data. Use `POST /api/v1/query` with
          `listCase` to retrieve available cases and their IDs. If omitted, TheHive
          uses fake data to fill the template.
        required: false
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      - name: maxElements
        in: query
        description: Maximum number of elements displayed per widget. Doesn't affect
          the number of elements included when saving or downloading the report.
        required: false
        schema:
          type: integer
          format: int32
          exclusiveMinimum: 0
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: Content type of the rendered output.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
    post:
      tags:
      - Case Report
      summary: Preview a case report without saving
      description: |
        Renders a case report and returns the output without saving it.
        Use this endpoint to preview a custom inline definition (`definition`)
        or a saved case report template (`caseReportTemplateId`).
        To get a URL you can open directly in a browser, use the GET
        variant instead: `GET /api/v1/caseReport/render`.

        Either `definition` or `caseReportTemplateId` must be provided.
        If `caseId` is omitted, TheHive uses fake data to fill the report.

        The response includes a `Content-Security-Policy: script-src 'none'` header,
        which blocks JavaScript execution in compliant browsers, and a `Referrer-Policy: no-referrer`
        header to prevent the browser from sending the `Referer` header.

        Required license: Platinum or One
      operationId: Render Case Report Template
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputRenderCaseReport'
            example:
              format: html
              definition:
                widgets:
                - _kind: AlertList
                  title: Linked Alerts
                  fields:
                  - title
                  - severity
                  - date
                  - status
                  - tags
                  filter:
                    _field: status
                    _value: New
                  sort:
                  - date: desc
                  maxElements: 20
                dateFormat: yyyy-MM-dd
                dateTimeFormat: yyyy-MM-dd HH:mm
                i18n: {}
              caseId: ~59643
        required: true
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: Content type of the rendered output.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/caseReport/render" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "format": "html",
            "definition": {
              "widgets": [
                {
                  "_kind": "AlertList",
                  "title": "Linked Alerts",
                  "fields": [
                    "title",
                    "severity",
                    "date",
                    "status",
                    "tags"
                  ],
                  "filter": {
                    "_field": "status",
                    "_value": "New"
                  },
                  "sort": [
                    {
                      "date": "desc"
                    }
                  ],
                  "maxElements": 20
                }
              ],
              "dateFormat": "yyyy-MM-dd",
              "dateTimeFormat": "yyyy-MM-dd HH:mm",
              "i18n": {}
            },
            "caseId": "~59643"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/caseReport/render",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "format": "html",
                  "definition": {
                      "widgets": [
                          {
                              "_kind": "AlertList",
                              "title": "Linked Alerts",
                              "fields": [
                                  "title",
                                  "severity",
                                  "date",
                                  "status",
                                  "tags"
                              ],
                              "filter": {
                                  "_field": "status",
                                  "_value": "New"
                              },
                              "sort": [
                                  {
                                      "date": "desc"
                                  }
                              ],
                              "maxElements": 20
                          }
                      ],
                      "dateFormat": "yyyy-MM-dd",
                      "dateTimeFormat": "yyyy-MM-dd HH:mm",
                      "i18n": {}
                  },
                  "caseId": "~59643"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/report:
    post:
      tags:
      - Case Report
      summary: Generate a case report from a template
      description: |
        Generate a case report for a case using a case report template
        and save the result. The report is then available in the
        **Attachments** tab of the case.

        Use `POST /api/v1/query` with `listCase` to retrieve available
        cases and their IDs.

        Required permission: `manageCaseReport`
        Required license: Platinum or One
      operationId: Generate Case Report
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputGenerateCaseReport'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReport'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-TheHive-permissions:
      - manageCaseReport
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/case/{caseId}/report" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "caseReportTemplateId": "~84512",
            "format": "html"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/case/{caseId}/report",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "caseReportTemplateId": "~84512",
                  "format": "html"
              },
          )
          response.raise_for_status()
  /api/v1/case/{caseId}/report/upload:
    post:
      tags:
      - Case Report
      summary: Upload a case report file
      description: |
        Attach an externally produced report file to a case.
        Use this endpoint instead of `POST /api/v1/case/{caseId}/report`
        when the report was generated outside TheHive. The report is then
        available in the **Attachments** tab of the case.

        Use `POST /api/v1/query` with `listCase` to retrieve available
        cases and their IDs.

        Required permission: `manageCaseReport`
        Required license: Platinum or One
      operationId: Upload Case Report
      parameters:
      - name: caseId
        in: path
        description: The case ID preceded by `~`, or the case number.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputUploadCaseReport'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseReport'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
      x-TheHive-permissions:
      - manageCaseReport
  /api/v1/caseReport/{reportId}/download:
    get:
      tags:
      - Case Report
      summary: Download a case report file
      description: |
        Download the case report file as an attachment.
        The response includes a `Content-Disposition: attachment` header so the browser
        saves the file to disk rather than rendering it inline.

        Use `POST /api/v1/query` with `listCaseReport` to retrieve
        available case reports and their IDs.

        Required license: Platinum or One
      operationId: Download Case Report
      parameters:
      - name: reportId
        in: path
        description: The case report ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: Content type of the report file.
              required: true
              schema:
                type: string
            Content-Length:
              description: Size of the report file in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Attachment disposition with the report filename.
              required: true
              schema:
                type: string
            Content-Transfer-Encoding:
              description: Always `binary` for file downloads.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/caseReport/{reportId}:
    delete:
      tags:
      - Case Report
      summary: Delete a case report
      description: |
        Delete a case report.

        Use `POST /api/v1/query` with `listCaseReport` to retrieve
        available case reports and their IDs.

        Required permission: `manageCaseReport`
        Required license: Platinum or One
      operationId: Delete Case Report
      parameters:
      - name: reportId
        in: path
        description: The case report ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
    patch:
      tags:
      - Case Report
      summary: Replace the content of a case report
      description: |
        Replace the content of a case report with a new uploaded file.

        Use `POST /api/v1/query` with `listCaseReport` to retrieve
        available case reports and their IDs.

        Required permission: `manageCaseReport`
        Required license: Platinum or One
      operationId: Update Case Report
      parameters:
      - name: reportId
        in: path
        description: The case report ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputUpdateCaseReport'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/caseReport/{reportId}/view:
    get:
      tags:
      - Case Report
      summary: View a case report in the browser
      description: |
        Returns the case report content for inline display in a browser.
        The response includes a `Content-Security-Policy: script-src 'none'; frame-src 'none'; object-src 'none'`
        header, which blocks JavaScript execution, framing, and plugin content in compliant browsers, and a
        `Referrer-Policy: no-referrer` header to prevent the browser from sending the `Referer` header.

        Use `POST /api/v1/query` with `listCaseReport` to retrieve
        available case reports and their IDs.

        Required license: Platinum or One
      operationId: View Case Report
      parameters:
      - name: reportId
        in: path
        description: The case report ID preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: Content type of the report file.
              required: true
              schema:
                type: string
            Content-Length:
              description: Size of the report file in bytes.
              required: true
              schema:
                type: integer
                format: int64
            Content-Disposition:
              description: Inline disposition — the content displays in the browser.
              required: true
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - case.reporting
  /api/v1/connector/email-intake/providers:
    get:
      tags:
      - Email Intake
      summary: List available email intake providers
      description: |
        Lists all email intake providers available on the server.
        Use the returned `name` and `_kind` values to set the provider
        when configuring a new mailbox connection.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Available providers
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                uniqueItems: true
                items:
                  $ref: '#/components/schemas/OutputRichEmailIntakeProvider'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
  /api/v1/connector/email-intake/config:
    post:
      tags:
      - Email Intake
      summary: Add a mailbox configuration
      description: |
        Add a new mailbox connection to the email intake module.

        Use `GET /api/v1/connector/email-intake/providers` to list available
        providers. Use `POST /api/v1/connector/email-intake/config/test` to
        verify the connection before saving. Use
        `POST /api/v1/connector/email-intake/folders` to list available folders
        and pick the inbox folder.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One — Platinum or One required for OAuth 2.0 providers: Microsoft 365, Microsoft Graph API, and Google Workspace
      operationId: Add new config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputEmailIntakeConfig'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputEmailIntakeConfig'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/email-intake/config" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "id": "~84123",
            "name": "SOC Mailbox - Office 365",
            "mailbox": {
              "provider": {
                "name": "MSGraph365"
              },
              "credential": {
                "email": "emma@example.com",
                "basicAuth": {
                  "password": "P@ssw0rd!"
                },
                "oAuth2": {
                  "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                  "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                  "secret": "~Q8Mxx-client-secret-placeholder",
                  "authority": "https://login.microsoftonline.com/",
                  "scopes": [
                    "https://mail.google.com/"
                  ],
                  "redirectUri": "https://thehive.example.com",
                  "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                }
              },
              "inbox": "Inbox",
              "archive": "Archive",
              "markAsRead": false,
              "_kind": "api"
            },
            "organisations": [
              "TheOrganization"
            ],
            "enabled": true,
            "createdAt": 1703174400000,
            "alertProperties": {
              "type": "email-intake",
              "source": "{name}",
              "tags": [
                "email-intake",
                "source:{name}",
                "{mailbox.provider.name}"
              ]
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/email-intake/config",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "id": "~84123",
                  "name": "SOC Mailbox - Office 365",
                  "mailbox": {
                      "provider": {
                          "name": "MSGraph365"
                      },
                      "credential": {
                          "email": "emma@example.com",
                          "basicAuth": {
                              "password": "P@ssw0rd!"
                          },
                          "oAuth2": {
                              "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                              "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                              "secret": "~Q8Mxx-client-secret-placeholder",
                              "authority": "https://login.microsoftonline.com/",
                              "scopes": [
                                  "https://mail.google.com/"
                              ],
                              "redirectUri": "https://thehive.example.com",
                              "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                          }
                      },
                      "inbox": "Inbox",
                      "archive": "Archive",
                      "markAsRead": False,
                      "_kind": "api"
                  },
                  "organisations": [
                      "TheOrganization"
                  ],
                  "enabled": True,
                  "createdAt": 1703174400000,
                  "alertProperties": {
                      "type": "email-intake",
                      "source": "{name}",
                      "tags": [
                          "email-intake",
                          "source:{name}",
                          "{mailbox.provider.name}"
                      ]
                  }
              },
          )
          response.raise_for_status()
  /api/v1/connector/email-intake/config/{configId}:
    get:
      tags:
      - Email Intake
      summary: Get a mailbox configuration
      description: |
        Returns the configuration of the mailbox identified by `configId`.

        Use `GET /api/v1/connector/email-intake/configs` to retrieve available
        configurations and their IDs.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Get config
      parameters:
      - name: configId
        in: path
        description: The mailbox configuration ID preceded by `~`.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputEmailIntakeConfig'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
    put:
      tags:
      - Email Intake
      summary: Update a mailbox configuration
      description: |
        Replace the mailbox configuration identified by `configId`.

        Use `GET /api/v1/connector/email-intake/configs` to retrieve available
        configurations and their IDs.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One — Platinum or One required for OAuth 2.0 providers: Microsoft 365, Microsoft Graph API, and Google Workspace
      operationId: Update config
      parameters:
      - name: configId
        in: path
        description: The mailbox configuration ID preceded by `~`.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputEmailIntakeConfig'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/connector/email-intake/config/{configId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "id": "~84123",
            "name": "SOC Mailbox - Office 365",
            "mailbox": {
              "provider": {
                "name": "MSGraph365"
              },
              "credential": {
                "email": "emma@example.com",
                "basicAuth": {
                  "password": "P@ssw0rd!"
                },
                "oAuth2": {
                  "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                  "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                  "secret": "~Q8Mxx-client-secret-placeholder",
                  "authority": "https://login.microsoftonline.com/",
                  "scopes": [
                    "https://mail.google.com/"
                  ],
                  "redirectUri": "https://thehive.example.com",
                  "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                }
              },
              "inbox": "Inbox",
              "archive": "Archive",
              "markAsRead": false,
              "_kind": "api"
            },
            "organisations": [
              "TheOrganization"
            ],
            "enabled": true,
            "createdAt": 1703174400000,
            "alertProperties": {
              "type": "email-intake",
              "source": "{name}",
              "tags": [
                "email-intake",
                "source:{name}",
                "{mailbox.provider.name}"
              ]
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/connector/email-intake/config/{configId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "id": "~84123",
                  "name": "SOC Mailbox - Office 365",
                  "mailbox": {
                      "provider": {
                          "name": "MSGraph365"
                      },
                      "credential": {
                          "email": "emma@example.com",
                          "basicAuth": {
                              "password": "P@ssw0rd!"
                          },
                          "oAuth2": {
                              "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                              "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                              "secret": "~Q8Mxx-client-secret-placeholder",
                              "authority": "https://login.microsoftonline.com/",
                              "scopes": [
                                  "https://mail.google.com/"
                              ],
                              "redirectUri": "https://thehive.example.com",
                              "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                          }
                      },
                      "inbox": "Inbox",
                      "archive": "Archive",
                      "markAsRead": False,
                      "_kind": "api"
                  },
                  "organisations": [
                      "TheOrganization"
                  ],
                  "enabled": True,
                  "createdAt": 1703174400000,
                  "alertProperties": {
                      "type": "email-intake",
                      "source": "{name}",
                      "tags": [
                          "email-intake",
                          "source:{name}",
                          "{mailbox.provider.name}"
                      ]
                  }
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Email Intake
      summary: Delete a mailbox configuration
      description: |
        Permanently remove the mailbox configuration identified by `configId`.

        Use `GET /api/v1/connector/email-intake/configs` to retrieve available
        configurations and their IDs.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Delete config
      parameters:
      - name: configId
        in: path
        description: The mailbox configuration ID preceded by `~`.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
  /api/v1/connector/email-intake/configs:
    get:
      tags:
      - Email Intake
      summary: Get the email intake module configuration
      description: |
        Returns the full configuration of the email intake module, including
        whether it's enabled, the sync interval, and all mailbox configurations.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Get configs
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputRichEmailIntake'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
    put:
      tags:
      - Email Intake
      summary: Update the email intake module settings
      description: |
        Update the global email intake module settings: the enabled flag and
        the sync interval. This endpoint doesn't manage individual mailbox
        configurations. Use `POST /api/v1/connector/email-intake/config` to add a
        mailbox, or `PUT /api/v1/connector/email-intake/config/{configId}` to
        update one.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Update configs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputEmailIntake'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/connector/email-intake/configs" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "enabled": true,
            "interval": "5 minutes"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/connector/email-intake/configs",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "enabled": True,
                  "interval": "5 minutes"
              },
          )
          response.raise_for_status()
  /api/v1/connector/email-intake/folders:
    post:
      tags:
      - Email Intake
      summary: List mailbox folders
      description: |
        Returns all folders available in the mailbox described by the request body.
        Use this to discover folder names before setting `mailbox.inbox` or
        `mailbox.archive` when adding or updating a configuration.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One — Platinum or One required for OAuth 2.0 providers: Microsoft 365, Microsoft Graph API, and Google Workspace
      operationId: Get mailbox folders
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputEmailIntakeConfig'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
              example:
              - Inbox
              - Archive
              - Sent
              - Junk Email
              - Deleted Items
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/email-intake/folders" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "id": "~84123",
            "name": "SOC Mailbox - Office 365",
            "mailbox": {
              "provider": {
                "name": "MSGraph365"
              },
              "credential": {
                "email": "emma@example.com",
                "basicAuth": {
                  "password": "P@ssw0rd!"
                },
                "oAuth2": {
                  "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                  "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                  "secret": "~Q8Mxx-client-secret-placeholder",
                  "authority": "https://login.microsoftonline.com/",
                  "scopes": [
                    "https://mail.google.com/"
                  ],
                  "redirectUri": "https://thehive.example.com",
                  "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                }
              },
              "inbox": "Inbox",
              "archive": "Archive",
              "markAsRead": false,
              "_kind": "api"
            },
            "organisations": [
              "TheOrganization"
            ],
            "enabled": true,
            "createdAt": 1703174400000,
            "alertProperties": {
              "type": "email-intake",
              "source": "{name}",
              "tags": [
                "email-intake",
                "source:{name}",
                "{mailbox.provider.name}"
              ]
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/email-intake/folders",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "id": "~84123",
                  "name": "SOC Mailbox - Office 365",
                  "mailbox": {
                      "provider": {
                          "name": "MSGraph365"
                      },
                      "credential": {
                          "email": "emma@example.com",
                          "basicAuth": {
                              "password": "P@ssw0rd!"
                          },
                          "oAuth2": {
                              "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                              "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                              "secret": "~Q8Mxx-client-secret-placeholder",
                              "authority": "https://login.microsoftonline.com/",
                              "scopes": [
                                  "https://mail.google.com/"
                              ],
                              "redirectUri": "https://thehive.example.com",
                              "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                          }
                      },
                      "inbox": "Inbox",
                      "archive": "Archive",
                      "markAsRead": False,
                      "_kind": "api"
                  },
                  "organisations": [
                      "TheOrganization"
                  ],
                  "enabled": True,
                  "createdAt": 1703174400000,
                  "alertProperties": {
                      "type": "email-intake",
                      "source": "{name}",
                      "tags": [
                          "email-intake",
                          "source:{name}",
                          "{mailbox.provider.name}"
                      ]
                  }
              },
          )
          response.raise_for_status()
  /api/v1/connector/email-intake/config/authorizationCode:
    post:
      tags:
      - Email Intake
      summary: Complete Google Workspace OAuth 2.0 authorization
      description: |
        Exchange a Google Workspace OAuth 2.0 authorization code for a new pending
        configuration entry and returns its ID. Call this after the user completes
        the Google consent flow and your application receives the authorization code.

        Request body: `{ "authorizationCode": "<code>" }`

        Response body: `{ "id": "<configId>", "authorizationCode": "<code>" }`

        Pass the returned `id` as the `id` field when calling
        `POST /api/v1/connector/email-intake/config` to save the configuration.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Platinum or One
      operationId: 'GW: Set authorization code'
      requestBody:
        content:
          application/json:
            schema: {}
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema: {}
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
  /api/v1/connector/email-intake/config/test:
    post:
      tags:
      - Email Intake
      summary: Test a mailbox connection
      description: |
        Test the connection to a mailbox using the provided configuration without
        saving it. Use this before calling
        `POST /api/v1/connector/email-intake/config` to verify credentials and
        network connectivity.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One — Platinum or One required for OAuth 2.0 providers: Microsoft 365, Microsoft Graph API, and Google Workspace
      operationId: Test config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputEmailIntakeConfig'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/email-intake/config/test" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "id": "~84123",
            "name": "SOC Mailbox - Office 365",
            "mailbox": {
              "provider": {
                "name": "MSGraph365"
              },
              "credential": {
                "email": "emma@example.com",
                "basicAuth": {
                  "password": "P@ssw0rd!"
                },
                "oAuth2": {
                  "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                  "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                  "secret": "~Q8Mxx-client-secret-placeholder",
                  "authority": "https://login.microsoftonline.com/",
                  "scopes": [
                    "https://mail.google.com/"
                  ],
                  "redirectUri": "https://thehive.example.com",
                  "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                }
              },
              "inbox": "Inbox",
              "archive": "Archive",
              "markAsRead": false,
              "_kind": "api"
            },
            "organisations": [
              "TheOrganization"
            ],
            "enabled": true,
            "createdAt": 1703174400000,
            "alertProperties": {
              "type": "email-intake",
              "source": "{name}",
              "tags": [
                "email-intake",
                "source:{name}",
                "{mailbox.provider.name}"
              ]
            }
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/email-intake/config/test",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "id": "~84123",
                  "name": "SOC Mailbox - Office 365",
                  "mailbox": {
                      "provider": {
                          "name": "MSGraph365"
                      },
                      "credential": {
                          "email": "emma@example.com",
                          "basicAuth": {
                              "password": "P@ssw0rd!"
                          },
                          "oAuth2": {
                              "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                              "tenantId": "f8a9b0c1-d2e3-4f56-7890-abcdef123456",
                              "secret": "~Q8Mxx-client-secret-placeholder",
                              "authority": "https://login.microsoftonline.com/",
                              "scopes": [
                                  "https://mail.google.com/"
                              ],
                              "redirectUri": "https://thehive.example.com",
                              "authorizationCode": "4/0AfJohXm-authorization-code-placeholder"
                          }
                      },
                      "inbox": "Inbox",
                      "archive": "Archive",
                      "markAsRead": False,
                      "_kind": "api"
                  },
                  "organisations": [
                      "TheOrganization"
                  ],
                  "enabled": True,
                  "createdAt": 1703174400000,
                  "alertProperties": {
                      "type": "email-intake",
                      "source": "{name}",
                      "tags": [
                          "email-intake",
                          "source:{name}",
                          "{mailbox.provider.name}"
                      ]
                  }
              },
          )
          response.raise_for_status()
  /api/v1/connector/email-intake/sync:
    post:
      tags:
      - Email Intake
      summary: Trigger an immediate email fetch
      description: |
        Trigger an immediate email fetch without waiting for the next scheduled
        interval. By default, syncs all connected mailboxes. To sync a single
        mailbox, add the `configId` query parameter:
        `POST /api/v1/connector/email-intake/sync?configId=<configId>`.
        Use `GET /api/v1/connector/email-intake/configs` to retrieve available
        configuration IDs.

        Required permissions: `manageConfig`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Gold, Platinum, or One
      operationId: Sync
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      x-TheHive-permissions:
      - manageConfig
  /api/v1/branding:
    get:
      tags:
      - Branding
      summary: Get branding
      description: Returns the title and logo URLs currently configured for TheHive.
      operationId: Get branding
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputBranding'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    post:
      tags:
      - Branding
      summary: Set branding
      description: |
        Set the browser tab title, login page logo, navigation bar logo,
        and favicon.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Platinum or One
      operationId: Set branding
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/InputBranding'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputBranding'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - branding
      x-TheHive-permissions:
      - managePlatform
  /api/v1/branding/assets/{kind}:
    get:
      tags:
      - Branding
      summary: Get a branding asset
      description: Returns the image file for a login logo, navigation bar logo, or
        favicon.
      operationId: Get branding attachment
      parameters:
      - name: kind
        in: path
        description: 'Enum: `loginLogo` `menuLogo` `favicon`<br>Branding asset to
          retrieve.'
        required: true
        schema:
          type: string
      - name: If-None-Match
        in: header
        description: ETag from a previous response. If it matches, returns `304 Not
          Modified` instead of the file content.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success
          headers:
            Content-Type:
              description: MIME content type of the file.
              required: true
              schema:
                type: string
            Content-Length:
              description: File size in bytes.
              required: true
              schema:
                type: integer
                format: int64
            ETag:
              description: ETag for conditional requests.
              required: false
              schema:
                type: string
            Content-Security-Policy:
              description: Prevents script execution to protect against XSS attacks.
              required: true
              schema:
                type: string
            Referrer-Policy:
              description: Prevents the browser from sending the Referer header.
              required: true
              schema:
                type: string
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '304':
          description: The attachment hasn't changed since the last request
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Branding
      summary: Delete a branding asset
      description: |
        Remove a login logo, navigation bar logo, or favicon, reverting
        to the default TheHive branding for that asset.

        Required permissions: `managePlatform`. Call it
        with the `X-Organisation: admin` header to target the `admin`
        organization.

        Required license: Platinum or One
      operationId: Delete branding attachment
      parameters:
      - name: kind
        in: path
        description: 'Enum: `loginLogo` `menuLogo` `favicon`<br>Branding asset to
          delete.'
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - branding
      x-TheHive-permissions:
      - managePlatform
  /api/v1/tag/{tagId}:
    get:
      tags:
      - Tag
      summary: Get a tag
      description: |
        Retrieves a tag by ID. Tags are labels assigned to cases,
        alerts, and observables in TheHive. Both custom and taxonomy
        tags are supported.

        Use `POST /api/v1/query` with `listTag` to retrieve available
        custom tags and their IDs, and with `listTaxonomy` then `tags`
        to retrieve available taxonomy tags and their IDs.
      operationId: Get Tag
      parameters:
      - name: tagId
        in: path
        description: The ID of the tag preceded by `~`.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputTag'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
    delete:
      tags:
      - Tag
      summary: Delete a tag
      description: |
        Delete a custom tag from the organization. Taxonomy
        tags can't be deleted. Deleting a tag removes it from all
        cases, alerts, and observables in the organization.

        Use `POST /api/v1/query` with `listTag` to retrieve available
        tags, their IDs and names.

        Required permission: `manageTag`
      operationId: Delete Tag
      parameters:
      - name: tagId
        in: path
        description: The ID of the tag to delete preceded by `~`, or the tag name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTag
    patch:
      tags:
      - Tag
      summary: Update a tag
      description: |
        Update a custom tag. Taxonomy tags can't be updated.
        Changes apply to all
        instances of the tag across cases, alerts, and observables
        in the organization.

        Use `POST /api/v1/query` with `listTag` to retrieve available
        tags, their IDs and names.

        Required permission: `manageTag`
      operationId: Update Tag
      parameters:
      - name: tagId
        in: path
        description: The ID of the tag to update preceded by `~`, or the tag name.
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateTag'
        required: true
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-permissions:
      - manageTag
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PATCH "$THEHIVE_HOST/api/v1/tag/{tagId}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "predicate": "ransomware",
            "description": "Identifies ransomware-related cases and observables",
            "colour": "#e8560a"
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.patch(
              f"{THEHIVE_HOST}/api/v1/tag/{tagId}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "predicate": "ransomware",
                  "description": "Identifies ransomware-related cases and observables",
                  "colour": "#e8560a"
              },
          )
          response.raise_for_status()
  /api/v1/connector/alert-feeder:
    get:
      tags:
      - Alert Feeder
      summary: List all alert feeders
      description: |
        Returns all alert feeders configured in the current organization.

        Required permission: `manageConfig`

        Required license: Platinum or One
      operationId: Get alert feeders
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputAlertFeeder'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
    post:
      tags:
      - Alert Feeder
      summary: Create an alert feeder
      description: |
        Create an alert feeder that periodically retrieves data from an external
        system via HTTP and converts it into alerts using a feeder function.

        Required permission: `manageConfig`

        Required license: Platinum or One

        Prerequisites: The feeder function must exist before you call this endpoint and
        must have the type `feeder:alert`. Use `POST /api/v1/function` to create a function.
      operationId: Create an alert feeder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputAlertFeeder'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAlertFeeder'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/alert-feeder" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "airtable-incidents-feeder",
            "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
            "method": "GET",
            "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
            "interval": {
              "value": 1,
              "unit": "Minutes"
            },
            "functionName": "airtable-to-alert",
            "body": {
              "maxRecords": 100
            },
            "headers": [
              {
                "key": "X-Custom-Header",
                "value": "custom-value"
              }
            ],
            "enabled": true,
            "auth": {
              "username": "alice@example.com",
              "password": "p@ssw0rd",
              "type": "basic"
            },
            "proxyConfig": {
              "timeout": {
                "connection": "2 minutes",
                "idle": "2 minutes",
                "request": "2 minutes"
              },
              "followRedirects": true,
              "useProxyProperties": true,
              "userAgent": "TheHive/5.8",
              "compressionEnabled": false,
              "ssl": {
                "default": false,
                "protocol": "TLSv1.2",
                "revocationLists": [
                  "http://crl.example.com/ca.crl"
                ],
                "enabledCipherSuites": [
                  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                ],
                "enabledProtocols": [
                  "TLSv1.2",
                  "TLSv1.1",
                  "TLSv1"
                ],
                "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                "secureRandom": "SHA1PRNG",
                "trustManager": {
                  "stores": []
                },
                "keyManager": {
                  "algorithm": "PKIX",
                  "stores": [
                    {
                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                      "filePath": "/etc/ssl/certs/thehive.jks",
                      "isFileOnClasspath": false,
                      "password": "p@ssw0rd",
                      "type": "JKS"
                    }
                  ]
                },
                "sslParametersConfig": {
                  "clientAuth": "Default",
                  "protocols": [
                    "TLSv1.2"
                  ]
                },
                "debug": {
                  "all": false,
                  "keymanager": false,
                  "ssl": false,
                  "sslctx": false,
                  "trustmanager": false
                },
                "loose": {
                  "acceptAnyCertificate": false,
                  "disableHostnameVerification": false,
                  "disableSNI": false
                }
              },
              "maxConnectionsPerHost": -1,
              "maxConnectionsTotal": -1,
              "maxConnectionLifetime": "Duration.Inf",
              "idleConnectionInPoolTimeout": "1 minute",
              "connectionPoolCleanerPeriod": "1 minute",
              "maxNumberOfRedirects": 5,
              "maxRequestRetry": 5,
              "disableUrlEncoding": false,
              "keepAlive": true,
              "useLaxCookieEncoder": false,
              "useCookieStore": false,
              "proxy": {
                "host": "proxy.example.com",
                "port": 8080,
                "state": "enabled",
                "protocol": "http",
                "principal": "proxy-user",
                "password": "p@ssw0rd",
                "ntlmDomain": "CORP",
                "encoding": "UTF-8",
                "nonProxyHosts": [
                  "localhost",
                  "*.internal.example.com"
                ]
              }
            },
            "requestTimeout": {
              "value": 10,
              "unit": "Seconds"
            },
            "responseMaxSize": 10485760
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/alert-feeder",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "airtable-incidents-feeder",
                  "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
                  "method": "GET",
                  "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
                  "interval": {
                      "value": 1,
                      "unit": "Minutes"
                  },
                  "functionName": "airtable-to-alert",
                  "body": {
                      "maxRecords": 100
                  },
                  "headers": [
                      {
                          "key": "X-Custom-Header",
                          "value": "custom-value"
                      }
                  ],
                  "enabled": True,
                  "auth": {
                      "username": "alice@example.com",
                      "password": "p@ssw0rd",
                      "type": "basic"
                  },
                  "proxyConfig": {
                      "timeout": {
                          "connection": "2 minutes",
                          "idle": "2 minutes",
                          "request": "2 minutes"
                      },
                      "followRedirects": True,
                      "useProxyProperties": True,
                      "userAgent": "TheHive/5.8",
                      "compressionEnabled": False,
                      "ssl": {
                          "default": False,
                          "protocol": "TLSv1.2",
                          "revocationLists": [
                              "http://crl.example.com/ca.crl"
                          ],
                          "enabledCipherSuites": [
                              "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                              "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                          ],
                          "enabledProtocols": [
                              "TLSv1.2",
                              "TLSv1.1",
                              "TLSv1"
                          ],
                          "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                          "secureRandom": "SHA1PRNG",
                          "trustManager": {
                              "stores": []
                          },
                          "keyManager": {
                              "algorithm": "PKIX",
                              "stores": [
                                  {
                                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                                      "filePath": "/etc/ssl/certs/thehive.jks",
                                      "isFileOnClasspath": False,
                                      "password": "p@ssw0rd",
                                      "type": "JKS"
                                  }
                              ]
                          },
                          "sslParametersConfig": {
                              "clientAuth": "Default",
                              "protocols": [
                                  "TLSv1.2"
                              ]
                          },
                          "debug": {
                              "all": False,
                              "keymanager": False,
                              "ssl": False,
                              "sslctx": False,
                              "trustmanager": False
                          },
                          "loose": {
                              "acceptAnyCertificate": False,
                              "disableHostnameVerification": False,
                              "disableSNI": False
                          }
                      },
                      "maxConnectionsPerHost": -1,
                      "maxConnectionsTotal": -1,
                      "maxConnectionLifetime": "Duration.Inf",
                      "idleConnectionInPoolTimeout": "1 minute",
                      "connectionPoolCleanerPeriod": "1 minute",
                      "maxNumberOfRedirects": 5,
                      "maxRequestRetry": 5,
                      "disableUrlEncoding": False,
                      "keepAlive": True,
                      "useLaxCookieEncoder": False,
                      "useCookieStore": False,
                      "proxy": {
                          "host": "proxy.example.com",
                          "port": 8080,
                          "state": "enabled",
                          "protocol": "http",
                          "principal": "proxy-user",
                          "password": "p@ssw0rd",
                          "ntlmDomain": "CORP",
                          "encoding": "UTF-8",
                          "nonProxyHosts": [
                              "localhost",
                              "*.internal.example.com"
                          ]
                      }
                  },
                  "requestTimeout": {
                      "value": 10,
                      "unit": "Seconds"
                  },
                  "responseMaxSize": 10485760
              },
          )
          response.raise_for_status()
  /api/v1/connector/alert-feeder/run/{alertFeederName}:
    post:
      tags:
      - Alert Feeder
      summary: Run an alert feeder immediately
      description: |
        Trigger an alert feeder to run immediately, outside its regular schedule.
        Set `dryRun` to `true` to simulate the execution without creating alerts.

        Use `GET /api/v1/connector/alert-feeder` to retrieve available alert feeders
        and their names.

        Required permission: `manageConfig`

        Required license: Platinum or One
      operationId: Run an alert feeder
      parameters:
      - name: alertFeederName
        in: path
        description: The name of the alert feeder.
        required: true
        schema:
          type: string
      - name: dryRun
        in: query
        description: Set to `true` to simulate the execution without creating alerts.
        required: false
        allowEmptyValue: true
        schema:
          default: false
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputInvokeFunctionOk'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: InternalError
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/OutputInvokeFunctionKo'
                - type: object
                  required:
                  - type
                  - message
                  properties:
                    type:
                      type: string
                    message:
                      type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
  /api/v1/connector/alert-feeder/{alertFeederName}:
    put:
      tags:
      - Alert Feeder
      summary: Update an alert feeder
      description: |
        Update an existing alert feeder by name.

        Use `GET /api/v1/connector/alert-feeder` to retrieve available alert feeders
        and their names.

        Required permission: `manageConfig`

        Required license: Platinum or One
      operationId: Update an alert feeder
      parameters:
      - name: alertFeederName
        in: path
        description: The name of the alert feeder.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputUpdateAlertFeeder'
        required: true
      responses:
        '201':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputAlertFeeder'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X PUT "$THEHIVE_HOST/api/v1/connector/alert-feeder/{alertFeederName}" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
            "method": "GET",
            "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
            "interval": {
              "value": 1,
              "unit": "Minutes"
            },
            "body": {
              "maxRecords": 100
            },
            "headers": [
              {
                "key": "X-Custom-Header",
                "value": "custom-value"
              }
            ],
            "enabled": true,
            "auth": {
              "username": "alice@example.com",
              "password": "p@ssw0rd",
              "type": "basic"
            },
            "proxyConfig": {
              "timeout": {
                "connection": "2 minutes",
                "idle": "2 minutes",
                "request": "2 minutes"
              },
              "followRedirects": true,
              "useProxyProperties": true,
              "userAgent": "TheHive/5.8",
              "compressionEnabled": false,
              "ssl": {
                "default": false,
                "protocol": "TLSv1.2",
                "revocationLists": [
                  "http://crl.example.com/ca.crl"
                ],
                "enabledCipherSuites": [
                  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                ],
                "enabledProtocols": [
                  "TLSv1.2",
                  "TLSv1.1",
                  "TLSv1"
                ],
                "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                "secureRandom": "SHA1PRNG",
                "trustManager": {
                  "stores": []
                },
                "keyManager": {
                  "algorithm": "PKIX",
                  "stores": [
                    {
                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                      "filePath": "/etc/ssl/certs/thehive.jks",
                      "isFileOnClasspath": false,
                      "password": "p@ssw0rd",
                      "type": "JKS"
                    }
                  ]
                },
                "sslParametersConfig": {
                  "clientAuth": "Default",
                  "protocols": [
                    "TLSv1.2"
                  ]
                },
                "debug": {
                  "all": false,
                  "keymanager": false,
                  "ssl": false,
                  "sslctx": false,
                  "trustmanager": false
                },
                "loose": {
                  "acceptAnyCertificate": false,
                  "disableHostnameVerification": false,
                  "disableSNI": false
                }
              },
              "maxConnectionsPerHost": -1,
              "maxConnectionsTotal": -1,
              "maxConnectionLifetime": "Duration.Inf",
              "idleConnectionInPoolTimeout": "1 minute",
              "connectionPoolCleanerPeriod": "1 minute",
              "maxNumberOfRedirects": 5,
              "maxRequestRetry": 5,
              "disableUrlEncoding": false,
              "keepAlive": true,
              "useLaxCookieEncoder": false,
              "useCookieStore": false,
              "proxy": {
                "host": "proxy.example.com",
                "port": 8080,
                "state": "enabled",
                "protocol": "http",
                "principal": "proxy-user",
                "password": "p@ssw0rd",
                "ntlmDomain": "CORP",
                "encoding": "UTF-8",
                "nonProxyHosts": [
                  "localhost",
                  "*.internal.example.com"
                ]
              }
            },
            "requestTimeout": {
              "value": 10,
              "unit": "Seconds"
            },
            "responseMaxSize": 10485760
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.put(
              f"{THEHIVE_HOST}/api/v1/connector/alert-feeder/{alertFeederName}",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
                  "method": "GET",
                  "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
                  "interval": {
                      "value": 1,
                      "unit": "Minutes"
                  },
                  "body": {
                      "maxRecords": 100
                  },
                  "headers": [
                      {
                          "key": "X-Custom-Header",
                          "value": "custom-value"
                      }
                  ],
                  "enabled": True,
                  "auth": {
                      "username": "alice@example.com",
                      "password": "p@ssw0rd",
                      "type": "basic"
                  },
                  "proxyConfig": {
                      "timeout": {
                          "connection": "2 minutes",
                          "idle": "2 minutes",
                          "request": "2 minutes"
                      },
                      "followRedirects": True,
                      "useProxyProperties": True,
                      "userAgent": "TheHive/5.8",
                      "compressionEnabled": False,
                      "ssl": {
                          "default": False,
                          "protocol": "TLSv1.2",
                          "revocationLists": [
                              "http://crl.example.com/ca.crl"
                          ],
                          "enabledCipherSuites": [
                              "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                              "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                          ],
                          "enabledProtocols": [
                              "TLSv1.2",
                              "TLSv1.1",
                              "TLSv1"
                          ],
                          "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                          "secureRandom": "SHA1PRNG",
                          "trustManager": {
                              "stores": []
                          },
                          "keyManager": {
                              "algorithm": "PKIX",
                              "stores": [
                                  {
                                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                                      "filePath": "/etc/ssl/certs/thehive.jks",
                                      "isFileOnClasspath": False,
                                      "password": "p@ssw0rd",
                                      "type": "JKS"
                                  }
                              ]
                          },
                          "sslParametersConfig": {
                              "clientAuth": "Default",
                              "protocols": [
                                  "TLSv1.2"
                              ]
                          },
                          "debug": {
                              "all": False,
                              "keymanager": False,
                              "ssl": False,
                              "sslctx": False,
                              "trustmanager": False
                          },
                          "loose": {
                              "acceptAnyCertificate": False,
                              "disableHostnameVerification": False,
                              "disableSNI": False
                          }
                      },
                      "maxConnectionsPerHost": -1,
                      "maxConnectionsTotal": -1,
                      "maxConnectionLifetime": "Duration.Inf",
                      "idleConnectionInPoolTimeout": "1 minute",
                      "connectionPoolCleanerPeriod": "1 minute",
                      "maxNumberOfRedirects": 5,
                      "maxRequestRetry": 5,
                      "disableUrlEncoding": False,
                      "keepAlive": True,
                      "useLaxCookieEncoder": False,
                      "useCookieStore": False,
                      "proxy": {
                          "host": "proxy.example.com",
                          "port": 8080,
                          "state": "enabled",
                          "protocol": "http",
                          "principal": "proxy-user",
                          "password": "p@ssw0rd",
                          "ntlmDomain": "CORP",
                          "encoding": "UTF-8",
                          "nonProxyHosts": [
                              "localhost",
                              "*.internal.example.com"
                          ]
                      }
                  },
                  "requestTimeout": {
                      "value": 10,
                      "unit": "Seconds"
                  },
                  "responseMaxSize": 10485760
              },
          )
          response.raise_for_status()
    delete:
      tags:
      - Alert Feeder
      summary: Delete an alert feeder
      description: |
        Delete an existing alert feeder by name. The associated feeder function isn't
        deleted automatically. Use `DELETE /api/v1/function/{functionId}` to remove it
        separately.

        Use `GET /api/v1/connector/alert-feeder` to retrieve available alert feeders
        and their names.

        Required permission: `manageConfig`

        Required license: Platinum or One
      operationId: Delete an alert feeder
      parameters:
      - name: alertFeederName
        in: path
        description: The name of the alert feeder.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
  /api/v1/connector/alert-feeder/test:
    post:
      tags:
      - Alert Feeder
      summary: Test an alert feeder connection
      description: |
        Test the HTTP connection of an alert feeder configuration without saving it.
        Returns the raw response from the external system.

        Required permission: `manageConfig`

        Required license: Platinum or One
      operationId: Test an alert feeder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InputTestAlertFeeder'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema: {}
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '401':
          description: AuthenticationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '403':
          description: AuthorizationError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '404':
          description: NotFoundError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
        '500':
          description: GenericError
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
                    type: string
      security:
      - ApiKey: []
      - Basic: []
      x-TheHive-scopes:
      - name: TheHive
      x-TheHive-capabilities:
      - admin.setConfiguration
      - alertFeeder
      x-TheHive-permissions:
      - manageConfig
      x-codeSamples:
      - lang: Shell
        label: curl
        source: |-
          curl -X POST "$THEHIVE_HOST/api/v1/connector/alert-feeder/test" \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            -d '{
            "name": "airtable-incidents-feeder",
            "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
            "method": "GET",
            "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
            "interval": {
              "value": 1,
              "unit": "Minutes"
            },
            "body": {
              "maxRecords": 100
            },
            "headers": [
              {
                "key": "X-Custom-Header",
                "value": "custom-value"
              }
            ],
            "enabled": true,
            "auth": {
              "username": "alice@example.com",
              "password": "p@ssw0rd",
              "type": "basic"
            },
            "proxyConfig": {
              "timeout": {
                "connection": "2 minutes",
                "idle": "2 minutes",
                "request": "2 minutes"
              },
              "followRedirects": true,
              "useProxyProperties": true,
              "userAgent": "TheHive/5.8",
              "compressionEnabled": false,
              "ssl": {
                "default": false,
                "protocol": "TLSv1.2",
                "revocationLists": [
                  "http://crl.example.com/ca.crl"
                ],
                "enabledCipherSuites": [
                  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                ],
                "enabledProtocols": [
                  "TLSv1.2",
                  "TLSv1.1",
                  "TLSv1"
                ],
                "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                "secureRandom": "SHA1PRNG",
                "trustManager": {
                  "stores": []
                },
                "keyManager": {
                  "algorithm": "PKIX",
                  "stores": [
                    {
                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                      "filePath": "/etc/ssl/certs/thehive.jks",
                      "isFileOnClasspath": false,
                      "password": "p@ssw0rd",
                      "type": "JKS"
                    }
                  ]
                },
                "sslParametersConfig": {
                  "clientAuth": "Default",
                  "protocols": [
                    "TLSv1.2"
                  ]
                },
                "debug": {
                  "all": false,
                  "keymanager": false,
                  "ssl": false,
                  "sslctx": false,
                  "trustmanager": false
                },
                "loose": {
                  "acceptAnyCertificate": false,
                  "disableHostnameVerification": false,
                  "disableSNI": false
                }
              },
              "maxConnectionsPerHost": -1,
              "maxConnectionsTotal": -1,
              "maxConnectionLifetime": "Duration.Inf",
              "idleConnectionInPoolTimeout": "1 minute",
              "connectionPoolCleanerPeriod": "1 minute",
              "maxNumberOfRedirects": 5,
              "maxRequestRetry": 5,
              "disableUrlEncoding": false,
              "keepAlive": true,
              "useLaxCookieEncoder": false,
              "useCookieStore": false,
              "proxy": {
                "host": "proxy.example.com",
                "port": 8080,
                "state": "enabled",
                "protocol": "http",
                "principal": "proxy-user",
                "password": "p@ssw0rd",
                "ntlmDomain": "CORP",
                "encoding": "UTF-8",
                "nonProxyHosts": [
                  "localhost",
                  "*.internal.example.com"
                ]
              }
            },
            "requestTimeout": {
              "value": 10,
              "unit": "Seconds"
            },
            "responseMaxSize": 10485760
          }'
      - lang: Python
        label: python
        source: |
          import requests

          response = requests.post(
              f"{THEHIVE_HOST}/api/v1/connector/alert-feeder/test",
              headers={
                  "Authorization": f"Bearer {API_KEY}",
                  "Content-Type": "application/json",
              },
              json={
                  "name": "airtable-incidents-feeder",
                  "description": "Retrieves security incidents from Airtable every hour and converts them to alerts.",
                  "method": "GET",
                  "url": "https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX",
                  "interval": {
                      "value": 1,
                      "unit": "Minutes"
                  },
                  "body": {
                      "maxRecords": 100
                  },
                  "headers": [
                      {
                          "key": "X-Custom-Header",
                          "value": "custom-value"
                      }
                  ],
                  "enabled": True,
                  "auth": {
                      "username": "alice@example.com",
                      "password": "p@ssw0rd",
                      "type": "basic"
                  },
                  "proxyConfig": {
                      "timeout": {
                          "connection": "2 minutes",
                          "idle": "2 minutes",
                          "request": "2 minutes"
                      },
                      "followRedirects": True,
                      "useProxyProperties": True,
                      "userAgent": "TheHive/5.8",
                      "compressionEnabled": False,
                      "ssl": {
                          "default": False,
                          "protocol": "TLSv1.2",
                          "revocationLists": [
                              "http://crl.example.com/ca.crl"
                          ],
                          "enabledCipherSuites": [
                              "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                              "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
                          ],
                          "enabledProtocols": [
                              "TLSv1.2",
                              "TLSv1.1",
                              "TLSv1"
                          ],
                          "hostnameVerifierClass": "com.typesafe.sslconfig.ssl.NoopHostnameVerifier",
                          "secureRandom": "SHA1PRNG",
                          "trustManager": {
                              "stores": []
                          },
                          "keyManager": {
                              "algorithm": "PKIX",
                              "stores": [
                                  {
                                      "data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t",
                                      "filePath": "/etc/ssl/certs/thehive.jks",
                                      "isFileOnClasspath": False,
                                      "password": "p@ssw0rd",
                                      "type": "JKS"
                                  }
                              ]
                          },
                          "sslParametersConfig": {
                              "clientAuth": "Default",
                              "protocols": [
                                  "TLSv1.2"
                              ]
                          },
                          "debug": {
                              "all": False,
                              "keymanager": False,
                              "ssl": False,
                              "sslctx": False,
                              "trustmanager": False
                          },
                          "loose": {
                              "acceptAnyCertificate": False,
                              "disableHostnameVerification": False,
                              "disableSNI": False
                          }
                      },
                      "maxConnectionsPerHost": -1,
                      "maxConnectionsTotal": -1,
                      "maxConnectionLifetime": "Duration.Inf",
                      "idleConnectionInPoolTimeout": "1 minute",
                      "connectionPoolCleanerPeriod": "1 minute",
                      "maxNumberOfRedirects": 5,
                      "maxRequestRetry": 5,
                      "disableUrlEncoding": False,
                      "keepAlive": True,
                      "useLaxCookieEncoder": False,
                      "useCookieStore": False,
                      "proxy": {
                          "host": "proxy.example.com",
                          "port": 8080,
                          "state": "enabled",
                          "protocol": "http",
                          "principal": "proxy-user",
                          "password": "p@ssw0rd",
                          "ntlmDomain": "CORP",
                          "encoding": "UTF-8",
                          "nonProxyHosts": [
                              "localhost",
                              "*.internal.example.com"
                          ]
                      }
                  },
                  "requestTimeout": {
                      "value": 10,
                      "unit": "Seconds"
                  },
                  "responseMaxSize": 10485760
              },
          )
          response.raise_for_status()
components:
  schemas:
    Access:
      title: Access
      oneOf:
      - $ref: '#/components/schemas/AllExternalAccess'
      - $ref: '#/components/schemas/ExternalAccess'
      - $ref: '#/components/schemas/OrganisationAccess'
      - $ref: '#/components/schemas/UserAccess'
      discriminator:
        propertyName: _kind
        mapping:
          AllExternalAccessKind: '#/components/schemas/AllExternalAccess'
          ExternalAccessKind: '#/components/schemas/ExternalAccess'
          OrganisationAccessKind: '#/components/schemas/OrganisationAccess'
          UserAccessKind: '#/components/schemas/UserAccess'
    ActionScope:
      title: ActionScope
      type: string
      enum:
      - case
      - alert
    AlertField:
      title: AlertField
      type: string
      enum:
      - _id
      - type
      - source
      - sourceRef
      - externalLink
      - title
      - description
      - severity
      - date
      - tags
      - tlp
      - pap
      - status
      - stage
      - assignee
      - summary
      - inProgressDate
      - closedDate
      - importedDate
      - timeToDetect
      - timeToTriage
      - timeToQualify
      - timeToAcknowledge
      - _createdAt
      - _createdBy
      - _updatedAt
      - _updatedBy
    AlertList:
      title: AlertList
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Linked Alerts
          type: string
          maxLength: 512
          minLength: 1
        fields:
          description: Alert fields to display for each item in the list.
          type: array
          items:
            $ref: '#/components/schemas/AlertField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the alert list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the alert list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of alerts to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    AlertTable:
      title: AlertTable
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Linked Alerts
          type: string
          maxLength: 512
          minLength: 1
        columns:
          description: Alert fields to include as columns in the table.
          type: array
          items:
            $ref: '#/components/schemas/AlertField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the alert list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the alert list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of alerts to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    AllExternalAccess:
      title: AllExternalAccess
      type: object
      required:
      - _kind
      properties:
        _kind:
          description: All external users of the organization can access the case
            through [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Internal users can still access the case through the main TheHive interface.
            Platinum or One license required.
          type: string
          const: AllExternalAccessKind
    AnalyzerOutput:
      title: AnalyzerOutput
      type: object
      required:
      - id
      - name
      - version
      - description
      properties:
        id:
          description: ID of the analyzer once enabled within the organization.
          examples:
          - 220483fde9608c580fb6a2508ff3d2d3
          type: string
        name:
          description: Display name of the analyzer.
          examples:
          - VirusTotal_GetReport
          type: string
        version:
          description: Version of the analyzer.
          examples:
          - 3.0
          type: string
        description:
          description: Description of what the analyzer does.
          examples:
          - Search for a specific hash, IP, domain, or URL in the VirusTotal database.
          type: string
        dataTypeList:
          description: Observable data types the analyzer supports.
          examples:
          - - hash
            - domain
            - ip
            - url
          type: array
          items:
            type: string
        cortexIds:
          description: Names of the Cortex servers on which the analyzer is available.
          examples:
          - - Cortex1
          type: array
          items:
            type: string
    AnyIndexType:
      title: AnyIndexType
      description: |-
        Indexing applied to the property:
        - `standard` — supports exact-match filtering, sorting, and aggregation
        - `fulltext` — adds full-text search on top of `standard` capabilities
        - `fulltextOnly` — supports only full-text search, without exact-match filtering, sorting, or aggregation
        - `none` — the property isn't indexed and can't be filtered, sorted, or aggregated
      examples:
      - fulltext
      type: string
      enum:
      - standard
      - none
      - fulltext
      - fulltextOnly
    BasicCreateAuth:
      title: BasicCreateAuth
      type: object
      required:
      - username
      - password
      - type
      properties:
        username:
          description: Username for HTTP Basic authentication.
          examples:
          - alice@example.com
          type: string
          maxLength: 128
          minLength: 1
        password:
          description: Password for HTTP Basic authentication.
          examples:
          - p@ssw0rd
          type: string
          maxLength: 512
          minLength: 1
        type:
          description: Authentication type identifier. Must be `basic`.
          examples:
          - basic
          type: string
          const: basic
    BasicIndexType:
      title: BasicIndexType
      description: |-
        Indexing applied to the property:
        - `standard` — supports exact-match filtering, sorting, and aggregation
        - `none` — the property isn't indexed and can't be filtered, sorted, or aggregated
      examples:
      - standard
      type: string
      enum:
      - standard
      - none
    BasicOutputAuth:
      title: BasicOutputAuth
      type: object
      required:
      - username
      - password
      - type
      properties:
        username:
          description: Username for HTTP Basic authentication.
          examples:
          - alice@example.com
          type: string
          maxLength: 128
          minLength: 1
        password:
          description: Password for HTTP Basic authentication.
          examples:
          - p@ssw0rd
          type: string
          maxLength: 512
          minLength: 1
        type:
          description: Authentication type identifier.
          examples:
          - basic
          type: string
          const: basic
    BasicUpdateAuth:
      title: BasicUpdateAuth
      type: object
      required:
      - username
      - password
      - type
      properties:
        username:
          description: Username for HTTP Basic authentication.
          examples:
          - alice@example.com
          type: string
          maxLength: 128
          minLength: 1
        password:
          description: Password for HTTP Basic authentication.
          examples:
          - p@ssw0rd
          type: string
          maxLength: 512
          minLength: 1
        type:
          description: Authentication type identifier. Must be `basic`.
          examples:
          - basic
          type: string
          const: basic
    BearerCreateAuth:
      title: BearerCreateAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: 'Bearer token included in the `Authorization: Bearer` header.'
          examples:
          - eyJhbGciOiJSUzI1NiJ9...
          type: string
          maxLength: 8192
          minLength: 1
        type:
          description: Authentication type identifier. Must be `bearer`.
          examples:
          - bearer
          type: string
          const: bearer
    BearerOutputAuth:
      title: BearerOutputAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: 'Bearer token included in the `Authorization: Bearer` header.'
          examples:
          - eyJhbGciOiJSUzI1NiJ9...
          type: string
          maxLength: 8192
          minLength: 1
        type:
          description: Authentication type identifier.
          examples:
          - bearer
          type: string
          const: bearer
    BearerUpdateAuth:
      title: BearerUpdateAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: 'Bearer token included in the `Authorization: Bearer` header.'
          examples:
          - eyJhbGciOiJSUzI1NiJ9...
          type: string
          maxLength: 8192
          minLength: 1
        type:
          description: Authentication type identifier. Must be `bearer`.
          examples:
          - bearer
          type: string
          const: bearer
    BooleanPropertyDescription:
      title: BooleanPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - customFields.confirmed-compromise
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - list
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as a boolean.
          examples:
          - boolean
          type: string
          enum:
          - boolean
          const: boolean
    Cardinality:
      title: Cardinality
      description: 'How many values the property can hold: `single` for exactly one
        mandatory value, `option` for zero or one value, `list` for zero or more values
        with duplicates allowed, `set` for zero or more unique values.'
      type: string
      enum:
      - single
      - option
      - list
      - set
    CaseReportTemplateDefinition:
      title: CaseReportTemplateDefinition
      type: object
      required:
      - i18n
      properties:
        widgets:
          description: Ordered list of widgets that define the report body. A widget
            is a self-contained section—for example, an observable table, an alert
            list, or a free-text block.
          type: array
          items:
            $ref: '#/components/schemas/Widget'
        header:
          $ref: '#/components/schemas/HeaderWidget'
        footer:
          $ref: '#/components/schemas/FooterWidget'
        dateFormat:
          description: Date format pattern applied to date fields in the report.
          default: yyyy-MM-dd
          examples:
          - yyyy-MM-dd
          type: string
        dateTimeFormat:
          description: Date and time format pattern applied to datetime fields in
            the report.
          default: yyyy-MM-dd HH:mm
          examples:
          - yyyy-MM-dd HH:mm
          type: string
        i18n:
          $ref: '#/components/schemas/I18n'
    ClientAuthenticationMethod:
      title: ClientAuthenticationMethod
      examples:
      - client_secret_post
      type: string
      enum:
      - client_secret_post
      - client_secret_basic
    ClientProxyWSConfigDto:
      title: ClientProxyWSConfigDto
      type: object
      required:
      - ssl
      - proxy
      properties:
        timeout:
          $ref: '#/components/schemas/Timeout'
        followRedirects:
          description: Whether to follow HTTP redirects automatically.
          default: true
          examples:
          - true
          type: boolean
        useProxyProperties:
          description: Whether to use system proxy properties.
          default: true
          examples:
          - true
          type: boolean
        userAgent:
          description: Custom User-Agent header value to send with requests.
          examples:
          - TheHive/5.8
          type: string
          maxLength: 128
          minLength: 1
        compressionEnabled:
          description: Whether to enable HTTP response compression.
          default: false
          examples:
          - false
          type: boolean
        ssl:
          $ref: '#/components/schemas/SSLConfig'
        maxConnectionsPerHost:
          description: Maximum number of connections per host. Use -1 for no limit.
          default: -1
          examples:
          - -1
          type: integer
          format: int32
        maxConnectionsTotal:
          description: Maximum total number of connections. Use -1 for no limit.
          default: -1
          examples:
          - -1
          type: integer
          format: int32
        maxConnectionLifetime:
          description: Maximum lifetime of a connection in the pool.
          default: Duration.Inf
          type: string
        idleConnectionInPoolTimeout:
          description: How long an idle connection is kept in the pool before being
            discarded.
          default: 1 minute
          type: string
        connectionPoolCleanerPeriod:
          description: How often the connection pool cleaner runs.
          default: 1 minute
          type: string
        maxNumberOfRedirects:
          description: Maximum number of redirects to follow before failing.
          default: 5
          examples:
          - 5
          type: integer
          format: int32
        maxRequestRetry:
          description: Maximum number of times a failed request is retried.
          default: 5
          examples:
          - 5
          type: integer
          format: int32
        disableUrlEncoding:
          description: Whether to skip URL encoding of query parameters.
          default: false
          examples:
          - false
          type: boolean
        keepAlive:
          description: Whether to use HTTP keep-alive connections.
          default: true
          examples:
          - true
          type: boolean
        useLaxCookieEncoder:
          description: Whether to use a lax cookie encoder that accepts non-standard
            cookie syntax.
          default: false
          examples:
          - false
          type: boolean
        useCookieStore:
          description: Whether to use a cookie store to persist cookies across requests.
          default: false
          examples:
          - false
          type: boolean
        proxy:
          $ref: '#/components/schemas/ProxyConfig'
    Comments:
      title: Comments
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Comments
          type: string
          maxLength: 512
          minLength: 1
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the comment list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the comment list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of comments to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    CreateAuth:
      title: CreateAuth
      description: Optional authentication configuration. Supports `none`, `basic`,
        `key`, `bearer`, and `oauth2`.
      oneOf:
      - $ref: '#/components/schemas/BasicCreateAuth'
      - $ref: '#/components/schemas/BearerCreateAuth'
      - $ref: '#/components/schemas/KeyCreateAuth'
      - $ref: '#/components/schemas/NoneCreateAuth'
      - $ref: '#/components/schemas/OAuth2CreateAuth'
      discriminator:
        propertyName: type
        mapping:
          basic: '#/components/schemas/BasicCreateAuth'
          bearer: '#/components/schemas/BearerCreateAuth'
          key: '#/components/schemas/KeyCreateAuth'
          none: '#/components/schemas/NoneCreateAuth'
          oauth2: '#/components/schemas/OAuth2CreateAuth'
    CustomFieldType:
      title: CustomFieldType
      examples:
      - string
      type: string
      enum:
      - string
      - integer
      - float
      - boolean
      - date
      - url
    CustomFields:
      title: CustomFields
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Custom Fields
          type: string
          maxLength: 512
          minLength: 1
        _kind:
          $ref: '#/components/schemas/Kind'
    CustomFieldsList:
      title: CustomFieldsList
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Custom Fields
          type: string
          maxLength: 512
          minLength: 1
        _kind:
          $ref: '#/components/schemas/Kind'
    DashboardStatus:
      title: DashboardStatus
      type: string
      enum:
      - Private
      - Shared
      - Deleted
    DatePropertyDescription:
      title: DatePropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - _createdAt
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - single
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - false
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as a date.
          examples:
          - date
          type: string
          enum:
          - date
          const: date
    Direction:
      title: Direction
      type: string
      enum:
      - asc
      - desc
    EmailIntakeConfigKind:
      title: EmailIntakeConfigKind
      description: 'Connection kind of the provider: `imap` for IMAP-based providers,
        `api` for API-based providers.'
      examples:
      - imap
      type: string
      enum:
      - api
      - imap
    EmailIntakeProviderName:
      title: EmailIntakeProviderName
      type: string
      enum:
      - imap
      - office365
      - google-workspace
      - MSGraph365
    EntityDescription:
      title: EntityDescription
      type: object
      required:
      - label
      - path
      - initialQuery
      - attributes
      properties:
        label:
          description: Name of the entity model.
          examples:
          - case
          type: string
        path:
          description: Reserved for future use. Currently always empty.
          examples:
          - ''
          type: string
        initialQuery:
          description: Name of the primary `list` operation to use with `POST /api/v1/query`
            to list entities of this model. Empty if the model isn't queryable. Names
            only this single `list` operation. It doesn't include the corresponding
            `get` operation, or any related object operations available for the model.
          examples:
          - listCase
          type: string
        attributes:
          description: Properties available on this model, including computed metadata
            fields such as `_createdBy` and `_createdAt`.
          type: array
          items:
            $ref: '#/components/schemas/PropertyDescription'
    EnumerationPropertyDescription:
      title: EnumerationPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - values
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - severity
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - single
        values:
          description: Allowed values for the property, in the format expected by
            `filter` steps.
          examples:
          - - 1
            - 2
            - 3
            - 4
          oneOf:
          - type: array
            items:
              type: integer
              format: int32
          - type: array
            items:
              type: string
        labels:
          description: Human-readable label for each entry in `values`, in the same
            order.
          examples:
          - - low
            - medium
            - high
            - critical
          type: array
          items:
            type: string
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as an enumeration.
          examples:
          - enumeration
          type: string
          enum:
          - enumeration
          const: enumeration
    Error:
      title: Error
      type: object
      required:
      - file
      - error
      - status
      properties:
        file:
          description: Name of the file that caused the error.
          examples:
          - machinetag.json
          type: string
        error:
          description: Description of the error.
          examples:
          - Invalid JSON format
          type: string
        details:
          description: Additional error details.
          type: object
        status:
          description: Import status. Always `Failure` for this variant.
          examples:
          - Failure
          type: string
    ExportFieldDescription:
      title: ExportFieldDescription
      type: object
      required:
      - fieldPath
      - fieldType
      - selectedByDefault
      properties:
        fieldPath:
          description: Path of the field as it should be referenced in the `fields`
            parameter of the Export API endpoint. Nested fields use a dotted notation
            (for example, `attachment.name`)
          type: string
        fieldType:
          description: Logical type of the field. Possible values are `string`, `string[]`,
            `number`, `boolean`, `date`, `user`, `customFields`, `organisationLink[]`,
            and `organisationProfile[]`
          type: string
        selectedByDefault:
          description: Whether the field is part of the default selection when the
            `fields` parameter is omitted in a CSV export
          type: boolean
    ExternalAccess:
      title: ExternalAccess
      type: object
      required:
      - users
      - _kind
      properties:
        users:
          description: Logins of the external users who can access the case. Must
            be a valid email address. Use `POST /api/v1/query` with `listUser` to
            retrieve available users and their email addresses.
          type: array
          items:
            type: string
            maxLength: 128
            pattern: ^(([^()\[\]\\.,;:\s@"]+(\.[^()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9 -퟿豈-﷏ﷰ-￯]+\.)+[a-zA-Z -퟿豈-﷏ﷰ-￯]{2,}))$
        _kind:
          description: Only a specific set of external users can access the case through
            [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Internal users can still access the case through the main TheHive interface.
            Platinum or One license required.
          type: string
          const: ExternalAccessKind
    FieldDirection:
      title: FieldDirection
      type: object
      required:
      - field
      - direction
      properties:
        field:
          type: string
        direction:
          $ref: '#/components/schemas/Direction'
    FieldFromTo:
      title: FieldFromTo
      type: object
      required:
      - _field
      - _from
      - _to
      properties:
        _field:
          description: The path to the field to filter on.
          examples:
          - _createdAt
          type: string
        _from:
          description: Lower bound of the range (inclusive).
          examples:
          - 1716400000000
        _to:
          description: Upper bound of the range (inclusive).
          examples:
          - 1716500000000
    FieldValue:
      title: FieldValue
      type: object
      required:
      - _field
      - _value
      properties:
        _field:
          description: The path to the field to filter on.
          examples:
          - ioc
          type: string
        _value:
          description: The value to compare against. Accepts any JSON value.
          examples:
          - true
    FieldValues:
      title: FieldValues
      type: object
      required:
      - _field
      properties:
        _field:
          description: The path to the field to filter on.
          examples:
          - status
          type: string
        _values:
          description: The list of values to match against.
          type: array
          items: {}
    Filter:
      title: Filter
      examples:
      - _eq:
          _field: ioc
          _value: true
      oneOf:
      - $ref: '#/components/schemas/_and'
      - $ref: '#/components/schemas/_any'
      - $ref: '#/components/schemas/_between'
      - $ref: '#/components/schemas/_contains'
      - $ref: '#/components/schemas/_endsWith'
      - $ref: '#/components/schemas/_eq'
      - $ref: '#/components/schemas/_gt'
      - $ref: '#/components/schemas/_gte'
      - $ref: '#/components/schemas/_id'
      - $ref: '#/components/schemas/_in'
      - $ref: '#/components/schemas/_like'
      - $ref: '#/components/schemas/_lt'
      - $ref: '#/components/schemas/_lte'
      - $ref: '#/components/schemas/_match'
      - $ref: '#/components/schemas/_ne'
      - $ref: '#/components/schemas/_not'
      - $ref: '#/components/schemas/_or'
      - $ref: '#/components/schemas/_startsWith'
    FloatPropertyDescription:
      title: FloatPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - customFields.confidence-level
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - list
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - false
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as a float.
          examples:
          - float
          type: string
          enum:
          - float
          const: float
    FooterWidget:
      title: FooterWidget
      description: Footer template rendered at the bottom of each page of the report.
      type: object
      required:
      - template
      properties:
        template:
          description: Mustache template string rendered as the report footer.
          examples:
          - Confidential — {{case.title}}
          type: string
    GrantType:
      title: GrantType
      type: string
      enum:
      - client_credentials
    Header:
      title: Header
      type: object
      required:
      - key
      - value
      properties:
        key:
          description: HTTP header name.
          examples:
          - X-Custom-Header
          type: string
          minLength: 1
          pattern: ^[ -~]+$
        value:
          description: HTTP header value.
          examples:
          - custom-value
          type: string
          maxLength: 8192
          minLength: 1
    HeaderWidget:
      title: HeaderWidget
      description: Header template rendered at the top of each page of the report.
      type: object
      required:
      - template
      properties:
        template:
          description: Mustache template string rendered as the report header.
          examples:
          - Incident Report — {{case.title}}
          type: string
    I18n:
      title: I18n
      type: object
      properties:
        lang:
          description: BCP 47 language tag used to format dates and labels in the
            report. See the [W3C language tag reference](https://www.w3.org/International/articles/language-tags/)
            for more information.
          default: en
          examples:
          - en
          type: string
    Image:
      title: Image
      type: object
      required:
      - attachmentId
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Company Logo
          type: string
          maxLength: 512
          minLength: 1
        attachmentId:
          description: ID of an attachment to use as the image. Must match an existing
            attachment.
          examples:
          - ~112233
          type: string
        _kind:
          $ref: '#/components/schemas/Kind'
    ImportCaseReportTemplate:
      title: ImportCaseReportTemplate
      type: object
      properties:
        title:
          description: Title of the created template. If absent, the title stored
            in the file is used.
          examples:
          - Ransomware Investigation Report
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: Description of the created template. If absent, the description
            stored in the file is used.
          examples:
          - Standard report layout for ransomware investigations.
          type: string
          maxLength: 1048576
        group:
          description: Group label used to categorize the template.
          default: default
          examples:
          - DFIR
          type: string
          maxLength: 64
          minLength: 1
    Imported:
      title: Imported
      type: object
      required:
      - namespace
      - numberOfTags
      - status
      properties:
        namespace:
          description: Namespace of the successfully imported taxonomy.
          examples:
          - tlp
          type: string
        numberOfTags:
          description: Number of tags imported from this taxonomy.
          examples:
          - 28
          type: integer
          format: int32
        status:
          description: Import status. Always `Success` for this variant.
          examples:
          - Success
          type: string
    Imports:
      title: Imports
      description: Status of built-in reference data imports.
      type: object
      required:
      - mitreCatalog
      properties:
        mitreCatalog:
          description: 'Status of the built-in MITRE ATT&CK catalog import: `Idle`,
            `Loading`, `Failed`, or `Complete`.'
          examples:
          - Complete
          type: string
    InputAction:
      title: InputAction
      type: object
      required:
      - responderId
      - objectType
      - objectId
      properties:
        responderId:
          description: ID of the responder to run. Must match a responder available
            for the target case, observable, task, task log, or alert. Use `GET /api/v1/connector/cortex/responder/{entityType}/{entityId}`
            to list responders available for that entity.
          examples:
          - b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab
          type: string
        cortexId:
          description: Name of the Cortex server to run the responder on, when the
            organization is connected to several servers. Check the `cortexIds` field
            returned by `GET /api/v1/connector/cortex/responder/{entityType}/{entityId}`
            for the servers where `responderId` is available. Omit to let TheHive
            pick the first server that offers the responder.
          examples:
          - Cortex1
          type: string
        objectType:
          description: 'Enum: `case` `case_artifact` `case_task` `case_task_log` `alert`<br>Type
            of entity the responder runs on: `case` for a case, `case_artifact` for
            an observable, `case_task` for a task, `case_task_log` for a task log,
            or `alert` for an alert.'
          examples:
          - case
          type: string
        objectId:
          description: ID of the case, observable, task, task log, or alert identified
            by `objectType`. Accepts the entity's ID preceded by `~`, or another identifier
            accepted by that entity type, such as the case number for cases. Use `POST
            /api/v1/query` with `listCase`, `listObservable`, `listTask`, `listLog`,
            or `listAlert` to retrieve available IDs.
          examples:
          - ~276824
          type: string
        parameters:
          description: Additional parameters passed to the responder. Available keys
            depend on `responderId` and are defined by that responder's own configuration
            on the Cortex server. See [How to Create a Responder](https://docs.strangebee.com/cortex/api/how-to-create-a-responder/#input)
            for the expected format.
          examples:
          - to: sami@example.com
          type: object
        tlp:
          description: 'Enum: `0` `1` `2` `3` `4`<br>Numeric [Traffic Light Protocol
            (TLP)](https://www.misp-project.org/taxonomies.html#_tlp) level of the
            target entity: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).
            Checked against the responder''s maximum TLP: the responder runs only
            if its own maximum TLP is greater than or equal to this value.'
          examples:
          - 2
          type: integer
          format: int32
    InputAddAttachments:
      title: InputAddAttachments
      type: object
      properties:
        attachments:
          type: array
          items:
            type: string
            format: binary
    InputAlertFeeder:
      title: InputAlertFeeder
      type: object
      required:
      - name
      - description
      - method
      - url
      - interval
      - functionName
      properties:
        name:
          description: Unique name for the alert feeder. You can't change this name
            after creation.
          examples:
          - airtable-incidents-feeder
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Description providing additional context about the alert feeder
            configuration.
          examples:
          - Retrieves security incidents from Airtable every hour and converts them
            to alerts.
          type: string
          maxLength: 1048576
        method:
          $ref: '#/components/schemas/Method'
          description: HTTP method to use when requesting data from the external system.
        url:
          description: Endpoint URL of the external system.
          examples:
          - https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX
          type: string
          format: url
        interval:
          $ref: '#/components/schemas/Interval'
          description: Polling interval. The minimum interval is 1 minute.
        functionName:
          description: 'Name of the feeder function that converts the HTTP response
            into alerts. Must reference an existing function of type `feeder:alert`.
            Use `POST /api/v1/query` with `listFunction`, filtered by `type: ["feeder:alert"]`,
            to retrieve available alert-feeder functions, their IDs, and names.'
          examples:
          - airtable-to-alert
          type: string
        body:
          description: Optional HTTP request body to send with the request. Used when
            the HTTP method is `POST`.
          examples:
          - maxRecords: 100
          type: string
        headers:
          description: Optional HTTP headers to include in the request.
          type: array
          items:
            $ref: '#/components/schemas/Header'
        enabled:
          description: Whether the alert feeder is active and runs on schedule.
          default: true
          examples:
          - true
          type: boolean
        auth:
          $ref: '#/components/schemas/CreateAuth'
        proxyConfig:
          $ref: '#/components/schemas/ClientProxyWSConfigDto'
          description: Optional proxy configuration for the HTTP request.
        requestTimeout:
          $ref: '#/components/schemas/Interval'
          description: Maximum time to wait for the external system to respond.
          default:
            value: 10
            unit: Seconds
        responseMaxSize:
          description: Maximum response payload size in bytes that the alert feeder
            accepts from the external system.
          default: 10485760
          examples:
          - 10485760
          type: integer
          format: int64
          exclusiveMinimum: 0
    InputAlertStage:
      title: InputAlertStage
      description: Stage the status belongs to. Immutable after creation.
      examples:
      - Closed
      type: string
      enum:
      - New
      - InProgress
      - Closed
      - Imported
    InputAlertsMergeWithCase:
      title: InputAlertsMergeWithCase
      type: object
      required:
      - caseId
      properties:
        caseId:
          description: The case ID preceded by `~`, or the case number.
          examples:
          - ~216513541
          type: string
        alertIds:
          description: The alert IDs preceded by `~`.
          examples:
          - - ~128458762
            - ~216513542
            - ~354
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
    InputAnalyzerTemplate:
      title: InputAnalyzerTemplate
      type: object
      required:
      - analyzerId
      - content
      properties:
        analyzerId:
          description: Name of the analyzer the template renders reports for. Must
            match the `name` field of an analyzer available from a connected Cortex
            server. Use `GET /api/v1/connector/cortex/analyzer` to list available
            analyzers.
          examples:
          - VirusTotal_GetReport
          type: string
        content:
          description: HTML content that defines how the analyzer's reports are displayed.
          examples:
          - <div class="panel-content">{{summary.taxonomies}}</div>
          type: string
    InputAnalyzerTemplateFiles:
      title: InputAnalyzerTemplateFiles
      type: object
      required:
      - templates
      properties:
        templates:
          description: ZIP archive containing one or more analyzer template files
            to import, such as the official templates archive available at `https://catalogs.download.strangebee.com/latest/zip/report-templates.zip?version=<thehive_version>`.
          type: string
          format: binary
    InputAnalyzerTemplateUpdate:
      title: InputAnalyzerTemplateUpdate
      type: object
      properties:
        content:
          description: New HTML content that defines how the analyzer's reports are
            displayed.
          examples:
          - <div class="panel-content">{{summary.taxonomies}}</div>
          type: string
    InputApplyCaseTemplateWithIds:
      title: InputApplyCaseTemplateWithIds
      type: object
      required:
      - ids
      - caseTemplate
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        caseTemplate:
          description: |-
            Name or ID of the case template to apply. Must match an existing case template.
            Use `POST /api/v1/query` with `listCaseTemplate` to list available case templates.
          examples:
          - Ransomware
          type: string
        updateTitlePrefix:
          description: Applies the title prefix from the case template to each case.
          default: false
          examples:
          - false
          type: boolean
        updateDescription:
          description: Replaces each case's description with the one from the case
            template.
          default: false
          examples:
          - false
          type: boolean
        updateTags:
          description: Applies the tags from the case template to each case.
          default: false
          examples:
          - true
          type: boolean
        updateSeverity:
          description: Applies the severity from the case template to each case.
          default: false
          examples:
          - false
          type: boolean
        updateFlag:
          description: Applies the flag from the case template to each case.
          default: false
          examples:
          - false
          type: boolean
        updateTlp:
          description: Applies the [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level from the case template to each case.
          default: false
          examples:
          - false
          type: boolean
        updatePap:
          description: Applies the [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level from the case template to each case.
          default: false
          examples:
          - false
          type: boolean
        updateCustomFields:
          description: |-
            Applies custom field values from the case template to each case, adding them to any
            existing values without removing what's already set. Custom fields not defined in
            the template remain unchanged.
          default: false
          examples:
          - true
          type: boolean
        importTasks:
          description: |-
            IDs or titles of tasks in the case template to import into each case.
            If empty, no tasks are imported. Must match tasks that exist in the
            specified case template.
            Use `POST /api/v1/query` with `listCaseTemplate` followed by a `tasks`
            operation to retrieve available tasks, their IDs, and titles.
          examples:
          - - ~123456789
            - ~987654321
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        importPages:
          description: |-
            IDs of pages in the case template to import into each case.
            If empty, no pages are imported. Must match page IDs that exist in the
            specified case template.
            Use `POST /api/v1/query` with `listCaseTemplate` followed by a `pageTemplates`
            operation to retrieve available page IDs.
          examples:
          - - ~111111111
          type: array
          items:
            examples:
            - ~354
            type: string
    InputAttachment:
      title: InputAttachment
      description: Existing attachment in TheHive.
      type: object
      required:
      - name
      - contentType
      - id
      properties:
        name:
          description: Filename of the attachment as stored in TheHive.
          examples:
          - malware_sample.exe
          type: string
          maxLength: 128
          minLength: 1
        contentType:
          description: MIME type of the attachment.
          examples:
          - application/octet-stream
          type: string
          maxLength: 128
          minLength: 1
        id:
          description: ID of the attachment in TheHive.
          examples:
          - ~128458762
          type: string
          maxLength: 128
          minLength: 1
        external:
          description: Whether the attachment is accessible to external users with
            [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Platinum or One license required.
          examples:
          - false
          type: boolean
    InputAttachmentsFile:
      title: InputAttachmentsFile
      type: object
      required:
      - attachments
      properties:
        attachments:
          description: Files to attach. Each part is a multipart form file field.
          type: array
          items:
            type: string
            format: binary
        canRename:
          description: When `true`, renames files that already exist with the same
            name.
          examples:
          - false
          type: boolean
    InputBranding:
      title: InputBranding
      type: object
      properties:
        title:
          description: Title shown in the browser tab instead of TheHive.
          examples:
          - TheOrganization
          type: string
          maxLength: 128
          minLength: 1
        loginLogo:
          description: Logo displayed on the login page. Accepts PNG or JPEG files,
            recommended size 200 x 200 pixels.
          type: string
          format: binary
        menuLogo:
          description: Logo displayed in the navigation bar. Accepts PNG or JPEG files,
            recommended size 84 x 84 pixels.
          type: string
          format: binary
        favicon:
          description: Icon displayed in the browser tab. Accepts PNG or JPEG files,
            recommended size 42 x 42 pixels.
          type: string
          format: binary
    InputBulkProcedure:
      title: InputBulkProcedure
      type: object
      properties:
        procedures:
          type: array
          items:
            $ref: '#/components/schemas/InputProcedure'
    InputCaseLink:
      title: InputCaseLink
      type: object
      required:
      - type
      - caseId
      properties:
        type:
          description: |-
            Label categorizing the link relationship.
            Use `GET /api/v1/case/link/types` to list existing types.
            A new type is created automatically if the provided name doesn't exist yet.
          examples:
          - Duplicate
          type: string
          maxLength: 64
          minLength: 1
        caseId:
          description: |-
            ID of the TheHive case to link to.
            Use `POST /api/v1/query` with `listCase` to search for cases and retrieve their IDs.
          examples:
          - ~72637286
          type: string
    InputCaseStage:
      title: InputCaseStage
      description: Stage the status belongs to. Immutable after creation.
      examples:
      - InProgress
      type: string
      enum:
      - New
      - InProgress
      - Closed
    InputCatalogOfPattern:
      title: InputCatalogOfPattern
      type: object
      required:
      - name
      properties:
        name:
          description: Unique name for the catalog.
          examples:
          - Enterprise Attack
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Optional description of the catalog.
          examples:
          - Covers all standard enterprise-level attack techniques from the MITRE
            ATT&CK framework.
          type: string
          maxLength: 1048576
        variant:
          description: Optional variant identifier to distinguish different versions
            of the catalog, such as a date or matrix name.
          examples:
          - '2025-04-15'
          type: string
          maxLength: 128
          minLength: 1
    InputChangeCaseOwnership:
      title: InputChangeCaseOwnership
      type: object
      required:
      - organisation
      properties:
        organisation:
          description: |-
            Name or ID of the organization to set as the new case owner.
            Must match an existing organization.
            Use `POST /api/v1/query` with `listOrganisation` to list available organizations.
          examples:
          - TheOrganization
          type: string
        keepProfile:
          description: |-
            Name or ID of the sharing permission profile to assign to the current owner organization
            so it retains access to the case after ownership transfers. If omitted, the
            current owner loses all access. Must match an existing profile.
            Use `POST /api/v1/query` with `listProfile` to list available profiles.
          examples:
          - analyst
          type: string
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for the new
            owner organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task.'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            the new owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable.'
          examples:
          - manual
          type: string
    InputChangeDashboardOwnership:
      title: InputChangeDashboardOwnership
      type: object
      required:
      - user
      properties:
        user:
          description: |-
            Id or login of the user who should become the new dashboard
            owner. Must match an existing user in your organization. Use
            `POST /api/v1/query` with `listUser` to retrieve available
            users, their IDs, and logins.
          examples:
          - lucas@example.com
          type: string
    InputChangeUserPassword:
      title: InputChangeUserPassword
      type: object
      required:
      - password
      - currentPassword
      properties:
        password:
          description: New password for the user account.
          examples:
          - N3wStr0ngP@ss!
          type: string
          maxLength: 128
          minLength: 1
        currentPassword:
          description: Current password for the user account.
          examples:
          - Str0ngP@ssw0rd!
          type: string
          maxLength: 128
          minLength: 1
    InputComment:
      title: InputComment
      type: object
      required:
      - message
      properties:
        message:
          description: Text of the comment.
          examples:
          - Confirmed as ransomware. Containment measures initiated.
          type: string
          maxLength: 1048576
        external:
          description: Whether the comment is visible to external users through [TheHive
            Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Set to `true` to share the comment with external portal users. Requires
            a Platinum or One license and the case to be shared through TheHive Portal.
            Has no effect on alert comments, which are always internal.
          default: false
          examples:
          - false
          type: boolean
    InputConfig:
      title: InputConfig
      type: object
      required:
      - value
      properties:
        value:
          description: 'New value to store for the configuration item. Accepts any
            JSON value: an object, array, string, number, or boolean.'
          examples:
          - ~7741591688:
              period: Last7Days
              refresh: 30
    InputCreateAlert:
      title: InputCreateAlert
      type: object
      required:
      - type
      - source
      - sourceRef
      - title
      - description
      properties:
        type:
          description: Type of the alert. Identifies the event category and groups
            related alerts.
          examples:
          - Endpoint Detection
          type: string
          maxLength: 32
          minLength: 1
        source:
          description: Source system that generated the alert.
          examples:
          - EDR
          type: string
          maxLength: 32
          minLength: 1
        sourceRef:
          description: Unique reference identifier from the source system. Combined
            with `type` and `source`, uniquely identifies an alert.
          examples:
          - MDATP-2025-004512
          type: string
          maxLength: 128
          minLength: 1
        externalLink:
          description: External URL linking to the alert in the source system.
          examples:
          - https://defender.microsoft.com/alerts/MDATP-2025-004512
          type: string
          maxLength: 4096
          minLength: 1
        title:
          description: Short title describing the alert.
          examples:
          - File encrypted on CORP-LAPTOP-056
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: Full description of the alert. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.
          type: string
          maxLength: 1048576
        severity:
          description: 'Numeric severity level of the alert: 1 (Low), 2 (Medium),
            3 (High), 4 (Critical).'
          default: 2
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        date:
          description: Date and time of the event that triggered the alert, as a Unix
            timestamp in milliseconds. If not provided, the current date is used.
          examples:
          - 1718532000000
          type: integer
          format: int64
        tags:
          description: |-
            Labels to categorize the alert. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks the alert as important for quick filtering.
          default: false
          examples:
          - false
          type: boolean
        tlp:
          description: '[Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level controlling how alert information can be shared: 0 (Clear — no restrictions),
            1 (Green — community), 2 (Amber — organization and clients), 3 (Amber+Strict
            — organization only), 4 (Red — named recipients only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: '[Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level controlling what actions can be taken with alert information: 0
            (Clear — no restrictions), 1 (Green — active actions allowed), 2 (Amber
            — passive checks only), 3 (Red — non-detectable actions only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        customFields:
          description: |-
            Custom field values to set on the alert. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Two formats are accepted:
            - Object format — display order can't be specified: `{"threat-type": "Malware", "severity-level": 3}`
            - Array format — supports display ordering: `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "severity-level", "value": 3, "order": 1}]`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        summary:
          description: Brief summary of the triage findings. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption detected via PowerShell on three workstations.
          type: string
          maxLength: 1048576
        status:
          description: |-
            Name of the alert status to apply. Must match an existing status.
            Use `POST /api/v1/query` with `listAlertStatus` to list available statuses.
          default: New
          examples:
          - New
          type: string
          maxLength: 64
          minLength: 1
        assignee:
          description: Login of the user to assign the alert to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. If omitted, the alert is
            unassigned.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        caseTemplate:
          description: |-
            Name of the case template to apply when creating a case from this alert. Applies the template's tasks, custom fields, and pages. Must match an existing case template.
            Use `POST /api/v1/query` with `listCaseTemplate` to list available case templates.
          examples:
          - Ransomware Investigation
          type: string
          maxLength: 128
          minLength: 1
        observables:
          description: Observables to attach to the alert. Can also be added after
            creation with `POST /api/v1/alert/{alertId}/observable`.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateObservable'
        procedures:
          description: Tactics, techniques, and procedures (TTPs) to link to the alert
            based on the MITRE ATT&CK framework.
          type: array
          items:
            $ref: '#/components/schemas/InputProcedure'
    InputCreateAlertStatus:
      title: InputCreateAlertStatus
      type: object
      required:
      - value
      - stage
      properties:
        value:
          description: Display name of the alert status. Immutable after creation.
          examples:
          - FalsePositive
          type: string
          maxLength: 64
          minLength: 1
        stage:
          $ref: '#/components/schemas/InputAlertStage'
        order:
          description: Position of the status in the UI dropdown list. Lower values
            appear first.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: Human-readable description of the status.
          examples:
          - Alert was analyzed and confirmed as a false positive.
          type: string
          maxLength: 1048576
        colour:
          description: Hex color code used to display the status in the UI.
          examples:
          - '#52c41a'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
        hidden:
          description: When `true`, hides the status from the UI dropdown. Hidden
            statuses remain accessible through the API.
          examples:
          - false
          type: boolean
    InputCreateCase:
      title: InputCreateCase
      type: object
      required:
      - title
      - description
      properties:
        title:
          description: Title of the case.
          examples:
          - Suspicious Ransomware Activity
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: Details of the case. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption via PowerShell script (encrypt.ps1) detected on multiple
            workstations.
          type: string
          maxLength: 1048576
        severity:
          description: 'Numeric severity level of the case: 1 (Low), 2 (Medium), 3
            (High), 4 (Critical).'
          default: 2
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        startDate:
          description: 'Start date of the incident. Expected format: Unix timestamp
            in milliseconds. Defaults to the current date. Used for KPI calculations.'
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: 'End date of the incident. Expected format: Unix timestamp
            in milliseconds. Used for KPI calculations.'
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: |-
            Labels to categorize the case. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks the case as important for quick filtering.
          default: false
          examples:
          - false
          type: boolean
        tlp:
          description: '[Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level controlling how case information can be shared: 0 (Clear — no restrictions),
            1 (Green — community), 2 (Amber — organization and clients), 3 (Amber+Strict
            — organization only), 4 (Red — named recipients only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: '[Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level controlling what actions can be taken with case information: 0 (Clear
            — no restrictions), 1 (Green — active actions allowed), 2 (Amber — passive
            checks only), 3 (Red — non-detectable actions only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        status:
          description: |-
            Name of the case status to apply. Must match an existing status.
            Use `POST /api/v1/query` with `listCaseStatus` to list available statuses.
          default: New
          examples:
          - New
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: Brief summary of the investigation findings. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the case to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. If omitted, the case is
            unassigned.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        access:
          $ref: '#/components/schemas/Access'
        customFields:
          description: |-
            Custom field values to set on the case. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Two formats are accepted:
            - Object format — display order can't be specified: `{"threat-type": "Malware", "severity-level": 3}`
            - Array format — supports display ordering: `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "severity-level", "value": 3, "order": 1}]`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        caseTemplate:
          description: |-
            Name or ID of the case template to use. Applies the template's tasks, custom fields, and pages. Must match an existing case template.
            Use `POST /api/v1/query` with `listCaseTemplate` to list available case templates.
          examples:
          - Ransomware
          type: string
          maxLength: 128
          minLength: 1
        tasks:
          description: Tasks to create in the case. A task represents one or more
            actions, called task logs, that must be completed during the investigation.
            If omitted and a case template is provided, the template's tasks are applied
            instead.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateTask'
        pages:
          description: |-
            Pages to create in the case for structured documentation such as lessons learned, investigation reports, or meeting notes. [Case pages are temporary](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-case-pages/#permanent-vs-temporary-documentation): they're scoped to the active investigation and can't be searched.
            If omitted and a case template is provided, the template's pages are applied instead.
          type: array
          items:
            $ref: '#/components/schemas/InputCreatePage'
        sharingParameters:
          description: Per-organization sharing configuration for this case. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
            for specific linked organizations.
          type: array
          items:
            $ref: '#/components/schemas/InputShare'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for the owner
            organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
    InputCreateCaseFromAlert:
      title: InputCreateCaseFromAlert
      type: object
      properties:
        title:
          description: Title of the case. When omitted, the alert title is used.
          examples:
          - Suspicious Ransomware Activity
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: Details of the case. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            When omitted, the alert description is used.
          examples:
          - File encryption via PowerShell script (encrypt.ps1) detected on multiple
            workstations.
          type: string
          maxLength: 1048576
        severity:
          description: 'Numeric severity level of the case: 1 (Low), 2 (Medium), 3
            (High), 4 (Critical). When omitted, the alert severity is used.'
          default: 2
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        startDate:
          description: Start date of the incident. Unix timestamp in milliseconds.
            When omitted, the alert date is used.
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: End date of the incident. Unix timestamp in milliseconds.
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: |-
            Labels to categorize the case. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
            When omitted, the alert tags are used.
          examples:
          - - file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks the case as important for quick filtering.
          default: false
          examples:
          - false
          type: boolean
        tlp:
          description: '[Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level controlling how case information can be shared: 0 (Clear — no restrictions),
            1 (Green — community), 2 (Amber — organization and clients), 3 (Amber+Strict
            — organization only), 4 (Red — named recipients only). When omitted, the
            alert TLP is used.'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: '[Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level controlling what actions can be taken with case information: 0 (Clear
            — no restrictions), 1 (Green — active actions allowed), 2 (Amber — passive
            checks only), 3 (Red — non-detectable actions only). When omitted, the
            alert PAP is used.'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        status:
          description: |-
            Name of the case status to apply. Must match an existing status.
            Use `POST /api/v1/query` with `listCaseStatus` to list available statuses.
          default: New
          examples:
          - New
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: Brief summary of the investigation findings. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the case to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. If omitted, the case is
            unassigned.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        customFields:
          description: |-
            Custom field values to set on the case. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Two formats are accepted:
            - Object format — display order can't be specified: `{"threat-type": "Malware", "severity-level": 3}`
            - Array format — supports display ordering: `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "severity-level", "value": 3, "order": 1}]`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        caseTemplate:
          description: |-
            Name or ID of the case template to use. Applies the template's tasks, custom fields, and pages.
            Must match an existing case template. Use `POST /api/v1/query` with `listCaseTemplate` to list available case templates.
          examples:
          - Ransomware
          type: string
          maxLength: 128
          minLength: 1
        tasks:
          description: Additional tasks to create in the case, on top of any tasks
            inherited from the alert or a case template.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateTask'
        pages:
          description: Additional pages to create in the case. Pages are collaborative
            notes attached to the case for sharing information within the team during
            an investigation, such as lessons learned or meeting notes.
          type: array
          items:
            $ref: '#/components/schemas/InputCreatePage'
        sharingParameters:
          description: Per-organization sharing configuration for this case. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
            for specific linked organizations.
          type: array
          items:
            $ref: '#/components/schemas/InputShare'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for the owner
            organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
    InputCreateCaseReportTemplate:
      title: InputCreateCaseReportTemplate
      type: object
      required:
      - title
      - definition
      properties:
        title:
          description: Title of the case report template, as displayed when selecting
            reports from case descriptions.
          examples:
          - Ransomware Investigation Report
          type: string
          maxLength: 512
          minLength: 1
        group:
          description: Group label used to categorize the template.
          examples:
          - Incident Response
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: Brief summary of the template's purpose and contents.
          examples:
          - Standard template for ransomware incident investigations.
          type: string
          maxLength: 1048576
        definition:
          $ref: '#/components/schemas/CaseReportTemplateDefinition'
          description: 'Structure defining the template''s layout: widgets, header,
            footer, date formats, and language.'
        version:
          description: Version number of the template.
          examples:
          - 1
          type: integer
          format: int32
    InputCreateCaseStatus:
      title: InputCreateCaseStatus
      type: object
      required:
      - value
      - stage
      properties:
        value:
          description: Display name of the case status. Immutable after creation.
          examples:
          - Contained
          type: string
          maxLength: 64
          minLength: 1
        stage:
          $ref: '#/components/schemas/InputCaseStage'
        order:
          description: Position of the status in the UI dropdown list. Lower values
            appear first.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: Human-readable description of the status.
          examples:
          - Case has been contained but investigation continues.
          type: string
          maxLength: 1048576
        colour:
          description: Hex color code used to display the status in the UI.
          examples:
          - '#ffa940'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
        hidden:
          description: When `true`, hides the status from the UI dropdown. Hidden
            statuses remain accessible through the API.
          examples:
          - false
          type: boolean
        requiresImpact:
          description: When `true`, closing a case with this status requires an `impactStatus`.
            Only a status in the *Closed* stage can require an impact.
          default: false
          examples:
          - false
          type: boolean
    InputCreateCaseTemplate:
      title: InputCreateCaseTemplate
      type: object
      required:
      - name
      properties:
        name:
          description: Name of the case template, must be unique in your organization.
          examples:
          - Ransomware Response
          type: string
          maxLength: 128
          minLength: 1
        displayName:
          description: Name shown to users when selecting this template. Defaults
            to the template name if not specified.
          examples:
          - Ransomware Response
          type: string
          maxLength: 128
          minLength: 1
        titlePrefix:
          description: Prefix automatically added to case titles when the template
            is applied. Add a hyphen after the prefix to separate it from the case
            title.
          examples:
          - RAN-
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: Default description for cases. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - |-
            ## Summary

            Ransomware infection detected. Containment and eradication required.
          type: string
          maxLength: 1048576
        severity:
          description: 'Default severity level for cases: 1 (Low), 2 (Medium), 3 (High),
            4 (Critical).'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        tags:
          description: |-
            Default tags for cases. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing free-form tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - ransomware
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks cases as important by default.
          examples:
          - false
          type: boolean
        tlp:
          description: 'Default [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level for cases controlling how case information can be shared: 0 (Clear
            — no restrictions), 1 (Green — community), 2 (Amber — organization and
            clients), 3 (Amber+Strict — organization only), 4 (Red — named recipients
            only).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'Default [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level for cases controlling what actions can be taken with case information:
            0 (Clear — no restrictions), 1 (Green — active actions allowed), 2 (Amber
            — passive checks only), 3 (Red — non-detectable actions only).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        summary:
          description: Default summary for cases. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - Ransomware case opened following detection of file encryption activity.
          type: string
          maxLength: 1048576
        tasks:
          description: Task templates to include in this case template. A task represents
            one or more actions, called task logs, that must be completed during the
            investigation. These tasks are automatically created on cases when the
            template is applied.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateTask'
        pageTemplateIds:
          description: Use `pageTemplates` instead.
          deprecated: true
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        customFields:
          description: |-
            Default custom field values for cases. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Two formats are accepted:
            - Object format — display order can't be specified: `{"threat-type": "Malware", "severity-level": 3}`
            - Array format — supports display ordering: `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "severity-level", "value": 3, "order": 1}]`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        pageTemplates:
          description: Pages enable the creation and sharing of valuable information
            within a team on a case. Pages to include in this case template are automatically
            created on cases when the template is applied. Preferred over the deprecated
            `pageTemplateIds` field.
          type: array
          items:
            $ref: '#/components/schemas/InputCreatePage'
    InputCreateDashboard:
      title: InputCreateDashboard
      type: object
      required:
      - title
      - description
      - status
      - definition
      properties:
        title:
          description: Title of the dashboard.
          examples:
          - Cases overview
          type: string
          maxLength: 512
          minLength: 1
        group:
          description: Group used to categorize the dashboard on the dashboards list.
          default: default
          examples:
          - Security operations
          type: string
          maxLength: 32
          minLength: 1
        description:
          description: Description of the dashboard.
          examples:
          - Overview of open cases across the organization, grouped by severity and
            status.
          type: string
          maxLength: 1048576
        status:
          $ref: '#/components/schemas/DashboardStatus'
          description: |-
            Visibility of the dashboard: `Private` restricts access to
            you, `Shared` makes it visible to your entire organization.
            `Deleted` has no effect on creation and behaves like
            `Private`.
        definition:
          description: |-
            Widget layout and configuration for the dashboard, structured
            as rows of widgets. Each widget defines a chart type, the
            entity it queries, and its display options. This structure
            isn't formally documented: the simplest way to build a valid
            value is to create a dashboard from TheHive web interface,
            then retrieve it with `GET /api/v1/dashboard/{dashboardId}`
            and use its `definition` value as a starting point.
          examples:
          - period: last3Months
            items:
            - type: container
              items:
              - id: wdgt-1a2b3c
                type: counter
                options:
                  title: Open cases
                  entity: case
                  periodDateField: _createdAt
                  filters: []
                  series:
                  - agg: count
                    type: bar
                    query: {}
                    label: Open cases
          type: object
        version:
          description: |-
            Version of the dashboard definition format. The current
            format is `1`. Older values indicate a legacy definition
            that must be converted before use.
          default: 1
          examples:
          - 1
          type: integer
          format: int32
    InputCreateListView:
      title: InputCreateListView
      type: object
      required:
      - name
      - entity
      - filter
      - listOptions
      - isShared
      properties:
        name:
          description: Name of the view.
          examples:
          - High severity cases
          type: string
        entity:
          $ref: '#/components/schemas/InputListViewEntity'
        filter:
          description: |-
            Filter applied to the list. Uses the same
            operators as the [`filter` step of the Query API](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export).
          examples:
          - _and:
            - _eq:
                _field: status
                _value: InProgress
          type: object
        listOptions:
          $ref: '#/components/schemas/ListOptions'
          description: Display options saved for the view.
        sortList:
          description: |-
            Sort order saved for the view. Each entry is a
            field name prefixed with `+` for ascending order
            or `-` for descending order.
          examples:
          - - -_createdAt
          type: array
          maxItems: 15
          items:
            type: string
        showColumns:
          description: |-
            Optional columns displayed in the list, on top of
            the fixed set of columns shown for
            that entity type. The available optional columns
            vary by entity: check the corresponding list in TheHive web interface.
          examples:
          - - tlp
            - tags
          type: array
          maxItems: 15
          uniqueItems: true
          items:
            type: string
        isShared:
          description: |
            Whether the view is shared with your entire
            organization. When false, the view is private and
            visible only to you.

            Every member of the organization can use, modify,
            and delete a shared view.
          examples:
          - false
          type: boolean
    InputCreateLog:
      title: InputCreateLog
      type: object
      required:
      - message
      properties:
        message:
          description: Content of the task log. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Don't include observables—links within task logs are clickable, which
            can be a security risk. Add them to the case instead.
          examples:
          - Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence
            of code injection into explorer.exe.
          type: string
          maxLength: 1048576
        startDate:
          description: 'Date and time of the log entry. Expected format: Unix timestamp
            in milliseconds. Defaults to the current date and time when omitted.'
          examples:
          - 1742048580000
          type: integer
          format: int64
        includeInTimeline:
          description: 'When set, pins the log entry to the case timeline at this
            date. Expected format: Unix timestamp in milliseconds.'
          examples:
          - 1742046000000
          type: integer
          format: int64
        attachments:
          description: Attachments to include with the log entry. Ignored when using
            JSON content type. Use multipart/form-data to upload files.
          type: array
          items:
            type: string
            format: binary
    InputCreateObservable:
      title: InputCreateObservable
      type: object
      required:
      - dataType
      properties:
        dataType:
          description: |-
            The observable type. Must match an existing observable type defined in TheHive.
            When set, this field takes priority over the `dataType` query parameter.
            Use `POST /api/v1/query` with `listObservableType` to list available types.
          examples:
          - ip
          type: string
          maxLength: 64
          minLength: 1
        data:
          description: Observable value or values. For non-attachment types, provide
            a string or an array of strings. Omit or set to `null` for attachment
            types. Each value is limited to 4096 characters.
          examples:
          - 00.01.002.003
          oneOf:
          - type: array
            items:
              type: string
              maxLength: 4096
              minLength: 1
          - type: string
        message:
          description: Note or additional context about the observable. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - Source IP of the ransomware C2 server detected on CORP-LAPTOP-056
          type: string
          maxLength: 1048576
        startDate:
          description: Deprecated. Maps to the `_createdAt` field. Don't use this
            field.
          examples:
          - 1640000000000
          type: integer
          format: int64
        attachment:
          description: |-
            Attachment for file-type observables. Required when the observable type has `isAttachment` set to `true`.

            Four formats are accepted:
            - String — name of a multipart part containing the file to upload: `"malware_sample"`
            - String array — names of multiple multipart parts: `["malware_sample", "config_file"]`
            - Object — reference to an existing attachment stored in TheHive: `{"name": "malware_sample.exe", "contentType": "application/octet-stream", "id": "~128458762"}`
            - Object array — references to multiple existing attachments: `[{"name": "malware_sample.exe", "contentType": "application/octet-stream", "id": "~128458762"}]`
          oneOf:
          - $ref: '#/components/schemas/InputAttachment'
          - description: Existing attachments in TheHive.
            type: array
            items:
              description: Existing attachment in TheHive.
              type: object
              required:
              - name
              - contentType
              - id
              properties:
                name:
                  description: Filename of the attachment as stored in TheHive.
                  examples:
                  - malware_sample.exe
                  type: string
                  maxLength: 128
                  minLength: 1
                contentType:
                  description: MIME type of the attachment.
                  examples:
                  - application/octet-stream
                  type: string
                  maxLength: 128
                  minLength: 1
                id:
                  description: ID of the attachment in TheHive.
                  examples:
                  - ~128458762
                  type: string
                  maxLength: 128
                  minLength: 1
                external:
                  description: Whether the attachment is accessible to external users
                    with [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
                    Platinum or One license required.
                  examples:
                  - false
                  type: boolean
          - description: Names of multipart parts, each containing a file to attach.
            type: array
            items:
              description: Name of a multipart part containing the file to attach.
              type: string
          - description: Name of a multipart part containing the file to attach.
            type: string
        tlp:
          description: '[Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level controlling how the observable''s information can be shared: 0 (Clear
            — no restrictions), 1 (Green — community), 2 (Amber — organization and
            clients), 3 (Amber+Strict — organization only), 4 (Red — named recipients
            only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: '[Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level controlling what actions can be taken with the observable data:
            0 (Clear — no restrictions), 1 (Green — active actions allowed), 2 (Amber
            — passive checks only), 3 (Red — non-detectable actions only).'
          default: 2
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        tags:
          description: |-
            Labels to categorize the observable. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - encrypted
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        ioc:
          description: Marks the observable as an indicator of compromise (IOC), indicating
            it's linked to suspicious or malicious activity.
          default: false
          examples:
          - true
          type: boolean
        sighted:
          description: Marks the observable as sighted, meaning it has been detected
            or observed in the environment.
          default: false
          examples:
          - false
          type: boolean
        sightedAt:
          description: 'Date and time when the observable was sighted. Expected format:
            Unix timestamp in milliseconds.'
          examples:
          - 1748736000000
          type: integer
          format: int64
        ignoreSimilarity:
          description: When `true`, excludes the observable from similarity checks
            used to identify related alerts and cases. Useful for contextual observables
            such as the company domain name that aren't indicators of a threat.
          default: false
          examples:
          - false
          type: boolean
        isZip:
          description: When `true`, TheHive unpacks the zip archive using `zipPassword`
            (if provided) and creates one observable per file it contains.
          default: false
          examples:
          - false
          type: boolean
        zipPassword:
          description: Password to decrypt the zip archive when `isZip` is `true`.
          examples:
          - infected
          type: string
          maxLength: 512
          minLength: 1
    InputCreateOrganisation:
      title: InputCreateOrganisation
      type: object
      required:
      - name
      - description
      properties:
        name:
          description: Name of the organization.
          examples:
          - TheOrganization
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: Short description of the organization.
          examples:
          - The primary investigation organization.
          type: string
          maxLength: 1048576
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Default task-sharing rule applied
            to new case shares with this organization: `autoShare` shares new tasks
            with every sharing organization automatically, `manual` requires explicit
            sharing per task. See [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Default observable-sharing rule
            applied to new case shares with this organization: `autoShare` shares
            new observables with every sharing organization automatically, `manual`
            requires explicit sharing per observable. See [organization-level sharing
            rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - manual
          type: string
        locked:
          description: Whether to lock the organization immediately after creation.
            Locked organizations can't be accessed by their members.
          examples:
          - false
          type: boolean
    InputCreatePage:
      title: InputCreatePage
      type: object
      required:
      - title
      - content
      - category
      properties:
        title:
          description: Title of the page.
          examples:
          - Investigation Notes
          type: string
          maxLength: 512
          minLength: 1
        content:
          description: Content of the page. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - |-
            ## Summary

            File encryption via PowerShell script detected on multiple workstations.
          type: string
          maxLength: 1048576
        order:
          description: Display order of the page within its category.
          examples:
          - 0
          type: integer
          format: int32
        category:
          description: |-
            Category the page belongs to. Unknown categories are automatically created.
            Use `POST /api/v1/query` with `listPage` to retrieve existing categories.
          examples:
          - Investigation
          type: string
          maxLength: 128
          minLength: 1
    InputCreateProfile:
      title: InputCreateProfile
      type: object
      required:
      - name
      properties:
        type:
          $ref: '#/components/schemas/ProfileType'
          description: |-
            Profile type:
            - `Organisation`: for users in non-admin organizations.
            - `Admin`: for users in the Admin organization.
            - `External`: for [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/) users. Requires a Platinum or One license.

            If omitted, TheHive infers the type from the provided permissions.
        name:
          description: Name of the profile.
          examples:
          - SOC-Tier1-Analyst
          type: string
          maxLength: 64
          minLength: 1
        permissions:
          description: |-
            Permissions to assign to the profile.
            Use `GET /api/v1/permission` to list all available permissions.
          examples:
          - - manageCase/create
            - manageCase/update
            - manageObservable
            - manageTask
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 64
            minLength: 1
    InputCreateShare:
      title: InputCreateShare
      type: object
      properties:
        organisations:
          description: |-
            Names or IDs of the organizations to share with. Each must match an existing linked organization.
            Use `GET /api/v1/organisation/{orgId}/links` to list linked organizations.
          examples:
          - - TheOrganization1
            - TheOrganization2
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
    InputCreateShares:
      title: InputCreateShares
      type: object
      properties:
        shares:
          description: List of sharing configurations, each specifying an organization,
            permission profile, and sharing rules for tasks and observables.
          type: array
          items:
            $ref: '#/components/schemas/InputShare'
    InputCreateTask:
      title: InputCreateTask
      type: object
      required:
      - title
      properties:
        title:
          description: Title of the task.
          examples:
          - Isolate affected workstation from the network
          type: string
          maxLength: 128
          minLength: 1
        group:
          description: Group name used to organize tasks within the case.
          examples:
          - Containment
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: Details of the task. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - Disconnect CORP-LAPTOP-056 from the network immediately.
          type: string
          maxLength: 1048576
        status:
          description: 'Enum: `Waiting` `InProgress` `Completed` `Cancel`<br>Initial
            status of the task.'
          examples:
          - Waiting
          type: string
        flag:
          description: Marks the task as important for quick filtering.
          examples:
          - false
          type: boolean
        startDate:
          description: Date and time when the task started. Unix timestamp in milliseconds.
          examples:
          - 1748476800000
          type: integer
          format: int64
        endDate:
          description: Date and time when the task ended. Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        order:
          description: Display order of the task within its group.
          examples:
          - 1
          type: integer
          format: int32
        dueDate:
          description: Due date for the task. Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        assignee:
          description: Email address of the user assigned to the task. Use `POST /api/v1/query`
            with `listUser` to retrieve available users and their logins.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        mandatory:
          description: Whether the task must be completed before the case can be closed.
          examples:
          - false
          type: boolean
    InputCreateUser:
      title: InputCreateUser
      type: object
      required:
      - login
      - name
      - profile
      properties:
        login:
          description: Login name for the user account, used to sign in. Must be a
            valid email address.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          pattern: ^(([^()\[\]\\.,;:\s@"]+(\.[^()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9 -퟿豈-﷏ﷰ-￯]+\.)+[a-zA-Z -퟿豈-﷏ﷰ-￯]{2,}))$
        name:
          description: Display name for the user account.
          examples:
          - Sami Analyst
          type: string
          maxLength: 128
          minLength: 1
        email:
          description: Email address for sending notifications.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          pattern: ^(([^()\[\]\\.,;:\s@"]+(\.[^()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9 -퟿豈-﷏ﷰ-￯]+\.)+[a-zA-Z -퟿豈-﷏ﷰ-￯]{2,}))$
        password:
          description: Initial password for the user account.
          examples:
          - Str0ngP@ssw0rd!
          type: string
          maxLength: 128
          minLength: 1
        profile:
          description: Permission profile for the user in the organization. Must match
            an existing profile. Use `GET /api/v1/profile` to list available profiles.
          examples:
          - analyst
          type: string
          maxLength: 64
          minLength: 1
        organisation:
          description: Organization the user belongs to. Must match an existing organization.
            Use `POST /api/v1/query` with `listOrganisation` to retrieve available
            organizations.
          examples:
          - TheOrganization
          type: string
          maxLength: 128
          minLength: 1
        type:
          $ref: '#/components/schemas/UserType'
          description: Type of user account. Normal accounts can use the web interface
            and the API. Service accounts authenticate exclusively with an API key
            and can't sign in to the web interface. External accounts access TheHive
            through the Portal (requires a Platinum or One license).
    InputCustomEvent:
      title: InputCustomEvent
      type: object
      required:
      - date
      - title
      properties:
        date:
          description: 'Start date of the custom event. Expected format: Unix timestamp
            in milliseconds.'
          examples:
          - 1737020400000
          type: integer
          format: int64
        endDate:
          description: 'End date of the custom event. Expected format: Unix timestamp
            in milliseconds.'
          examples:
          - 1737025800000
          type: integer
          format: int64
        title:
          description: Title of the custom event, visible on the timeline.
          examples:
          - Ransom demand received via email
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Brief description of the custom event. Visible when users select
            **Preview** in the timeline.
          examples:
          - Attacker sent a ransom demand to the security team requesting payment
            in exchange for the decryption key.
          type: string
          maxLength: 1048576
    InputCustomField:
      title: InputCustomField
      type: object
      required:
      - name
      - group
      - description
      - type
      properties:
        name:
          description: Technical name of the custom field.
          examples:
          - threat-type
          type: string
          maxLength: 64
          minLength: 1
        displayName:
          description: User-facing name of the custom field displayed in cases and
            alerts.
          examples:
          - Threat Type
          type: string
          maxLength: 64
          minLength: 1
        group:
          description: Group that organizes related custom fields, shown as a tab
            in cases and alerts.
          examples:
          - Classification
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: Description shown to users when hovering over the custom field
            in a case or alert.
          examples:
          - Type of threat detected in the case.
          type: string
          maxLength: 1048576
        type:
          $ref: '#/components/schemas/CustomFieldType'
          description: Type of data the custom field contains.
        mandatory:
          description: 'Marks the field as mandatory: users must fill it in before
            a case or alert can be closed.'
          examples:
          - true
          type: boolean
        options:
          description: Predefined selectable values for the custom field. Available
            for `string`, `integer`, and `float` types. If set, users can only select
            from these values.
          examples:
          - - Malware
            - Intrusion
            - Data Leak
          type: array
          items: {}
    InputCustomFieldValue:
      title: InputCustomFieldValue
      type: object
      required:
      - name
      - value
      properties:
        name:
          description: |-
            Name of the custom field. Must match an existing custom field.
            Use `GET /api/v1/customField` to list available custom fields.
          examples:
          - threat-type
          type: string
          maxLength: 64
          minLength: 1
        value:
          description: 'Value of the custom field. The type depends on the custom
            field definition: a string, integer, boolean, date value, float, or url.'
          examples:
          - Malware
        order:
          description: Display order of the custom field value within the case.
          examples:
          - 0
          type: integer
          format: int32
    InputEmailBasicAuthConfig:
      title: InputEmailBasicAuthConfig
      description: HTTP Basic authentication credentials. Use for IMAP server providers
        with password-based authentication.
      type: object
      required:
      - password
      properties:
        password:
          description: Password for the mailbox account.
          examples:
          - P@ssw0rd!
          type: string
    InputEmailIntake:
      title: InputEmailIntake
      type: object
      required:
      - interval
      properties:
        enabled:
          description: Enables or deactivates the email intake module globally. When
            turned off, no emails are fetched from any connected mailbox.
          default: true
          examples:
          - true
          type: boolean
        interval:
          description: Time interval between automatic email fetch cycles for all
            connected mailboxes. Use the format `<amount> <unit>`.
          examples:
          - 5 minutes
          type: string
    InputEmailIntakeAlertProperties:
      title: InputEmailIntakeAlertProperties
      description: Custom alert metadata applied to alerts created from emails in
        this mailbox. When omitted, TheHive uses `email-intake` as the type, derives
        the source from the connector name, and sets standard tags.
      examples:
      - type: email-intake
        source: '{name}'
        tags:
        - email-intake
        - source:{name}
        - '{mailbox.provider.name}'
      type: object
      required:
      - source
      properties:
        type:
          description: Type of the alerts created through the email intake connector.
          default: email-intake
          examples:
          - email-intake
          type: string
        source:
          description: Source of the alerts created through the email intake connector.
            Defaults to the slugified connector name.
          examples:
          - soc-mailbox
          type: string
        tags:
          description: Tags applied to alerts created through the email intake connector.
          examples:
          - - email-intake
            - source:soc-mailbox
            - office365
          type: array
          items:
            type: string
    InputEmailIntakeApiMailbox:
      title: InputEmailIntakeApiMailbox
      type: object
      required:
      - provider
      - credential
      properties:
        provider:
          $ref: '#/components/schemas/InputEmailIntakeApiProvider'
        credential:
          $ref: '#/components/schemas/InputEmailIntakeCredential'
        inbox:
          description: Folder from which emails are fetched. Use `POST /api/v1/connector/email-intake/folders`
            to list available folders.
          default: Inbox
          examples:
          - Inbox
          type: string
        archive:
          description: Folder where processed emails are moved after fetching. Use
            `POST /api/v1/connector/email-intake/folders` to list available folders.
            When omitted, emails aren't moved.
          examples:
          - Archive
          type: string
        markAsRead:
          description: Marks processed emails as read in the mailbox after fetching.
          default: false
          examples:
          - false
          type: boolean
        _kind:
          description: Discriminator identifying this as an API-based mailbox configuration.
            Must be `api`.
          examples:
          - api
          type: string
          enum:
          - api
          const: api
    InputEmailIntakeApiProvider:
      title: InputEmailIntakeApiProvider
      description: 'API provider settings: the provider name used to identify the
        service.'
      type: object
      required:
      - name
      properties:
        name:
          $ref: '#/components/schemas/EmailIntakeProviderName'
          description: Email provider name. Use `GET /api/v1/connector/email-intake/providers`
            to list available providers.
          examples:
          - MSGraph365
    InputEmailIntakeConfig:
      title: InputEmailIntakeConfig
      type: object
      required:
      - name
      - mailbox
      properties:
        id:
          description: Pre-registered configuration ID for Google Workspace OAuth
            2.0 configurations. Obtain this by calling `POST /api/v1/connector/email-intake/config/authorizationCode`
            before saving the configuration. Omit for all other provider types.
          examples:
          - ~84123
          type: string
        name:
          description: Display name for the mailbox configuration.
          examples:
          - SOC Mailbox - Office 365
          type: string
        mailbox:
          $ref: '#/components/schemas/InputEmailIntakeMailboxConfig'
        organisations:
          description: Organizations where incoming emails from this mailbox create
            alerts. Must match existing organizations. Use `GET /api/v1/organisation`
            to list available organizations.
          examples:
          - - TheOrganization
          type: array
          items:
            type: string
        enabled:
          description: Enables or deactivates this specific mailbox configuration.
            When turned off, emails aren't fetched from this mailbox.
          default: true
          examples:
          - true
          type: boolean
        createdAt:
          description: Creation date of the configuration, as a Unix timestamp in
            milliseconds. Set automatically when the configuration is saved.
          examples:
          - 1703174400000
          type: integer
          format: int64
        alertProperties:
          $ref: '#/components/schemas/InputEmailIntakeAlertProperties'
    InputEmailIntakeCredential:
      title: InputEmailIntakeCredential
      description: Credentials for the mailbox account.
      type: object
      required:
      - email
      properties:
        email:
          description: Email address or username for the mailbox account.
          examples:
          - emma@example.com
          type: string
        basicAuth:
          $ref: '#/components/schemas/InputEmailBasicAuthConfig'
        oAuth2:
          $ref: '#/components/schemas/InputEmailIntakeOAuth2'
    InputEmailIntakeImapMailbox:
      title: InputEmailIntakeImapMailbox
      type: object
      required:
      - provider
      - credential
      properties:
        provider:
          $ref: '#/components/schemas/InputEmailIntakeProvider'
        credential:
          $ref: '#/components/schemas/InputEmailIntakeCredential'
        inbox:
          description: Folder from which emails are fetched. Use `POST /api/v1/connector/email-intake/folders`
            to list available folders.
          default: Inbox
          examples:
          - Inbox
          type: string
        archive:
          description: Folder where processed emails are moved after fetching. Use
            `POST /api/v1/connector/email-intake/folders` to list available folders.
            When omitted, emails aren't moved.
          examples:
          - Archive
          type: string
        markAsRead:
          description: Marks processed emails as read in the mailbox after fetching.
          default: false
          examples:
          - false
          type: boolean
        _kind:
          description: Discriminator identifying this as an IMAP mailbox configuration.
            Must be `imap`.
          examples:
          - imap
          type: string
          enum:
          - imap
          const: imap
    InputEmailIntakeMailboxConfig:
      title: InputEmailIntakeMailboxConfig
      description: Mailbox connection settings, including the provider, credentials,
        and folder configuration.
      oneOf:
      - $ref: '#/components/schemas/InputEmailIntakeApiMailbox'
      - $ref: '#/components/schemas/InputEmailIntakeImapMailbox'
      discriminator:
        propertyName: _kind
        mapping:
          api: '#/components/schemas/InputEmailIntakeApiMailbox'
          imap: '#/components/schemas/InputEmailIntakeImapMailbox'
    InputEmailIntakeOAuth2:
      title: InputEmailIntakeOAuth2
      description: OAuth 2.0 credentials. Required for Google Workspace, Microsoft
        365, and Microsoft Graph API providers. Requires a Platinum or One license.
      type: object
      required:
      - clientId
      - secret
      properties:
        clientId:
          description: OAuth 2.0 client ID from the identity provider.
          examples:
          - a1b2c3d4-e5f6-7890-abcd-ef1234567890
          type: string
        tenantId:
          description: Tenant ID from Microsoft Entra ID. Required for Microsoft 365
            and Microsoft Graph API providers.
          examples:
          - f8a9b0c1-d2e3-4f56-7890-abcdef123456
          type: string
        secret:
          description: OAuth 2.0 client secret from the identity provider.
          examples:
          - ~Q8Mxx-client-secret-placeholder
          type: string
        authority:
          description: OAuth 2.0 authority URL. Defaults to the Microsoft identity
            platform endpoint when using Microsoft providers.
          examples:
          - https://login.microsoftonline.com/
          type: string
        scopes:
          description: OAuth 2.0 permission scopes required by the application.
          examples:
          - - https://mail.google.com/
          type: array
          uniqueItems: true
          items:
            type: string
        redirectUri:
          description: Redirect URI registered in the OAuth 2.0 application. Required
            for authorization code flows such as Google Workspace.
          examples:
          - https://thehive.example.com
          type: string
        authorizationCode:
          description: Authorization code from the OAuth 2.0 consent flow. Used only
            for Google Workspace configurations. Obtain this by calling `POST /api/v1/connector/email-intake/config/authorizationCode`.
          examples:
          - 4/0AfJohXm-authorization-code-placeholder
          type: string
    InputEmailIntakeProvider:
      title: InputEmailIntakeProvider
      description: 'IMAP provider settings: the server address and connection options.'
      type: object
      required:
      - name
      properties:
        name:
          $ref: '#/components/schemas/EmailIntakeProviderName'
          description: Email provider type. Use `GET /api/v1/connector/email-intake/providers`
            to list available providers.
          examples:
          - imap
        host:
          description: Hostname of the IMAP server. Required when using a custom IMAP
            provider.
          examples:
          - outlook.office365.com
          type: string
        protocol:
          description: IMAP protocol variant to use.
          default: imap
          examples:
          - imap
          type: string
        port:
          description: Port number for the IMAP server.
          default: 993
          examples:
          - 993
          type: integer
          format: int32
        ssl:
          description: Enables SSL for the IMAP connection.
          default: true
          examples:
          - true
          type: boolean
        startTLS:
          description: Enables STARTTLS for the IMAP connection.
          default: false
          examples:
          - false
          type: boolean
        checkServerIdentity:
          description: Turns off host name verification against the SSL certificate
            when set to `false`. Don't deactivate this in production environments.
          default: true
          examples:
          - true
          type: boolean
        certificates:
          description: PEM certificate authority certificates to trust for the IMAP
            server SSL connection. Required when the server uses a certificate from
            an internal CA or a self-signed certificate.
          type: array
          items:
            $ref: '#/components/schemas/InputEmailIntakeSSLCert'
    InputEmailIntakeSSLCert:
      title: InputEmailIntakeSSLCert
      type: object
      required:
      - data
      properties:
        data:
          description: PEM-encoded certificate data.
          examples:
          - |-
            -----BEGIN CERTIFICATE-----
            ...
            -----END CERTIFICATE-----
          type: string
        type:
          description: Certificate type identifier.
          examples:
          - PEM
          type: string
    InputEntry:
      title: InputEntry
      type: object
      required:
      - value
      properties:
        value:
          description: Identifier string for this entry, used as the tag value.
          examples:
          - strict
          type: string
          maxLength: 512
          minLength: 1
        expanded:
          description: Full display label for this entry, shown instead of the identifier
            where supported.
          examples:
          - Recipients may share information only within their organization.
          type: string
          maxLength: 1048576
        colour:
          description: Hex color code for the entry tag's visual appearance. Must
            be a six-digit hex color preceded by `#`.
          examples:
          - '#ffa800'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
        description:
          description: Description of what this entry represents.
          examples:
          - Disclosure is restricted to participants' organizations only.
          type: string
          maxLength: 1048576
        numerical_value:
          description: Numerical score associated with this entry, used for sorting
            or weighting.
          examples:
          - 50
          type: integer
          format: int32
    InputExternalLink:
      title: InputExternalLink
      type: object
      required:
      - type
      - url
      properties:
        type:
          description: |-
            Label categorizing the link relationship.
            Use `GET /api/v1/case/link/types` to list existing types.
            A new type is created automatically if the provided name doesn't exist yet.
          examples:
          - MITRE ATT&CK
          type: string
          maxLength: 64
          minLength: 1
        url:
          description: URL of the external resource to link to.
          examples:
          - https://attack.mitre.org/techniques/T1486/
          type: string
          format: url
    InputFunction:
      title: InputFunction
      type: object
      required:
      - name
      - definition
      properties:
        name:
          description: Name of the function. Must be unique within the organization.
          examples:
          - airtable-to-alert
          type: string
          maxLength: 128
          minLength: 1
        mode:
          $ref: '#/components/schemas/InputFunctionMode'
        definition:
          description: JavaScript source code. Must define a `handle(input, context)`
            function as the entry point.
          examples:
          - function handle(input, context) { return []; }
          type: string
          maxLength: 1048576
        description:
          description: Description of the function.
          examples:
          - Fetches records from Airtable and creates alerts in TheHive.
          type: string
          maxLength: 1048576
        config:
          description: Configuration object passed to the function at runtime. Accessible
            via the context object.
          examples:
          - apiKey: <api_key>
          type: object
        types:
          description: '[Function types](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/#function-types).
            Determines how and when the function can be invoked.'
          examples:
          - - api
          type: array
          items:
            $ref: '#/components/schemas/InputFunctionType'
    InputFunctionMode:
      title: InputFunctionMode
      description: '[Execution mode](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/#function-modes)
        of the function. In `DryRun` mode, the function executes without persisting
        any changes.'
      type: string
      enum:
      - Enabled
      - Disabled
      - DryRun
    InputFunctionType:
      title: InputFunctionType
      type: string
      enum:
      - api
      - notification
      - action:case
      - action:alert
      - feeder:alert
    InputGenerateCaseReport:
      title: InputGenerateCaseReport
      type: object
      required:
      - caseReportTemplateId
      - format
      properties:
        caseReportTemplateId:
          description: Must match an existing case report template. Use `POST /api/v1/query`
            with `listCaseReportTemplate` to retrieve available templates and their
            IDs.
          examples:
          - ~84512
          type: string
        format:
          description: Output format for the generated report.
          examples:
          - html
          type: string
          enum:
          - html
          - markdown
          - word
    InputImportCase:
      title: InputImportCase
      type: object
      required:
      - password
      properties:
        password:
          description: Archive password that was set when the case was exported.
          examples:
          - Arch1ve-P@ss2025
          type: string
          maxLength: 512
          minLength: 1
        sharingParameters:
          description: Per-organization sharing configuration for the imported case.
            Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
            for specific linked organizations.
          type: array
          items:
            $ref: '#/components/schemas/InputShare'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for the owner
            organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
    InputImportCase1:
      title: InputImportCase
      type: object
      properties:
        caseTemplate:
          description: |-
            Name of the case template to apply to the created case. Must match an existing case template.
            Use `POST /api/v1/query` with `listCaseTemplate` to list available case templates.
          examples:
          - MISP Import
          type: string
        assignee:
          description: Login of the user to assign as owner of the case. Typically
            an email address. If a default domain is configured in the [authentication
            settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted.
          examples:
          - lucas@example.com
          type: string
        tasks:
          description: Tasks to create in the case. A task represents one or more
            actions, called task logs, that must be completed during the investigation.
            If omitted and a case template is provided, the template's tasks are applied
            instead.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateTask'
        pages:
          description: |-
            Pages to create in the case for structured documentation such as lessons learned, investigation reports, or meeting notes. [Case pages are temporary](https://docs.strangebee.com/thehive/user-guides/knowledge-base/about-case-pages/#permanent-vs-temporary-documentation): they're scoped to the active investigation and can't be searched.
            If omitted and a case template is provided, the template's pages are applied instead.
          type: array
          items:
            $ref: '#/components/schemas/InputCreatePage'
        customFields:
          description: |-
            Custom field values to set on the case. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Two formats are accepted:
            - Object format — display order can't be specified: `{"threat-type": "Malware", "severity-level": 3}`
            - Array format — supports display ordering: `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "severity-level", "value": 3, "order": 1}]`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        sharingParameters:
          description: Per-organization sharing configuration for this case. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/)
            for specific linked organizations.
          type: array
          items:
            $ref: '#/components/schemas/InputShare'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for the owner
            organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
    InputJob:
      title: InputJob
      type: object
      required:
      - analyzerId
      - cortexId
      - artifactId
      properties:
        analyzerId:
          description: ID of the analyzer to run. Use `GET /api/v1/connector/cortex/analyzer`
            to list available analyzers.
          examples:
          - 220483fde9608c580fb6a2508ff3d2d3
          type: string
        cortexId:
          description: Name of the Cortex server to run the analyzer on. Check the
            `cortexIds` field returned by `GET /api/v1/connector/cortex/analyzer`
            for the servers where `analyzerId` is available.
          examples:
          - Cortex1
          type: string
        artifactId:
          description: ID of the observable to analyze. Must match an existing observable.
            Use `POST /api/v1/query` with `listObservable` to retrieve available observables
            and their IDs.
          examples:
          - ~344112
          type: string
        parameters:
          description: Additional parameters passed to the analyzer. Available keys
            depend on `analyzerId` and are defined by that analyzer's own configuration
            on the Cortex server. See [the Cortex API guide](https://docs.strangebee.com/cortex/api/api-guide/#run)
            for the expected format.
          examples:
          - comment: Investigating phishing campaign
          type: object
    InputLicense:
      title: InputLicense
      type: object
      required:
      - license
      properties:
        license:
          description: Raw license key string provided by StrangeBee.
          examples:
          - eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.abc123
          type: string
    InputLinkPageTemplatesToCaseTemplate:
      title: InputLinkPageTemplatesToCaseTemplate
      type: object
      properties:
        pageTemplateIds:
          description: IDs of the page templates to link to the case template. Must
            match existing page templates. Use `POST /api/v1/query` with `listPageTemplate`
            to retrieve available page templates and their IDs. Pass an empty array
            to remove all links.
          examples:
          - - ~84123
            - ~84456
          type: array
          items:
            examples:
            - ~354
            type: string
    InputListViewEntity:
      title: InputListViewEntity
      description: |-
        Type of list the view applies to. Determines
        which list the view's filters, sort order,
        displayed columns, and display options apply
        to.
      examples:
      - Case
      type: string
      enum:
      - Alert
      - AlertObservable
      - AlertTTP
      - AlertHistory
      - AlertSimilarCases
      - AlertSimilarAlerts
      - Case
      - CaseTask
      - CaseObservable
      - CaseTTP
      - CaseHistory
      - CaseSimilarCases
      - CaseSimilarAlerts
      - CaseSimilarLinkedAlerts
      - Dashboard
      - Organisation
      - OrganisationUsers
      - OrganisationTemplateCase
      - OrganisationTemplateReport
      - OrganisationTemplatePages
      - OrganisationCustomTags
      - OrganisationFunctions
      - User
      - Profiles
      - CustomFields
      - ObservableTypes
      - Taxonomies
      - Task
      - AttackPatterns
    InputLogLevel:
      title: InputLogLevel
      type: string
      enum:
      - ALL
      - TRACE
      - DEBUG
      - INFO
      - WARN
      - ERROR
      - 'OFF'
    InputManageCaseAccess:
      title: InputManageCaseAccess
      type: object
      required:
      - access
      properties:
        access:
          $ref: '#/components/schemas/Access'
    InputManageCaseAccessWithIds:
      title: InputManageCaseAccessWithIds
      type: object
      required:
      - ids
      - access
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        access:
          $ref: '#/components/schemas/Access'
    InputObservableType:
      title: InputObservableType
      type: object
      required:
      - name
      properties:
        name:
          description: Name of the observable type. Once created, this becomes a valid
            value for the `dataType` field when creating or updating observables.
          examples:
          - ja4-fingerprint
          type: string
          maxLength: 64
          minLength: 1
        isAttachment:
          description: When `true`, observables of this type require a file upload
            instead of a text value.
          examples:
          - false
          type: boolean
        isCaseSensitive:
          description: |-
            When `false`, new observables of this type are automatically normalized to lowercase upon
            creation to ensure that values are treated as identical regardless of letter casing.
            Existing observables aren't affected.
          examples:
          - false
          type: boolean
    InputOrganisationBulkLink:
      title: InputOrganisationBulkLink
      type: object
      properties:
        links:
          description: Complete set of sharing links to apply to the organization.
            Replaces all existing links for the organization.
          type: array
          items:
            $ref: '#/components/schemas/OrganisationLink'
    InputOrganisationLink:
      title: InputOrganisationLink
      type: object
      properties:
        linkType:
          description: Sharing profile applied when the current organization shares
            a case with the other organization. Use `GET /api/v1/sharingProfile` to
            retrieve available profiles.
          default: default
          examples:
          - default
          type: string
          maxLength: 64
          minLength: 1
        otherLinkType:
          description: Sharing profile applied when the other organization shares
            a case with the current organization. Use `GET /api/v1/sharingProfile`
            to retrieve available profiles.
          default: default
          examples:
          - default
          type: string
          maxLength: 64
          minLength: 1
    InputPatternImportMitre:
      title: InputPatternImportMitre
      type: object
      required:
      - catalog
      properties:
        url:
          description: URL of the MITRE ATT&CK JSON file to import. Use this or `file`,
            not both.
          examples:
          - https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json
          type: string
          maxLength: 512
          minLength: 1
        catalog:
          description: Name or ID of the catalog to import techniques into. If no
            catalog with that name exists, TheHive creates it automatically. Use `POST
            /api/v1/query` with `listCatalog` to retrieve available catalogs, their
            IDs, and names.
          examples:
          - Enterprise Attack
          type: string
          maxLength: 128
          minLength: 1
        variant:
          description: Variant identifier set on the catalog after import. Defaults
            to today's date in YYYY-MM-DD format if not provided.
          examples:
          - '2025-06-26'
          type: string
          maxLength: 128
          minLength: 1
    InputPredicate:
      title: InputPredicate
      description: A predicate is a tag label within the taxonomy namespace, forming
        a tag of the form `namespace:predicate`.
      type: object
      required:
      - value
      properties:
        value:
          description: Identifier string for this predicate, used in the tag label.
          examples:
          - white
          type: string
          maxLength: 512
          minLength: 1
        expanded:
          description: Full display label for this predicate, shown instead of the
            identifier where supported.
          examples:
          - TLP:WHITE
          type: string
          maxLength: 1048576
        exclusive:
          description: Whether only one entry from this predicate can be selected
            at a time.
          type: boolean
        description:
          description: Description of what this predicate represents.
          examples:
          - Disclosure is not limited.
          type: string
          maxLength: 1048576
        colour:
          description: Hex color code for the predicate tag's visual appearance. Must
            be a six-digit hex color preceded by `#`.
          examples:
          - '#ffffff'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
    InputProcedure:
      title: InputProcedure
      type: object
      required:
      - patternId
      - occurDate
      properties:
        patternId:
          description: |-
            Technique ID from a loaded catalog, for example a MITRE ATT&CK technique ID.
            Must match an existing technique. Use `POST /api/v1/query` with `listPattern`
            to retrieve available techniques and their IDs.
          examples:
          - T1486
          type: string
          maxLength: 128
          minLength: 1
        occurDate:
          description: 'Date and time when the technique occurred during the incident.
            Expected format: Unix timestamp in milliseconds.'
          examples:
          - 1748739600000
          type: integer
          format: int64
        tactic:
          description: |-
            Short name of the tactic the technique belongs to. Required when the technique belongs to more than one tactic.
            Use `POST /api/v1/query` with `listPattern` to check which tactics a technique belongs to.
          examples:
          - impact
          type: string
          maxLength: 32
          minLength: 1
        description:
          description: Description of how the technique was carried out in this incident,
            referred to as the procedure. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - PowerShell script used to encrypt files across multiple workstations.
          type: string
          maxLength: 1048576
    InputQuery:
      title: InputQuery
      type: object
      properties:
        query:
          type: array
          items:
            $ref: '#/components/schemas/InputQueryNamedOperation'
        excludeFields:
          type: array
          items:
            type: string
    InputQueryFilterOperation:
      title: InputQueryFilterOperation
      type: object
      required:
      - _name
      properties:
        _eq:
          $ref: '#/components/schemas/JsObject'
        _name:
          type: string
          const: filter
    InputQueryGenericOperation:
      title: InputQueryGenericOperation
      type: object
      required:
      - _name
      properties:
        _name:
          type: string
          const: <operation_name>
    InputQueryNamedOperation:
      title: InputQueryNamedOperation
      oneOf:
      - $ref: '#/components/schemas/InputQueryFilterOperation'
      - $ref: '#/components/schemas/InputQueryGenericOperation'
      - $ref: '#/components/schemas/InputQueryPagingOperation'
      - $ref: '#/components/schemas/InputQuerySortOperation'
      discriminator:
        propertyName: _name
        mapping:
          <operation_name>: '#/components/schemas/InputQueryGenericOperation'
          filter: '#/components/schemas/InputQueryFilterOperation'
          page: '#/components/schemas/InputQueryPagingOperation'
          sort: '#/components/schemas/InputQuerySortOperation'
    InputQueryPagingOperation:
      title: InputQueryPagingOperation
      type: object
      required:
      - from
      - to
      - _name
      properties:
        from:
          type: integer
          format: int32
        to:
          type: integer
          format: int32
        extraData:
          type: array
          items:
            type: string
        _name:
          type: string
          const: page
    InputQuerySortOperation:
      title: InputQuerySortOperation
      type: object
      required:
      - _name
      properties:
        _fields:
          type: array
          items:
            $ref: '#/components/schemas/JsObject'
        _name:
          type: string
          const: sort
    InputRemoveShares:
      title: InputRemoveShares
      type: object
      properties:
        organisations:
          description: |-
            Names or IDs of the organizations to remove from sharing.
            Use `GET /api/v1/case/{caseId}/shares` to list current shares and identify organizations.
          examples:
          - - TheOrganization1
            - TheOrganization2
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
    InputRenderCaseReport:
      title: InputRenderCaseReport
      type: object
      required:
      - format
      properties:
        format:
          description: Output format for the rendered report.
          examples:
          - html
          type: string
          enum:
          - html
          - markdown
          - word
        definition:
          $ref: '#/components/schemas/CaseReportTemplateDefinition'
          description: Inline template definition used when rendering without a saved
            case report template. A definition is an ordered list of widgets—building
            blocks that each render one section of the report, such as a `Text` widget
            for free-form Mustache content or an `ObservableList` widget for the case
            observables. Either `definition` or `caseReportTemplateId` is required.
        caseReportTemplateId:
          description: ID of the saved case report template to use. Must match an
            existing template. Use `POST /api/v1/query` with `listCaseReportTemplate`
            to retrieve available templates and their IDs. Either `caseReportTemplateId`
            or `definition` is required.
          examples:
          - ~84512
          type: string
        caseId:
          description: ID of the case to use for data. Use `POST /api/v1/query` with
            `listCase` to retrieve available cases and their IDs. If omitted, TheHive
            uses fake data to fill the template.
          examples:
          - ~59643
          type: string
        maxElements:
          description: Maximum number of elements displayed per widget in the preview.
            Doesn't affect the number of elements included when saving or downloading
            the report.
          examples:
          - 5
          type: integer
          format: int32
          exclusiveMinimum: 0
    InputSetUserOrganisations:
      title: InputSetUserOrganisations
      type: object
      properties:
        organisations:
          description: Complete list of organizations the user account belongs to.
            Replaces all existing memberships for the user account.
          type: array
          items:
            $ref: '#/components/schemas/InputUserOrganisation'
    InputSetUserPassword:
      title: InputSetUserPassword
      type: object
      required:
      - password
      properties:
        password:
          description: New password for the user account.
          examples:
          - Str0ngP@ssw0rd!
          type: string
          maxLength: 128
          minLength: 1
    InputShare:
      title: InputShare
      type: object
      required:
      - organisation
      properties:
        organisation:
          description: |-
            Name or ID of the organization to share the case with. Must match an existing linked organization.
            Use `GET /api/v1/organisation/{orgId}/links` to list the organizations linked to your organization.
          examples:
          - TheOrganization
          type: string
        share:
          description: Controls whether the organization has active sharing access
            to the case.
          default: true
          examples:
          - true
          type: boolean
        profile:
          description: |-
            Profile that defines the permissions of the organization members on this case. Must match an existing profile.
            Use `POST /api/v1/query` with `listProfile` to retrieve available permission profiles. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).
          default: analyst
          examples:
          - analyst
          type: string
          maxLength: 64
          minLength: 1
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>Task-sharing rule for this organization:
            `autoShare` shares new tasks automatically, `manual` requires explicit
            sharing per task. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - autoShare
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>Observable-sharing rule for
            this organization: `autoShare` shares new observables automatically, `manual`
            requires explicit sharing per observable. Overrides the [organization-level
            sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - autoShare
          type: string
    InputTOTPCode:
      title: InputTOTPCode
      type: object
      required:
      - code
      - secret
      properties:
        code:
          description: Current 6-digit code generated by your authenticator app from
            `secret`.
          examples:
          - 123456
          type: integer
          format: int32
        secret:
          description: Secret returned by `GET /api/v1/auth/totp/get`.
          examples:
          - JBSWY3DPEHPK3PXP
          type: string
    InputTaxonomy:
      title: InputTaxonomy
      type: object
      required:
      - namespace
      - description
      - version
      properties:
        namespace:
          description: Namespace of the taxonomy. Must be unique in TheHive.
          examples:
          - tlp
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Description of what this taxonomy covers.
          examples:
          - Traffic Light Protocol for information sharing
          type: string
          maxLength: 1048576
        version:
          description: Version number of the taxonomy.
          examples:
          - 6
          type: integer
          format: int32
        exclusive:
          description: Whether only one predicate can be applied at a time. When `true`,
            applying a second predicate from this taxonomy removes the first.
          type: boolean
        predicates:
          description: Predicates to define in this taxonomy. A predicate is a tag
            label within the namespace.
          type: array
          items:
            $ref: '#/components/schemas/InputPredicate'
        values:
          description: Value sets for predicates that have a third-level entry. A
            value groups entries under a predicate, forming tags of the form `namespace:predicate:entry`.
            Omit if none of the predicates have entries.
          type: array
          items:
            $ref: '#/components/schemas/InputValue'
    InputTaxonomyFile:
      title: InputTaxonomyFile
      type: object
      required:
      - file
      properties:
        file:
          description: ZIP archive containing at least one `machinetag.json` file
            following the MISP taxonomy JSON schema.
          type: string
          format: binary
    InputTestAlertFeeder:
      title: InputTestAlertFeeder
      type: object
      required:
      - name
      - description
      - method
      - url
      - interval
      properties:
        name:
          description: Unique name for the alert feeder.
          examples:
          - airtable-incidents-feeder
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Description providing additional context about the alert feeder
            configuration.
          examples:
          - Retrieves security incidents from Airtable every hour and converts them
            to alerts.
          type: string
          maxLength: 1048576
        method:
          $ref: '#/components/schemas/Method'
          description: HTTP method to use when requesting data from the external system.
        url:
          description: Endpoint URL of the external system.
          examples:
          - https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX
          type: string
          format: url
        interval:
          $ref: '#/components/schemas/Interval'
          description: Polling interval. The minimum interval is 1 minute.
        body:
          description: Optional HTTP request body to send with the request. Used when
            the HTTP method is `POST`.
          examples:
          - maxRecords: 100
          type: string
        headers:
          description: Optional HTTP headers to include in the request.
          type: array
          items:
            $ref: '#/components/schemas/Header'
        enabled:
          description: Whether the alert feeder is active and runs on schedule.
          default: true
          examples:
          - true
          type: boolean
        auth:
          $ref: '#/components/schemas/UpdateAuth'
          description: Optional authentication configuration. Supports `none`, `basic`,
            `bearer`, `key`, and `oauth2`. Omitting this field or setting it to `none`
            means no authentication.
        proxyConfig:
          $ref: '#/components/schemas/ClientProxyWSConfigDto'
          description: Optional proxy configuration for the HTTP request.
        requestTimeout:
          $ref: '#/components/schemas/Interval'
          description: Maximum time to wait for the external system to respond.
          default:
            value: 10
            unit: Seconds
        responseMaxSize:
          description: Maximum response payload size in bytes that the alert feeder
            accepts from the external system.
          default: 10485760
          examples:
          - 10485760
          type: integer
          format: int64
          exclusiveMinimum: 0
    InputTestFunction:
      title: InputTestFunction
      type: object
      required:
      - definition
      properties:
        name:
          description: Optional name for the function, used for identification purposes
            only.
          examples:
          - airtable-to-alert
          type: string
          maxLength: 128
          minLength: 1
        definition:
          description: JavaScript source code to test. Must define a `handle(input,
            context)` function as the entry point.
          examples:
          - function handle(input, context) { return "Hello world"; }
          type: string
          maxLength: 1048576
        config:
          description: Configuration object passed to the function at runtime.
          examples:
          - threshold: 10
          type: object
        input:
          description: Input data passed to the `handle` function as the first argument.
          examples:
          - source: test-source
            title: Test input
    InputUpdateAlert:
      title: InputUpdateAlert
      type: object
      properties:
        type:
          description: Type of the alert. Identifies the event category and groups
            related alerts.
          examples:
          - Endpoint Detection
          type: string
          maxLength: 32
          minLength: 1
        source:
          description: Source system that generated the alert.
          examples:
          - EDR
          type: string
          maxLength: 32
          minLength: 1
        sourceRef:
          description: Unique reference identifier from the source system. Combined
            with `type` and `source`, uniquely identifies an alert.
          examples:
          - MDATP-2025-004512
          type: string
          maxLength: 128
          minLength: 1
        externalLink:
          description: External URL linking to the alert in the source system. Send
            `null` to unset.
          examples:
          - https://defender.microsoft.com/alerts/MDATP-2025-004512
          type: string
          maxLength: 4096
          minLength: 1
        title:
          description: New title of the alert.
          examples:
          - File encrypted on CORP-LAPTOP-056
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: New description of the alert. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.
          type: string
          maxLength: 1048576
        severity:
          description: 'New severity level of the alert: 1 (Low), 2 (Medium), 3 (High),
            4 (Critical).'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        date:
          description: New date and time of the event that triggered the alert, as
            a Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        lastSyncDate:
          description: Date and time of the last synchronization with the source system,
            as a Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        follow:
          description: Whether to follow the alert for change notifications.
          examples:
          - true
          type: boolean
        customFields:
          description: |2-

            Custom field values to update on the alert. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Several formats are accepted, with different behaviors:

            Replacements

            - To replace all values of a custom field with a single value — Object format.
            Overwrites the current values of each listed custom field. Fields not listed are left untouched.
            `{"threat-type": "Malware", "detection-source": "EDR"}`
            - To replace all values of a custom field with one or more values — Array format.
            Overwrites the current values of each listed custom field. Fields not listed are deleted.
            `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "threat-type", "value": "Ransomware", "order": 1}, {"name": "detection-source", "value": "EDR", "order": 2}]`
            - To replace one specific value inside a custom field with one or more values — Object format with a field:value key.
            Only the targeted value changes. Every other value in that custom field is kept, and fields not listed are left untouched.
            `{"threat-type:Malware":"Ransomware"}` or `{"threat-type:Malware":["Ransomware", "Spyware"]}`

            Additions

            To add one or more values to a custom field without touching its existing values — Object format with an empty target.
            The trailing colon means that no value is targeted, so the new value is appended.

            `{"threat-type:": "Malware"}` or `{"threat-type:": ["Malware", "Ransomware"]}`

            Deletions

            To delete one specific value from a custom field — Object format with an empty replacement.
            Only the targeted value is removed. Every other value in that field is kept.

            `{"threat-type:Malware": ""}`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        status:
          description: |-
            New alert status. Must match an existing status. To close an alert, set this
            to a status linked to the *Closed* stage.
            Use `POST /api/v1/query` with `listAlertStatus` to list available statuses.
          examples:
          - InProgress
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: New summary of the triage findings. Send `null` to unset.
          examples:
          - File encryption detected via PowerShell on three workstations.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the alert to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        addTags:
          description: |-
            Tags to add to the current set of alert tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of alert tags. Tags not present on the alert are silently ignored.
            Use `GET /api/v1/alert/{alertId}` and read the `tags` field to see the current tags on the alert.
          examples:
          - - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
    InputUpdateAlertFeeder:
      title: InputUpdateAlertFeeder
      type: object
      required:
      - description
      - method
      - url
      - interval
      properties:
        description:
          description: New description of the alert feeder.
          examples:
          - Retrieves security incidents from Airtable every hour and converts them
            to alerts.
          type: string
          maxLength: 1048576
        method:
          $ref: '#/components/schemas/Method'
          description: New HTTP method to use when requesting data from the external
            system.
        url:
          description: New endpoint URL of the external system.
          examples:
          - https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX
          type: string
          format: url
        interval:
          $ref: '#/components/schemas/Interval'
          description: New polling interval. The minimum interval is 1 minute.
        body:
          description: New HTTP request body to send with the request. Used when the
            HTTP method is `POST`.
          examples:
          - maxRecords: 100
          type: string
        headers:
          description: New HTTP headers to include in the request. Replaces the current
            set.
          type: array
          items:
            $ref: '#/components/schemas/Header'
        enabled:
          description: Whether the alert feeder is active and runs on schedule.
          default: true
          examples:
          - true
          type: boolean
        auth:
          $ref: '#/components/schemas/UpdateAuth'
          description: New authentication configuration. Supports `none`, `basic`,
            `key`, `bearer`, and `oauth2`.
        proxyConfig:
          $ref: '#/components/schemas/ClientProxyWSConfigDto'
          description: New proxy configuration for the HTTP request.
        requestTimeout:
          $ref: '#/components/schemas/Interval'
          description: New maximum time to wait for the external system to respond.
          default:
            value: 10
            unit: Seconds
        responseMaxSize:
          description: New maximum response payload size in bytes that the alert feeder
            accepts from the external system.
          default: 10485760
          examples:
          - 10485760
          type: integer
          format: int64
          exclusiveMinimum: 0
    InputUpdateAlertStatus:
      title: InputUpdateAlertStatus
      type: object
      properties:
        order:
          description: New position in the UI dropdown list. Set to `null` to remove
            the custom ordering.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: New description. Set to `null` to remove the existing description.
          examples:
          - Alert was analyzed and confirmed as a false positive.
          type: string
          maxLength: 1048576
        colour:
          description: New hex color code. Set to `null` to remove the custom color.
          examples:
          - '#52c41a'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
        hidden:
          description: When `true`, hides the status from the UI dropdown. Hidden
            statuses remain accessible through the API.
          examples:
          - false
          type: boolean
    InputUpdateAlertWithIds:
      title: InputUpdateAlertWithIds
      type: object
      required:
      - ids
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        type:
          description: Type of the alert. Identifies the event category and groups
            related alerts.
          examples:
          - Endpoint Detection
          type: string
          maxLength: 32
          minLength: 1
        source:
          description: Source system that generated the alert.
          examples:
          - EDR
          type: string
          maxLength: 32
          minLength: 1
        sourceRef:
          description: Unique reference identifier from the source system. Combined
            with `type` and `source`, uniquely identifies an alert.
          examples:
          - MDATP-2025-004512
          type: string
          maxLength: 128
          minLength: 1
        externalLink:
          description: External URL linking to the alert in the source system. Send
            `null` to unset.
          examples:
          - https://defender.microsoft.com/alerts/MDATP-2025-004512
          type: string
          maxLength: 4096
          minLength: 1
        title:
          description: New title of the alert.
          examples:
          - File encrypted on CORP-LAPTOP-056
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: New description of the alert. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.
          type: string
          maxLength: 1048576
        severity:
          description: 'New severity level of the alert: 1 (Low), 2 (Medium), 3 (High),
            4 (Critical).'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        date:
          description: New date and time of the event that triggered the alert, as
            a Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        lastSyncDate:
          description: Date and time of the last synchronization with the source system,
            as a Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        follow:
          description: Whether to follow the alert for change notifications.
          examples:
          - true
          type: boolean
        customFields:
          description: |2-

            Custom field values to update on the alert. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Several formats are accepted, with different behaviors:

            Replacements

            - To replace all values of a custom field with a single value — Object format.
            Overwrites the current values of each listed custom field. Fields not listed are left untouched.
            `{"threat-type": "Malware", "detection-source": "EDR"}`
            - To replace all values of a custom field with one or more values — Array format.
            Overwrites the current values of each listed custom field. Fields not listed are deleted.
            `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "threat-type", "value": "Ransomware", "order": 1}, {"name": "detection-source", "value": "EDR", "order": 2}]`
            - To replace one specific value inside a custom field with one or more values — Object format with a field:value key.
            Only the targeted value changes. Every other value in that custom field is kept, and fields not listed are left untouched.
            `{"threat-type:Malware":"Ransomware"}` or `{"threat-type:Malware":["Ransomware", "Spyware"]}`

            Additions

            To add one or more values to a custom field without touching its existing values — Object format with an empty target.
            The trailing colon means that no value is targeted, so the new value is appended.

            `{"threat-type:": "Malware"}` or `{"threat-type:": ["Malware", "Ransomware"]}`

            Deletions

            To delete one specific value from a custom field — Object format with an empty replacement.
            Only the targeted value is removed. Every other value in that field is kept.

            `{"threat-type:Malware": ""}`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        status:
          description: |-
            New alert status. Must match an existing status. To close an alert, set this
            to a status linked to the *Closed* stage.
            Use `POST /api/v1/query` with `listAlertStatus` to list available statuses.
          examples:
          - InProgress
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: New summary of the triage findings. Send `null` to unset.
          examples:
          - File encryption detected via PowerShell on three workstations.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the alert to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - lucas@example.com
          type: string
          maxLength: 128
          minLength: 1
        addTags:
          description: |-
            Tags to add to the current set of alert tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of alert tags. Tags not present on the alert are silently ignored.
            Use `GET /api/v1/alert/{alertId}` and read the `tags` field to see the current tags on the alert.
          examples:
          - - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
    InputUpdateAttachment:
      title: InputUpdateAttachment
      type: object
      properties:
        external:
          description: Whether the attachment is accessible to external users with
            [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Requires a Platinum or One license. If absent, the current value is unchanged.
          examples:
          - true
          type: boolean
    InputUpdateCase:
      title: InputUpdateCase
      type: object
      properties:
        title:
          description: New title of the case.
          examples:
          - Suspicious Ransomware Activity — CORP-LAPTOP-056
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: New details of the case. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption via PowerShell script (encrypt.ps1) detected on multiple
            workstations.
          type: string
          maxLength: 1048576
        severity:
          description: 'New severity level of the case: 1 (Low), 2 (Medium), 3 (High),
            4 (Critical).'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        startDate:
          description: 'New start date of the incident. Expected format: Unix timestamp
            in milliseconds.'
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: 'New end date of the incident. Expected format: Unix timestamp
            in milliseconds. Send `null` to unset.'
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks the case as important for quick filtering.
          examples:
          - false
          type: boolean
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        status:
          description: |-
            New case status. Must match an existing status. To close a case, set this
            to a status linked to the *Closed* stage.
            Use `POST /api/v1/query` with `listCaseStatus` to list available statuses.
          examples:
          - InProgress
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: New investigation summary. Send `null` to unset.
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the case to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          minLength: 1
        impactStatus:
          description: 'Enum: `NoImpact` `WithImpact` `NotApplicable`<br>Verdict on
            whether the incident had real consequences for the organization. Required
            when you close a case with a status whose `requiresImpact` field is `true`.
            TheHive rejects the update if you send it while closing a case with a
            status that doesn''t require an impact. Use `POST /api/v1/query` with
            `listCaseStatus` to check which statuses require an impact. `WithImpact`
            means the incident caused damage or data loss. `NoImpact` means it was
            resolved without consequences. `NotApplicable` means the concept doesn''t
            apply to this case. Send `null` to unset.'
          examples:
          - NotApplicable
          type: string
        customFields:
          description: |-
            Custom field values to update on the case. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Several formats are accepted, with different behaviors:

            Replacements

            - To replace all values of a custom field with a single value — Object format.
            Overwrites the current values of each listed custom field. Fields not listed are left untouched.
            `{"threat-type": "Malware", "detection-source": "EDR"}`
            - To replace all values of a custom field with one or more values — Array format.
            Overwrites the current values of each listed custom field. Fields not listed are deleted.
            `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "threat-type", "value": "Ransomware", "order": 1}, {"name": "detection-source", "value": "EDR", "order": 2}]`
            - To replace one specific value inside a custom field with one or more values — Object format with a field:value key.
            Only the targeted value changes. Every other value in that custom field is kept, and fields not listed are left untouched.
            `{"threat-type:Malware":"Ransomware"}` or `{"threat-type:Malware":["Ransomware", "Spyware"]}`

            Additions

            To add one or more values to a custom field without touching its existing values — Object format with an empty target.
            The trailing colon means that no value is targeted, so the new value is appended.

            `{"threat-type:": "Malware"}` or `{"threat-type:": ["Malware", "Ransomware"]}`

            Deletions

            To delete one specific value from a custom field — Object format with an empty replacement.
            Only the targeted value is removed. Every other value in that field is kept.

            `{"threat-type:Malware": ""}`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>New task-sharing rule for the
            owner organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>New observable-sharing rule
            for the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        addTags:
          description: |-
            Tags to add to the current set of case tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - ransomware
            - endpoint
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of case tags. Tags not present on the case are silently ignored.
            Use `GET /api/v1/case/{idOrName}` and read the `tags` field to see the current tags on the case.
          examples:
          - - file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
    InputUpdateCaseReport:
      title: InputUpdateCaseReport
      type: object
      required:
      - file
      properties:
        file:
          description: The new report file to replace the existing content.
          type: string
          format: binary
    InputUpdateCaseReportTemplate:
      title: InputUpdateCaseReportTemplate
      type: object
      properties:
        title:
          description: New title of the case report template.
          examples:
          - Ransomware Investigation Report
          type: string
          maxLength: 512
          minLength: 1
        group:
          description: New group label used to categorize the template.
          examples:
          - Incident Response
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: New summary of the template's purpose and contents.
          examples:
          - Standard template for ransomware incident investigations.
          type: string
          maxLength: 1048576
        definition:
          $ref: '#/components/schemas/CaseReportTemplateDefinition'
          description: New structure for the template.
        version:
          description: New version number of the template.
          examples:
          - 2
          type: integer
          format: int32
    InputUpdateCaseStatus:
      title: InputUpdateCaseStatus
      type: object
      properties:
        order:
          description: New position in the UI dropdown list. Set to `null` to remove
            the custom ordering.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: New description. Set to `null` to remove the existing description.
          examples:
          - Case has been contained but investigation continues.
          type: string
          maxLength: 1048576
        colour:
          description: New hex color code. Set to `null` to remove the custom color.
          examples:
          - '#ffa940'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
        hidden:
          description: When `true`, hides the status from the UI dropdown. Hidden
            statuses remain accessible through the API.
          examples:
          - false
          type: boolean
        requiresImpact:
          description: When `true`, closing a case with this status requires an `impactStatus`.
            Only a status in the *Closed* stage can require an impact, and you can't
            turn it off for the predefined `TruePositive` status.
          examples:
          - true
          type: boolean
    InputUpdateCaseTemplate:
      title: InputUpdateCaseTemplate
      type: object
      properties:
        name:
          description: New name for the case template, must be unique in your organization.
          examples:
          - Ransomware Response
          type: string
          maxLength: 128
          minLength: 1
        displayName:
          description: New display name shown to users when selecting this template.
          examples:
          - Ransomware Response
          type: string
          maxLength: 64
          minLength: 1
        titlePrefix:
          description: New prefix for case titles. Send `null` to remove the prefix.
          examples:
          - RAN-
          type: string
        description:
          description: New default description for cases. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to clear this field.
          examples:
          - |-
            ## Summary

            Ransomware infection detected. Containment and eradication required.
          type: string
          maxLength: 1048576
        severity:
          description: 'New default severity level for cases: 1 (Low), 2 (Medium),
            3 (High), 4 (Critical). Send `null` to clear this field.'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        tags:
          description: |-
            Replaces the template's current tag list with this set. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing free-form tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - ransomware
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks cases as important by default.
          examples:
          - false
          type: boolean
        tlp:
          description: 'New default [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level for cases: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4
            (Red). Send `null` to clear this field.'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New default [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level for cases: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red). Send `null`
            to clear this field.'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        summary:
          description: New default summary for cases. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to clear this field.
          examples:
          - Ransomware case opened following detection of file encryption activity.
          type: string
          maxLength: 1048576
        customFields:
          description: |-
            Custom fields to update. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Several formats are accepted, with different behaviors:

            Replacements

            - To replace all values of a custom field with a single value — Object format.
            Overwrites the current values of each listed custom field. Fields not listed are left untouched.
            `{"threat-type": "Malware", "detection-source": "EDR"}`
            - To replace all values of a custom field with one or more values — Array format.
            Overwrites the current values of each listed custom field. Fields not listed are deleted.
            `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "threat-type", "value": "Ransomware", "order": 1}, {"name": "detection-source", "value": "EDR", "order": 2}]`
            - To replace one specific value inside a custom field with one or more values — Object format with a field:value key.
            Only the targeted value changes. Every other value in that custom field is kept, and fields not listed are left untouched.
            `{"threat-type:Malware":"Ransomware"}` or `{"threat-type:Malware":["Ransomware", "Spyware"]}`

            Additions

            To add one or more values to a custom field without touching its existing values — Object format with an empty target.
            The trailing colon means that no value is targeted, so the new value is appended.

            `{"threat-type:": "Malware"}` or `{"threat-type:": ["Malware", "Ransomware"]}`

            Deletions

            To delete one specific value from a custom field — Object format with an empty replacement.
            Only the targeted value is removed. Every other value in that field is kept.

            `{"threat-type:Malware": ""}`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        tasks:
          description: Replaces the template's current task list with this set. A
            task represents one or more actions, called task logs, that must be completed
            during the investigation.
          type: array
          items:
            $ref: '#/components/schemas/InputCreateTask'
    InputUpdateCaseWithIds:
      title: InputUpdateCaseWithIds
      type: object
      required:
      - ids
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        title:
          description: New title of the case.
          examples:
          - Suspicious Ransomware Activity — CORP-LAPTOP-056
          type: string
          maxLength: 512
          minLength: 1
        description:
          description: New details of the case. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - File encryption via PowerShell script (encrypt.ps1) detected on multiple
            workstations.
          type: string
          maxLength: 1048576
        severity:
          description: 'New severity level of the case: 1 (Low), 2 (Medium), 3 (High),
            4 (Critical).'
          examples:
          - 3
          type: integer
          enum:
          - 1
          - 2
          - 3
          - 4
          format: int32
        startDate:
          description: 'New start date of the incident. Expected format: Unix timestamp
            in milliseconds.'
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: 'New end date of the incident. Expected format: Unix timestamp
            in milliseconds. Send `null` to unset.'
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        flag:
          description: Marks the case as important for quick filtering.
          examples:
          - false
          type: boolean
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        status:
          description: |-
            New case status. Must match an existing status. To close a case, set this
            to a status linked to the *Closed* stage.
            Use `POST /api/v1/query` with `listCaseStatus` to list available statuses.
          examples:
          - InProgress
          type: string
          maxLength: 64
          minLength: 1
        summary:
          description: New investigation summary. Send `null` to unset.
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
          maxLength: 1048576
        assignee:
          description: Login of the user to assign the case to. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          minLength: 1
        impactStatus:
          description: 'Enum: `NoImpact` `WithImpact` `NotApplicable`<br>Verdict on
            whether the incident had real consequences for the organization. Required
            when you close a case with a status whose `requiresImpact` field is `true`.
            TheHive rejects the update if you send it while closing a case with a
            status that doesn''t require an impact. Use `POST /api/v1/query` with
            `listCaseStatus` to check which statuses require an impact. `WithImpact`
            means the incident caused damage or data loss. `NoImpact` means it was
            resolved without consequences. `NotApplicable` means the concept doesn''t
            apply to this case. Send `null` to unset.'
          examples:
          - NotApplicable
          type: string
        customFields:
          description: |-
            Custom field values to update on the case. Must match existing custom fields.
            Use `GET /api/v1/customField` to list available custom fields.

            Several formats are accepted, with different behaviors:

            Replacements

            - To replace all values of a custom field with a single value — Object format.
            Overwrites the current values of each listed custom field. Fields not listed are left untouched.
            `{"threat-type": "Malware", "detection-source": "EDR"}`
            - To replace all values of a custom field with one or more values — Array format.
            Overwrites the current values of each listed custom field. Fields not listed are deleted.
            `[{"name": "threat-type", "value": "Malware", "order": 0}, {"name": "threat-type", "value": "Ransomware", "order": 1}, {"name": "detection-source", "value": "EDR", "order": 2}]`
            - To replace one specific value inside a custom field with one or more values — Object format with a field:value key.
            Only the targeted value changes. Every other value in that custom field is kept, and fields not listed are left untouched.
            `{"threat-type:Malware":"Ransomware"}` or `{"threat-type:Malware":["Ransomware", "Spyware"]}`

            Additions

            To add one or more values to a custom field without touching its existing values — Object format with an empty target.
            The trailing colon means that no value is targeted, so the new value is appended.

            `{"threat-type:": "Malware"}` or `{"threat-type:": ["Malware", "Ransomware"]}`

            Deletions

            To delete one specific value from a custom field — Object format with an empty replacement.
            Only the targeted value is removed. Every other value in that field is kept.

            `{"threat-type:Malware": ""}`
          oneOf:
          - $ref: '#/components/schemas/customFieldsAsObject'
          - type: array
            items:
              $ref: '#/components/schemas/InputCustomFieldValue'
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>New task-sharing rule for the
            owner organization: `autoShare` shares new tasks with every sharing organization
            automatically, `manual` requires explicit sharing per task. Overrides
            the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>New observable-sharing rule
            for the owner organization: `autoShare` shares new observables with every
            sharing organization automatically, `manual` requires explicit sharing
            per observable. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          examples:
          - manual
          type: string
        addTags:
          description: |-
            Tags to add to the current set of case tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - ransomware
            - endpoint
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of case tags. Tags not present on the case are silently ignored.
            Use `GET /api/v1/case/{idOrName}` and read the `tags` field to see the current tags on the case.
          examples:
          - - file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
    InputUpdateCatalogOfPattern:
      title: InputUpdateCatalogOfPattern
      type: object
      properties:
        name:
          description: New name for the catalog.
          examples:
          - Enterprise Attack v2
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: New description for the catalog. Send `null` to delete.
          examples:
          - Covers all standard enterprise-level attack techniques from the MITRE
            ATT&CK framework.
          type: string
          maxLength: 1048576
        variant:
          description: New variant identifier for the catalog. Send `null` to delete.
          examples:
          - '2025-04-15'
          type: string
          maxLength: 128
          minLength: 1
    InputUpdateCustomEvent:
      title: InputUpdateCustomEvent
      type: object
      properties:
        date:
          description: 'New start date of the custom event. Expected format: Unix
            timestamp in milliseconds.'
          examples:
          - 1737020400000
          type: integer
          format: int64
        endDate:
          description: 'New end date of the custom event. Expected format: Unix timestamp
            in milliseconds. Send `null` to unset.'
          examples:
          - 1737025800000
          type: integer
          format: int64
        title:
          description: New title of the custom event.
          examples:
          - Ransom demand received via email
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: New description of the custom event. Send `null` to unset.
          examples:
          - Attacker sent a ransom demand to the security team requesting payment
            in exchange for the decryption key.
          type: string
          maxLength: 1048576
    InputUpdateCustomField:
      title: InputUpdateCustomField
      type: object
      properties:
        displayName:
          description: New user-facing name of the custom field.
          examples:
          - Threat Type
          type: string
          maxLength: 64
          minLength: 1
        group:
          description: New group of the custom field.
          examples:
          - Classification
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: New description of the custom field.
          examples:
          - Type of threat detected in the case.
          type: string
          maxLength: 1048576
        type:
          $ref: '#/components/schemas/CustomFieldType'
          description: New type of the custom field.
        options:
          description: Replaces the predefined selectable values. Available for `string`,
            `integer`, and `float` types.
          examples:
          - - Malware
            - Intrusion
            - Data Leak
          type: array
          items: {}
        mandatory:
          description: 'Marks the field as mandatory: users must fill it in before
            a case or alert can be closed.'
          examples:
          - true
          type: boolean
    InputUpdateDashboard:
      title: InputUpdateDashboard
      type: object
      properties:
        title:
          description: New title for the dashboard. Leave unset to keep the current
            title.
          examples:
          - Cases overview
          type: string
          maxLength: 512
          minLength: 1
        group:
          description: New group used to categorize the dashboard. Leave unset to
            keep the current group.
          examples:
          - Security operations
          type: string
          maxLength: 32
          minLength: 1
        description:
          description: New description for the dashboard. Leave unset to keep the
            current description.
          examples:
          - Overview of open cases across the organization, grouped by severity and
            status.
          type: string
          maxLength: 1048576
        definition:
          description: |-
            New widget layout and configuration for the dashboard,
            structured as rows of widgets. Leave unset to keep the
            current definition. This structure isn't formally
            documented: the simplest way to build a valid value is to
            edit the dashboard from TheHive web interface, then retrieve
            it with `GET /api/v1/dashboard/{dashboardId}` and use its
            `definition` value as a starting point.
          examples:
          - period: last3Months
            items:
            - type: container
              items:
              - id: wdgt-1a2b3c
                type: counter
                options:
                  title: Open cases
                  entity: case
                  periodDateField: _createdAt
                  filters: []
                  series:
                  - agg: count
                    type: bar
                    query: {}
                    label: Open cases
          type: object
        status:
          $ref: '#/components/schemas/DashboardStatus'
          description: |-
            New visibility for the dashboard: `Private` restricts access
            to you, `Shared` makes it visible to your entire organization.
            Setting this to `Deleted` deletes the dashboard. Leave unset
            to keep the current visibility.
        version:
          description: |-
            New version number for the dashboard definition format.
            Leave unset to keep the current version.
          examples:
          - 1
          type: integer
          format: int32
    InputUpdateFunction:
      title: InputUpdateFunction
      type: object
      properties:
        mode:
          $ref: '#/components/schemas/InputFunctionMode'
          examples:
          - Enabled
        definition:
          description: JavaScript source code. Must define a `handle(input, context)`
            function as the entry point.
          examples:
          - function handle(input, context) { return []; }
          type: string
          maxLength: 1048576
        description:
          description: Description of the function.
          examples:
          - Fetches records from Airtable and creates alerts in TheHive.
          type: string
          maxLength: 1048576
        config:
          description: Configuration object passed to the function at runtime.
          examples:
          - apiKey: <api_key>
          type: object
        types:
          description: '[Function types](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-functions/about-functions/#function-types).
            Determines how and when the function can be invoked.'
          examples:
          - - api
          type: array
          items:
            $ref: '#/components/schemas/InputFunctionType'
    InputUpdateListView:
      title: InputUpdateListView
      type: object
      properties:
        name:
          description: New name for the view. Leave unset to keep the current name.
          examples:
          - High severity cases
          type: string
        filter:
          description: |-
            Filter applied to the list. Uses the same
            operators as the [`filter` step of the Query API](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export). Leave
            unset to keep the current filter.
          examples:
          - _and:
            - _eq:
                _field: status
                _value: InProgress
          type: object
        listOptions:
          $ref: '#/components/schemas/ListOptions'
          description: New display options for the view. Leave unset to keep the current
            options.
        sortList:
          description: |-
            New sort order for the view. Each entry is a
            field name prefixed with `+` for ascending order
            or `-` for descending order. Leave unset to keep
            the current sort order.
          examples:
          - - -_createdAt
          type: array
          maxItems: 15
          items:
            type: string
        showColumns:
          description: |-
            New set of optional columns displayed in the
            list, on top of the fixed set of columns shown for that entity type. The available
            optional columns vary by entity: check the corresponding list in
            TheHive web interface. Leave unset to keep the
            current columns.
          examples:
          - - tlp
            - tags
          type: array
          maxItems: 15
          uniqueItems: true
          items:
            type: string
        isShared:
          description: |
            Whether to share the view with your entire
            organization, or make it private. Leave unset to
            keep the current visibility.

            Every member of the organization can use, modify,
            and delete a shared view.
          examples:
          - true
          type: boolean
    InputUpdateLog:
      title: InputUpdateLog
      type: object
      properties:
        message:
          description: New content of the task log. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence
            of code injection into explorer.exe.
          type: string
          maxLength: 1048576
        includeInTimeline:
          description: 'New date at which to pin the log entry in the case timeline.
            Expected format: Unix timestamp in milliseconds. Send `null` to remove
            the pin.'
          examples:
          - 1742046000000
          type: integer
          format: int64
    InputUpdateObservable:
      title: InputUpdateObservable
      type: object
      properties:
        dataType:
          description: |-
            New observable type. Must match an existing observable type defined in TheHive.
            Use `POST /api/v1/query` with `listObservableType` to list available types.
          examples:
          - domain
          type: string
          maxLength: 64
          minLength: 1
        message:
          description: New description of the observable. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to unset.
          examples:
          - Source IP of the ransomware C2 server detected on CORP-LAPTOP-056
          type: string
          maxLength: 1048576
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        ioc:
          description: Marks the observable as an indicator of compromise (IOC), indicating
            it's linked to suspicious or malicious activity.
          examples:
          - true
          type: boolean
        sighted:
          description: Marks the observable as sighted, meaning it has been detected
            or observed in the environment.
          examples:
          - false
          type: boolean
        sightedAt:
          description: 'Date and time when the observable was last sighted. Expected
            format: Unix timestamp in milliseconds. Send `null` to unset.'
          examples:
          - 1748822400000
          type: integer
          format: int64
        ignoreSimilarity:
          description: When `true`, excludes the observable from similarity checks
            used to identify related alerts and cases.
          examples:
          - false
          type: boolean
        addTags:
          description: |-
            Tags to add to the current set of observable tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of observable tags. Tags not present on the observable are silently ignored.
            Use `GET /api/v1/observable/{observableId}` and read the `tags` field to see the current tags on the observable.
          examples:
          - - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        external:
          description: When `true`, makes the observable accessible to external users
            with [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Platinum or One license required.
          examples:
          - false
          type: boolean
    InputUpdateObservableType:
      title: InputUpdateObservableType
      type: object
      properties:
        isCaseSensitive:
          description: |-
            When `false`, new observables of this type are automatically normalized to lowercase upon
            creation to ensure that values are treated as identical regardless of letter casing.
            Existing observables aren't affected.
          examples:
          - false
          type: boolean
    InputUpdateObservableWithIds:
      title: InputUpdateObservableWithIds
      type: object
      required:
      - ids
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        dataType:
          description: |-
            New observable type. Must match an existing observable type defined in TheHive.
            Use `POST /api/v1/query` with `listObservableType` to list available types.
          examples:
          - domain
          type: string
          maxLength: 64
          minLength: 1
        message:
          description: New description of the observable. Supports [TheHive-flavored
            Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to unset.
          examples:
          - Source IP of the ransomware C2 server detected on CORP-LAPTOP-056
          type: string
          maxLength: 1048576
        tlp:
          description: 'New [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          - 4
          format: int32
        pap:
          description: 'New [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level: 0 (Clear), 1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int32
        tags:
          description: |-
            Replaces all current tags with this set. Unknown tags are automatically created.
            Use `addTags` and `removeTags` to add or remove individual tags without replacing the full set.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        ioc:
          description: Marks the observable as an indicator of compromise (IOC), indicating
            it's linked to suspicious or malicious activity.
          examples:
          - true
          type: boolean
        sighted:
          description: Marks the observable as sighted, meaning it has been detected
            or observed in the environment.
          examples:
          - false
          type: boolean
        sightedAt:
          description: 'Date and time when the observable was last sighted. Expected
            format: Unix timestamp in milliseconds. Send `null` to unset.'
          examples:
          - 1748822400000
          type: integer
          format: int64
        ignoreSimilarity:
          description: When `true`, excludes the observable from similarity checks
            used to identify related alerts and cases.
          examples:
          - false
          type: boolean
        addTags:
          description: |-
            Tags to add to the current set of observable tags. Unknown tags are automatically created.
            Use `POST /api/v1/query` with `listTag` to retrieve existing custom tags, or with `listTaxonomy` and `tags` to retrieve taxonomy tags.
          examples:
          - - threat-type:file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        removeTags:
          description: |-
            Tags to remove from the current set of observable tags. Tags not present on the observable are silently ignored.
            Use `GET /api/v1/observable/{observableId}` and read the `tags` field to see the current tags on the observable.
          examples:
          - - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 128
            minLength: 1
        external:
          description: When `true`, makes the observable accessible to external users
            with [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Platinum or One license required.
          examples:
          - false
          type: boolean
    InputUpdateOrganisation:
      title: InputUpdateOrganisation
      type: object
      properties:
        name:
          description: New name for the organization.
          examples:
          - TheOrganization
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: New description for the organization.
          examples:
          - The primary investigation organization.
          type: string
          maxLength: 1048576
        taskRule:
          description: 'Enum: `autoShare` `manual`<br>New default task-sharing rule
            applied to new case shares with this organization: `autoShare` shares
            new tasks with every sharing organization automatically, `manual` requires
            explicit sharing per task. See [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - manual
          type: string
        observableRule:
          description: 'Enum: `autoShare` `manual`<br>New default observable-sharing
            rule applied to new case shares with this organization: `autoShare` shares
            new observables with every sharing organization automatically, `manual`
            requires explicit sharing per observable. See [organization-level sharing
            rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).'
          default: manual
          examples:
          - manual
          type: string
        locked:
          description: Whether to lock or unlock the organization.
          examples:
          - false
          type: boolean
        avatar:
          description: New avatar for the organization, encoded as a Base64 string.
          examples:
          - iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==
          type: string
    InputUpdatePage:
      title: InputUpdatePage
      type: object
      properties:
        title:
          description: New title of the page.
          examples:
          - Investigation Notes
          type: string
          maxLength: 512
          minLength: 1
        content:
          description: New content of the page. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - |-
            ## Summary

            File encryption via PowerShell script detected on multiple workstations.
          type: string
          maxLength: 1048576
        order:
          description: New display order of the page within its category.
          examples:
          - 1
          type: integer
          format: int32
        category:
          description: |-
            New category for the page. Unknown categories are automatically created.
            Use `POST /api/v1/query` with `listPage` to retrieve existing categories.
          examples:
          - Investigation
          type: string
          maxLength: 128
          minLength: 1
    InputUpdateProcedure:
      title: InputUpdateProcedure
      type: object
      properties:
        description:
          description: New description of how the technique was carried out, referred
            to as the procedure.
          examples:
          - PowerShell script used to encrypt files across multiple workstations.
          type: string
          maxLength: 1048576
        occurDate:
          description: 'New occurrence date of the technique. Expected format: Unix
            timestamp in milliseconds.'
          examples:
          - 1748739600000
          type: integer
          format: int64
        patternId:
          description: |-
            New technique ID from a loaded catalog, for example a MITRE ATT&CK technique ID.
            Must match an existing technique. Use `POST /api/v1/query` with `listPattern`
            to retrieve available techniques and their IDs.
          examples:
          - T1059.001
          type: string
          maxLength: 128
          minLength: 1
        tactic:
          description: New short name of the tactic the technique belongs to. Required
            when the technique belongs to more than one tactic.
          examples:
          - execution
          type: string
          maxLength: 32
          minLength: 1
    InputUpdateProfile:
      title: InputUpdateProfile
      type: object
      properties:
        name:
          description: New name for the profile.
          examples:
          - SOC-Tier1-Analyst
          type: string
          maxLength: 64
          minLength: 1
        permissions:
          description: |-
            Replaces all current permissions with this set.
            Use `GET /api/v1/permission` to list all available permissions.
          examples:
          - - manageCase/create
            - manageCase/update
            - manageObservable
            - manageTask
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 64
            minLength: 1
    InputUpdateShare:
      title: InputUpdateShare
      type: object
      required:
      - profile
      properties:
        profile:
          description: |-
            Profile that defines the permissions of the organization members on this case. Must match an existing profile.
            Use `POST /api/v1/query` with `listProfile` to retrieve available permission profiles. Overrides the [organization-level sharing rules](https://docs.strangebee.com/thehive/administration/organizations/about-organizations-sharing-rules/).
          examples:
          - analyst
          type: string
          maxLength: 64
          minLength: 1
    InputUpdateTag:
      title: InputUpdateTag
      type: object
      properties:
        predicate:
          description: New label text displayed on cases, alerts, and observables.
            Must not duplicate a name from any existing taxonomy in TheHive.
          examples:
          - ransomware
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: New description of the tag.
          examples:
          - Identifies ransomware-related cases and observables
          type: string
          maxLength: 1048576
        colour:
          description: New hex color code for the tag's visual appearance. Must be
            a six-digit hex color preceded by `#`.
          examples:
          - '#e8560a'
          type: string
          pattern: ^#[0-9a-fA-F]{6,6}|$
    InputUpdateTask:
      title: InputUpdateTask
      type: object
      properties:
        title:
          description: New title of the task.
          examples:
          - Isolate affected workstation from the network
          type: string
          maxLength: 128
          minLength: 1
        group:
          description: New group of the task.
          examples:
          - Containment
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: New details of the task. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to clear this field.
          examples:
          - Disconnect CORP-LAPTOP-056 from the network immediately.
          type: string
          maxLength: 1048576
        status:
          description: 'Enum: `Waiting` `InProgress` `Completed` `Cancel`<br>New status
            of the task.'
          examples:
          - InProgress
          type: string
        flag:
          description: Marks the task as important for quick filtering.
          examples:
          - false
          type: boolean
        startDate:
          description: New start date of the task. Unix timestamp in milliseconds.
            Send `null` to clear this field.
          examples:
          - 1748476800000
          type: integer
          format: int64
        endDate:
          description: New end date of the task. Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        order:
          description: New display order of the task within its group.
          examples:
          - 1
          type: integer
          format: int32
        dueDate:
          description: New due date of the task. Unix timestamp in milliseconds. Send
            `null` to clear this field.
          examples:
          - 1748563200000
          type: integer
          format: int64
        assignee:
          description: Login of the user to assign to the task. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          minLength: 1
        mandatory:
          description: Whether the task must be completed before the case can be closed.
          examples:
          - false
          type: boolean
    InputUpdateTaskWithIds:
      title: InputUpdateTaskWithIds
      type: object
      required:
      - ids
      properties:
        ids:
          description: Identifiers of the entities to target. IDs must be prefixed
            with `~`. Case numbers and names are passed as plain strings without a
            prefix.
          examples:
          - - ~128458762
            - ~216513541
          type: array
          items:
            description: The _id of the entity or its 'name' (depends of the entity)
            examples:
            - ~354
            type: string
        title:
          description: New title of the task.
          examples:
          - Isolate affected workstation from the network
          type: string
          maxLength: 128
          minLength: 1
        group:
          description: New group of the task.
          examples:
          - Containment
          type: string
          maxLength: 64
          minLength: 1
        description:
          description: New details of the task. Supports [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
            Send `null` to clear this field.
          examples:
          - Disconnect CORP-LAPTOP-056 from the network immediately.
          type: string
          maxLength: 1048576
        status:
          description: 'Enum: `Waiting` `InProgress` `Completed` `Cancel`<br>New status
            of the task.'
          examples:
          - InProgress
          type: string
        flag:
          description: Marks the task as important for quick filtering.
          examples:
          - false
          type: boolean
        startDate:
          description: New start date of the task. Unix timestamp in milliseconds.
            Send `null` to clear this field.
          examples:
          - 1748476800000
          type: integer
          format: int64
        endDate:
          description: New end date of the task. Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        order:
          description: New display order of the task within its group.
          examples:
          - 1
          type: integer
          format: int32
        dueDate:
          description: New due date of the task. Unix timestamp in milliseconds. Send
            `null` to clear this field.
          examples:
          - 1748563200000
          type: integer
          format: int64
        assignee:
          description: Login of the user to assign to the task. Typically an email
            address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted. Use `POST /api/v1/query` with `listUser`
            to retrieve available users and their logins. Send `null` to unassign.
          examples:
          - sami@example.com
          type: string
          maxLength: 128
          minLength: 1
        mandatory:
          description: Whether the task must be completed before the case can be closed.
          examples:
          - false
          type: boolean
    InputUpdateUser:
      title: InputUpdateUser
      type: object
      properties:
        name:
          description: New display name for the user account.
          examples:
          - Emma Analyst
          type: string
          maxLength: 128
          minLength: 1
        organisation:
          description: 'Organization context when updating the profile. Must match
            an existing organization the user belongs to. Use `POST /api/v1/query`
            with `listUser` and `extraData: ["organisations"]` to retrieve the organizations
            the user belongs to.'
          examples:
          - TheOrganization
          type: string
          maxLength: 128
          minLength: 1
        profile:
          description: New permission profile for the user in the specified organization.
            Must match an existing profile. Use `GET /api/v1/profile` to list available
            profiles.
          examples:
          - analyst
          type: string
          maxLength: 64
          minLength: 1
        locked:
          description: Locks or unlocks the user account. A locked account can't sign
            in or use the API. Requires `manageUser` permission.
          examples:
          - false
          type: boolean
        avatar:
          description: Avatar image as a raw Base64-encoded string. Always stored
            as JPEG regardless of the source format. Set to `null` or an empty string
            to remove the current avatar.
          examples:
          - iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==
          type: string
        email:
          description: Email address for sending notifications. Set to `null` to remove
            the current address.
          examples:
          - emma@example.com
          type: string
          maxLength: 128
          pattern: ^(([^()\[\]\\.,;:\s@"]+(\.[^()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9 -퟿豈-﷏ﷰ-￯]+\.)+[a-zA-Z -퟿豈-﷏ﷰ-￯]{2,}))$
        defaultOrganisation:
          description: 'New default organization for the user account. Must match
            an organization the user already belongs to. Use `POST /api/v1/query`
            with `listUser` and `extraData: ["organisations"]` to retrieve the organizations
            the user belongs to.'
          examples:
          - TheOrganization
          type: string
          maxLength: 128
          minLength: 1
        type:
          $ref: '#/components/schemas/UserType'
          description: Type of user account. Normal accounts can use the web interface
            and the API. Service accounts authenticate exclusively with an API key
            and can't sign in to the web interface. External accounts access TheHive
            through the Portal (requires a Platinum or One license). A user's type
            can't be changed to or from `External` after creation.
    InputUploadCaseReport:
      title: InputUploadCaseReport
      type: object
      required:
      - file
      properties:
        file:
          description: The report file to attach to the case.
          type: string
          format: binary
    InputUserOrganisation:
      title: InputUserOrganisation
      type: object
      required:
      - organisation
      - profile
      properties:
        organisation:
          description: Organization name. Must match an existing organization. Use
            `POST /api/v1/query` with `listOrganisation` to retrieve available organizations.
          examples:
          - TheOrganization
          type: string
          maxLength: 128
          minLength: 1
        profile:
          description: Permission profile for the user in this organization. Must
            match an existing profile. Use `GET /api/v1/profile` to list available
            profiles.
          examples:
          - analyst
          type: string
          maxLength: 64
          minLength: 1
        default:
          description: Whether this is the user's default organization. On sign-in,
            the user's session starts in this organization's context. For API requests,
            this organization is used when the `X-Organisation` header isn't specified.
          default: false
          examples:
          - true
          type: boolean
    InputValue:
      title: InputValue
      type: object
      required:
      - predicate
      properties:
        predicate:
          description: Predicate identifier this set of entries belongs to.
          examples:
          - amber
          type: string
          maxLength: 512
          minLength: 1
        entry:
          type: array
          items:
            $ref: '#/components/schemas/InputEntry'
    IntegerPropertyDescription:
      title: IntegerPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - customFields.impact-score
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - list
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as an integer.
          examples:
          - integer
          type: string
          enum:
          - integer
          const: integer
    Interval:
      title: Interval
      type: object
      required:
      - value
      - unit
      properties:
        value:
          description: Number of time units. Must be greater than 0.
          examples:
          - 1
          type: integer
          format: int32
          exclusiveMinimum: 0
        unit:
          $ref: '#/components/schemas/IntervalUnit'
    IntervalUnit:
      title: IntervalUnit
      description: Time unit.
      examples:
      - Minutes
      type: string
      enum:
      - Days
      - Hours
      - Minutes
      - Seconds
      - Milliseconds
    JsObject:
      title: JsObject
      type: object
    KeyCreateAuth:
      title: KeyCreateAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: API key included in the authentication header.
          examples:
          - api_key_value
          type: string
          maxLength: 8192
          minLength: 1
        prefix:
          description: Optional prefix prepended to the API key in the header, separated
            by a space.
          examples:
          - ApiKey
          type: string
          maxLength: 32
          minLength: 1
        type:
          description: Authentication type identifier. Must be `key`.
          examples:
          - key
          type: string
          const: key
    KeyOutputAuth:
      title: KeyOutputAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: API key included in the authentication header.
          examples:
          - api_key_value
          type: string
          maxLength: 8192
          minLength: 1
        prefix:
          description: Optional prefix prepended to the API key in the header, separated
            by a space.
          examples:
          - ApiKey
          type: string
          maxLength: 32
          minLength: 1
        type:
          description: Authentication type identifier.
          examples:
          - key
          type: string
          const: key
    KeyUpdateAuth:
      title: KeyUpdateAuth
      type: object
      required:
      - key
      - type
      properties:
        key:
          description: API key included in the authentication header.
          examples:
          - api_key_value
          type: string
          maxLength: 8192
          minLength: 1
        prefix:
          description: Optional prefix prepended to the API key in the header, separated
            by a space.
          examples:
          - ApiKey
          type: string
          maxLength: 32
          minLength: 1
        type:
          description: Authentication type identifier. Must be `key`.
          examples:
          - key
          type: string
          const: key
    Kind:
      title: Kind
      type: string
      enum:
      - Text
      - Image
      - CustomFields
      - CustomFieldsList
      - AlertTable
      - AlertList
      - ObservableTable
      - ObservableList
      - TaskTable
      - TaskList
      - TTPTable
      - TTPList
      - Timeline
      - Comments
      - Pages
    Ko:
      title: Ko
      type: object
      required:
      - errors
      properties:
        errors:
          $ref: '#/components/schemas/Map_String'
    ListOptions:
      title: ListOptions
      type: object
      required:
      - itemsPerPage
      - listAsGroup
      - autoRefresh
      - statsIsOpen
      properties:
        itemsPerPage:
          description: Number of rows shown per page in the list.
          examples:
          - 50
          type: integer
          enum:
          - 10
          - 30
          - 50
          - 100
          - 150
          - 300
          format: int32
        listAsGroup:
          description: |-
            Whether the list groups its items by their group
            value instead of showing them as a flat list. Only
            applies to lists that support grouping, such as
            tasks.
          examples:
          - false
          type: boolean
        autoRefresh:
          description: |
            Whether the list refreshes automatically when new
            activity occurs. See [About Autorefresh](https://docs.strangebee.com/thehive/user-guides/analyst-corner/about-autorefresh/) for more information.
          examples:
          - true
          type: boolean
        statsIsOpen:
          description: |
            Whether the statistics panel above the list is
            expanded. See [About Statistics](https://docs.strangebee.com/thehive/user-guides/analyst-corner/about-statistics/) for more information.
          examples:
          - true
          type: boolean
    ListRespondersOutput:
      title: ListRespondersOutput
      type: object
      required:
      - id
      - name
      - version
      - description
      properties:
        id:
          description: ID of the responder once enabled within the organization.
          examples:
          - b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab
          type: string
        name:
          description: Display name of the responder.
          examples:
          - Mailer
          type: string
        version:
          description: Version of the responder.
          examples:
          - 1.0
          type: string
        description:
          description: Description of what the responder does.
          examples:
          - Send an email through an SMTP relay.
          type: string
        dataTypeList:
          description: Data types the responder supports.
          examples:
          - - thehive:case
            - thehive:case_task
          type: array
          items:
            type: string
        cortexIds:
          description: Names of the Cortex servers on which the responder is available.
          examples:
          - - Cortex1
          type: array
          items:
            type: string
    List_OutputLicense:
      title: List_OutputLicense
      oneOf:
      - $ref: '#/components/schemas/Nil'
      - type: array
        items:
          $ref: '#/components/schemas/OutputLicense'
    LogField:
      title: LogField
      type: string
      enum:
      - message
      - date
      - includeInTimeline
      - _createdAt
      - _createdBy
      - _updatedAt
      - _updatedBy
    LoginInput:
      title: LoginInput
      type: object
      required:
      - user
      - password
      properties:
        user:
          description: Login used to sign in to TheHive. Typically an email address.
            If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication),
            a plain username is also accepted.
          examples:
          - lucas@example.com
          type: string
        password:
          description: Password associated with `user`.
          examples:
          - Sup3rSecret!2025
          type: string
        organisation:
          description: ID or name of the organization to log into. Must be an organization
            you belong to that isn't locked, or login fails. If omitted, TheHive uses
            your default organization when it isn't locked, otherwise an organization
            you belong to.
          examples:
          - TheOrganization
          type: string
        code:
          description: Current code from your authenticator app. Required if multifactor
            authentication is enabled for `user`.
          examples:
          - 123456
          type: string
    Manager:
      title: Manager
      type: object
      properties:
        algorithm:
          description: Algorithm name for the key or trust manager.
          examples:
          - PKIX
          type: string
          maxLength: 128
          minLength: 1
        stores:
          description: Key or trust stores used by the manager.
          type: array
          items:
            $ref: '#/components/schemas/StoreConfig'
    Map_Boolean:
      title: Map_Boolean
      type: object
      additionalProperties:
        type: boolean
    Map_Direction:
      title: Map_Direction
      type: object
      additionalProperties:
        $ref: '#/components/schemas/Direction'
    Map_Int:
      title: Map_Int
      type: object
      additionalProperties:
        type: integer
        format: int32
    Map_Seq_ExportFieldDescription:
      title: Map_Seq_ExportFieldDescription
      description: Map of supported model name (`Case`, `Alert`, `User`, `Organisation`,
        `Procedure`, `Task`, `Observable`) to the list of fields available for export
        on that model
      type: object
      additionalProperties:
        type: array
        items:
          $ref: '#/components/schemas/ExportFieldDescription'
    Map_String:
      title: Map_String
      description: Map of filename to error message for each file that failed to import.
      examples:
      - machinetag.json: Invalid JSON format
      type: object
      additionalProperties:
        type: string
    Method:
      title: Method
      examples:
      - GET
      type: string
      enum:
      - GET
      - POST
    Nil:
      title: Nil
      type: object
    NoneCreateAuth:
      title: NoneCreateAuth
      type: object
      required:
      - type
      properties:
        type:
          description: Authentication type identifier. Must be `none`.
          examples:
          - none
          type: string
          const: none
    NoneOutputAuth:
      title: NoneOutputAuth
      type: object
      required:
      - type
      properties:
        type:
          description: Authentication type identifier.
          examples:
          - none
          type: string
          const: none
    NoneUpdateAuth:
      title: NoneUpdateAuth
      type: object
      required:
      - type
      properties:
        type:
          description: Authentication type identifier. Must be `none`.
          examples:
          - none
          type: string
          const: none
    OAuth2CreateAuth:
      title: OAuth2CreateAuth
      type: object
      required:
      - clientId
      - clientSecret
      - tokenUrl
      - clientAuthenticationMethod
      - type
      properties:
        clientId:
          description: Client ID assigned by the OAuth 2.0 provider when registering
            TheHive.
          examples:
          - thehive-client-id
          type: string
          maxLength: 512
          minLength: 1
        clientSecret:
          description: Client secret issued by the OAuth 2.0 provider.
          examples:
          - thehive-client-secret
          type: string
          maxLength: 512
          minLength: 1
        grantType:
          $ref: '#/components/schemas/GrantType'
          description: Default value is 'client_credentials'
        tokenUrl:
          description: OAuth 2.0 token endpoint used to obtain an access token.
          examples:
          - https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
          type: string
          format: url
        scope:
          description: Default value is empty array
          examples:
          - - openid
            - email
          type: array
          items:
            type: string
        clientAuthenticationMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
          description: Defines how client credentials are sent to the token endpoint.
        tokenParameters:
          description: Additional parameters to include in the token request.
          type: array
          items:
            $ref: '#/components/schemas/TokenParameter'
        type:
          description: Authentication type identifier. Must be `oauth2`.
          examples:
          - oauth2
          type: string
          const: oauth2
    OAuth2OutputAuth:
      title: OAuth2OutputAuth
      type: object
      required:
      - clientId
      - tokenUrl
      - clientAuthenticationMethod
      - type
      properties:
        clientId:
          description: Client ID assigned by the OAuth 2.0 provider.
          examples:
          - thehive-client-id
          type: string
          maxLength: 512
          minLength: 1
        grantType:
          $ref: '#/components/schemas/GrantType'
        tokenUrl:
          description: OAuth 2.0 token endpoint.
          examples:
          - https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
          type: string
          format: url
        scope:
          description: Scopes requested from the authorization server.
          examples:
          - - openid
            - email
          type: array
          items:
            type: string
        clientAuthenticationMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
          description: Method used to send client credentials to the token endpoint.
        tokenParameters:
          description: Additional parameters included in the token request.
          type: array
          items:
            $ref: '#/components/schemas/TokenParameter'
        type:
          description: Authentication type identifier.
          examples:
          - oauth2
          type: string
          const: oauth2
    OAuth2UpdateAuth:
      title: OAuth2UpdateAuth
      type: object
      required:
      - clientId
      - tokenUrl
      - clientAuthenticationMethod
      - type
      properties:
        clientId:
          description: Client ID assigned by the OAuth 2.0 provider when registering
            TheHive.
          examples:
          - thehive-client-id
          type: string
          maxLength: 512
          minLength: 1
        clientSecret:
          description: Client secret issued by the OAuth 2.0 provider. Won't be updated
            if it consists only of `*` characters.
          examples:
          - thehive-client-secret
          type: string
          maxLength: 512
          minLength: 1
        grantType:
          $ref: '#/components/schemas/GrantType'
          description: Default value is 'client_credentials'
        tokenUrl:
          description: OAuth 2.0 token endpoint used to obtain an access token.
          examples:
          - https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
          type: string
          format: url
        scope:
          description: Default value is empty array
          examples:
          - - openid
            - email
          type: array
          items:
            type: string
        clientAuthenticationMethod:
          $ref: '#/components/schemas/ClientAuthenticationMethod'
          description: Defines how client credentials are sent to the token endpoint.
        tokenParameters:
          description: Additional parameters to include in the token request.
          type: array
          items:
            $ref: '#/components/schemas/TokenParameter'
        type:
          description: Authentication type identifier. Must be `oauth2`.
          examples:
          - oauth2
          type: string
          const: oauth2
    ObservableField:
      title: ObservableField
      type: string
      enum:
      - dataType
      - data
      - startDate
      - tlp
      - pap
      - tags
      - ioc
      - sighted
      - sightedAt
      - reports
      - message
      - _createdAt
      - _createdBy
      - _updatedAt
      - _updatedBy
    ObservableList:
      title: ObservableList
      type: object
      required:
      - protectData
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Observables
          type: string
          maxLength: 512
          minLength: 1
        fields:
          description: Observable fields to display for each item in the list.
          type: array
          items:
            $ref: '#/components/schemas/ObservableField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the observable list. See the [Query and
            Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the observable list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        protectData:
          description: When `true`, masks the data of observables flagged as sensitive.
          examples:
          - true
          type: boolean
        maxElements:
          description: Maximum number of observables to include in the widget. If
            omitted, the global `maxElements` limit applies.
          examples:
          - 50
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    ObservableTable:
      title: ObservableTable
      type: object
      required:
      - protectData
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Observables
          type: string
          maxLength: 512
          minLength: 1
        columns:
          description: Observable fields to include as columns in the table.
          type: array
          items:
            $ref: '#/components/schemas/ObservableField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the observable list. See the [Query and
            Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the observable list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        protectData:
          description: When `true`, masks the data of observables flagged as sensitive.
          examples:
          - true
          type: boolean
        maxElements:
          description: Maximum number of observables to include in the widget. If
            omitted, the global `maxElements` limit applies.
          examples:
          - 50
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    Ok:
      title: Ok
      type: object
      properties:
        imported:
          type: array
          items:
            $ref: '#/components/schemas/Imported'
    OkWithErrors:
      title: OkWithErrors
      type: object
      properties:
        imported:
          type: array
          items:
            $ref: '#/components/schemas/Imported'
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
    OrganisationAccess:
      title: OrganisationAccess
      type: object
      required:
      - _kind
      properties:
        _kind:
          description: All internal users of the owner organization can see the case.
            This is the default access mode.
          type: string
          const: OrganisationAccessKind
    OrganisationLink:
      title: OrganisationLink
      type: object
      required:
      - toOrganisation
      - linkType
      - otherLinkType
      properties:
        toOrganisation:
          description: ID or name of the organization to link.
          examples:
          - TheOrganization
          type: string
        avatar:
          description: Base64-encoded avatar image of the organization.
          examples:
          - iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==
          type: string
        linkType:
          description: Sharing profile applied when the current organization shares
            a case with this organization. Use `GET /api/v1/sharingProfile` to retrieve
            available profiles.
          examples:
          - default
          type: string
          maxLength: 64
          minLength: 1
        otherLinkType:
          description: Sharing profile applied when this organization shares a case
            with the current organization. Use `GET /api/v1/sharingProfile` to retrieve
            available profiles.
          examples:
          - supervised
          type: string
          maxLength: 64
          minLength: 1
    OutputAction:
      title: OutputAction
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - responderId
      - objectType
      - objectId
      - status
      - startDate
      - operations
      - report
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the action.
          examples:
          - ~327696
          type: string
        _type:
          description: Entity type, always `Action`.
          examples:
          - Action
          type: string
        _createdBy:
          description: Login of the user who triggered the action.
          examples:
          - emma@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the action.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the action was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the action was last updated. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739605000
          type: integer
          format: int64
        responderId:
          description: ID of the responder that ran.
          examples:
          - b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab
          type: string
        responderName:
          description: Display name of the responder that ran.
          examples:
          - Mailer
          type: string
        responderDefinition:
          description: Definition of the responder that ran, as returned by Cortex.
          examples:
          - name: Mailer_1_0
            version: '1.0'
          type: string
        cortexId:
          description: Name of the Cortex server the responder ran on.
          examples:
          - Cortex1
          type: string
        cortexJobId:
          description: ID of the corresponding job on the Cortex server.
          examples:
          - AWmX6HGxi3s3zwsBQJer
          type: string
        objectType:
          description: Type of the entity the action targeted. One of `Case`, `Alert`,
            `Observable`, `Task`, or `Log`.
          examples:
          - Observable
          type: string
        objectId:
          description: ID of the entity the action targeted.
          examples:
          - ~276824
          type: string
        status:
          description: Status of the action. One of `Waiting`, `InProgress`, `Success`,
            `Failure`, or `Deleted`.
          examples:
          - Success
          type: string
          enum:
          - InProgress
          - Success
          - Failure
          - Waiting
          - Deleted
        startDate:
          description: Date and time when the action started. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        endDate:
          description: Date and time when the action finished. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739605000
          type: integer
          format: int64
        operations:
          description: JSON-encoded array of operations the responder performed, such
            as adding a tag or closing the case.
          examples:
          - - tag: ransomware
              type: AddTagToCase
              status: Success
              message: Tag added to the case.
          type: string
        report:
          description: JSON-encoded report returned by the responder.
          examples:
          - success: true
            full:
              message: Email successfully sent to soc@example.com
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputAlert:
      title: OutputAlert
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - type
      - source
      - sourceRef
      - title
      - description
      - severity
      - severityLabel
      - date
      - tlp
      - tlpLabel
      - pap
      - papLabel
      - follow
      - observableCount
      - status
      - stage
      - extraData
      - newDate
      - timeToDetect
      properties:
        _id:
          description: Internal unique identifier of the alert.
          examples:
          - ~128458762
          type: string
        _type:
          description: Entity type, always `Alert`.
          examples:
          - Alert
          type: string
        _createdBy:
          description: Login of the user who created the alert.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the alert.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date and time when the alert was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the alert was last updated. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1718618400000
          type: integer
          format: int64
        type:
          description: Type of the alert.
          examples:
          - Endpoint Detection
          type: string
        source:
          description: Source system that generated the alert.
          examples:
          - EDR
          type: string
        sourceRef:
          description: Unique reference identifier from the source system.
          examples:
          - MDATP-2025-004512
          type: string
        externalLink:
          description: External URL linking to the alert in the source system.
          examples:
          - https://defender.microsoft.com/alerts/MDATP-2025-004512
          type: string
        title:
          description: Short title describing the alert.
          examples:
          - File encrypted on CORP-LAPTOP-056
          type: string
        description:
          description: Full description of the alert.
          examples:
          - File encryption detected via PowerShell script (encrypt.ps1) on CORP-LAPTOP-056.
          type: string
        severity:
          description: 'Numeric severity level of the alert: 1 (Low), 2 (Medium),
            3 (High), 4 (Critical).'
          examples:
          - 3
          type: integer
          format: int32
        severityLabel:
          description: Human-readable severity label.
          examples:
          - HIGH
          type: string
        date:
          description: Date and time of the event that triggered the alert, as a Unix
            timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        tags:
          description: Tags assigned to the alert.
          examples:
          - - TheOrganization
            - threat-type:file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
        tlp:
          description: 'Numeric Traffic Light Protocol (TLP) level: 0 (Clear), 1 (Green),
            2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        tlpLabel:
          description: Human-readable TLP label.
          examples:
          - AMBER
          type: string
        pap:
          description: 'Numeric Permissible Actions Protocol (PAP) level: 0 (Clear),
            1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        papLabel:
          description: Human-readable PAP label.
          examples:
          - AMBER
          type: string
        follow:
          description: Whether the alert is being followed for change notifications.
          examples:
          - true
          type: boolean
        customFields:
          description: Custom field values attached to the alert.
          type: array
          items:
            $ref: '#/components/schemas/OutputCustomFieldValue'
        caseTemplate:
          description: Name of the case template used when creating a case from this
            alert.
          examples:
          - Ransomware Investigation
          type: string
        observableCount:
          description: Number of observables attached to the alert.
          examples:
          - 7
          type: integer
          format: int64
        caseId:
          description: ID of the case created from or linked to this alert.
          examples:
          - ~216513541
          type: string
        status:
          description: Current status of the alert.
          examples:
          - New
          type: string
        stage:
          description: Stage derived from the alert status.
          examples:
          - New
          type: string
        assignee:
          description: Login of the user assigned to the alert.
          examples:
          - lucas@example.com
          type: string
        summary:
          description: Brief summary of the triage findings.
          examples:
          - File encryption detected via PowerShell on three workstations.
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
        newDate:
          description: Date when the alert first entered a status linked to the *New*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        inProgressDate:
          description: Date when the alert first entered a status linked to the *In
            Progress* stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1718618400000
          type: integer
          format: int64
        closedDate:
          description: Date when the alert first entered a status linked to the *Closed*
            stage because no further investigation was required. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1718704800000
          type: integer
          format: int64
        importedDate:
          description: Date when the alert first entered the *Imported* status. This
            occurs when the alert is merged into a new or existing case for investigation.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1718618400000
          type: integer
          format: int64
        timeToDetect:
          description: '[Time to Detect (TTD)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-detect-ttd),
            in milliseconds.'
          examples:
          - 0
          type: integer
          format: int64
        timeToTriage:
          description: '[Time to Triage (TTT)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-triage-ttt),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToQualify:
          description: '[Time to Qualify (TTQ)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-qualify-ttq),
            in milliseconds.'
          examples:
          - 86400000
          type: integer
          format: int64
        timeToAcknowledge:
          description: '[Time to Acknowledge (TTA)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-acknowledge-tta),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
    OutputAlertFeeder:
      title: OutputAlertFeeder
      type: object
      required:
      - name
      - description
      - method
      - url
      - interval
      - function
      - enabled
      - requestTimeout
      - responseMaxSize
      properties:
        name:
          description: Name of the alert feeder.
          examples:
          - airtable-incidents-feeder
          type: string
          maxLength: 128
          minLength: 1
        description:
          description: Description of the alert feeder.
          examples:
          - Retrieves security incidents from Airtable every hour and converts them
            to alerts.
          type: string
          maxLength: 1048576
        method:
          $ref: '#/components/schemas/Method'
          description: HTTP method used when requesting data from the external system.
        url:
          description: Endpoint URL of the external system.
          examples:
          - https://api.airtable.com/v0/appXXXXXXXXXXXXXX/tblXXXXXXXXXXXXXX
          type: string
          format: url
        interval:
          $ref: '#/components/schemas/Interval'
          description: Polling interval.
        function:
          $ref: '#/components/schemas/OutputFunction'
          description: Feeder function that converts the HTTP response into alerts.
        headers:
          description: HTTP headers included in the request.
          type: array
          items:
            $ref: '#/components/schemas/Header'
        auth:
          $ref: '#/components/schemas/OutputAuth'
        body:
          description: HTTP request body sent with the request.
          examples:
          - maxRecords: 100
          type: string
        enabled:
          description: Whether the alert feeder is active and runs on schedule.
          examples:
          - true
          type: boolean
        requestTimeout:
          $ref: '#/components/schemas/Interval'
          description: Maximum time to wait for the external system to respond.
        responseMaxSize:
          description: Maximum response payload size in bytes.
          examples:
          - 10485760
          type: integer
          format: int64
          exclusiveMinimum: 0
        proxyConfig:
          $ref: '#/components/schemas/ClientProxyWSConfigDto'
          description: Proxy configuration for the HTTP request.
    OutputAlertStatus:
      title: OutputAlertStatus
      type: object
      required:
      - _id
      - _type
      - _createdAt
      - _createdBy
      - value
      - stage
      - hidden
      - extraData
      properties:
        _id:
          description: Unique identifier of the alert status.
          examples:
          - ~84123
          type: string
        _type:
          description: Object type, always `AlertStatus`.
          examples:
          - AlertStatus
          type: string
        _updatedAt:
          description: Date and time of the last update, as a Unix timestamp in milliseconds.
          examples:
          - 1718723423000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the status.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time the status was created, as a Unix timestamp in
            milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who created the status.
          examples:
          - emma@example.com
          type: string
        value:
          description: Display name of the alert status.
          examples:
          - FalsePositive
          type: string
        stage:
          description: Stage the status belongs to. One of *New*, *In progress*, *Closed*,
            or *Imported*.
          examples:
          - Closed
          type: string
        order:
          description: Position of the status in the UI dropdown list.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: Human-readable description of the status.
          examples:
          - Alert was analyzed and confirmed as a false positive.
          type: string
        colour:
          description: Hex color code used to display the status in the UI.
          examples:
          - '#52c41a'
          type: string
        hidden:
          description: Whether the status is hidden from the UI dropdown. Hidden statuses
            remain accessible through the API.
          examples:
          - false
          type: boolean
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputAnalyzerTemplate:
      title: OutputAnalyzerTemplate
      type: object
      required:
      - id
      - analyzerId
      - content
      properties:
        id:
          description: Internal unique identifier of the analyzer template.
          examples:
          - ~360448
          type: string
        analyzerId:
          description: Name of the analyzer the template renders reports for, matching
            the `name` field returned by `GET /api/v1/connector/cortex/analyzer`.
          examples:
          - VirusTotal_GetReport
          type: string
        content:
          description: HTML content that defines how the analyzer's reports are displayed.
          examples:
          - <div class="panel-content">{{summary.taxonomies}}</div>
          type: string
    OutputAttachment:
      title: OutputAttachment
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - name
      - hashes
      - size
      - contentType
      - id
      - path
      - extraData
      - external
      properties:
        _id:
          description: Internal unique identifier of the attachment.
          examples:
          - ~456789012
          type: string
        _type:
          description: Entity type, always `Attachment`.
          examples:
          - Attachment
          type: string
        _createdBy:
          description: Login of the user who uploaded the attachment.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the attachment.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date and time when the attachment was uploaded. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the attachment was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        name:
          description: File name of the attachment.
          examples:
          - encrypt.ps1
          type: string
        hashes:
          description: Cryptographic hashes of the file.
          examples:
          - - e5c67f1d2e6f8b3a4c1f2b7d9a0e8c6d
            - 2b4f6dacb1e3f5a7c9d0e2b4f6dacb1e
          type: array
          items:
            type: string
        size:
          description: Size of the file in bytes.
          examples:
          - 2048
          type: integer
          format: int64
        contentType:
          description: MIME content type of the file.
          examples:
          - application/x-powershell
          type: string
        id:
          description: Unique storage identifier of the file content.
          examples:
          - a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
          type: string
        path:
          description: Storage path of the file in the configured backend.
          examples:
          - attachments/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
        external:
          description: Whether the attachment is accessible to external users with
            [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Platinum or One license required.
          examples:
          - false
          type: boolean
    OutputAttachments:
      title: OutputAttachments
      type: object
      required:
      - attachments
      properties:
        attachments:
          description: List of attachments created by the upload.
          type: array
          items:
            $ref: '#/components/schemas/OutputAttachment'
    OutputAudit:
      title: OutputAudit
      description: Audit log entry describing the change.
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - action
      - requestId
      - rootId
      - details
      - mainAction
      properties:
        _id:
          description: Internal unique identifier of the audit log entry.
          examples:
          - ~327684328
          type: string
        _type:
          description: Entity type, always `Audit`.
          examples:
          - Audit
          type: string
        _createdBy:
          description: Email address of the user who performed the action.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Email address of the user who last updated the audit log entry.
            Audit log entries are immutable, so this field is always absent.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the action occurred. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1694441999960
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the audit log entry was last updated. Audit
            log entries are immutable, so this field is always absent.
          examples:
          - 1640000000000
          type: integer
          format: int64
        action:
          description: 'Type of action recorded by this entry: `create`, `update`,
            `delete`, `merge`, or `invoke` for a function call.'
          examples:
          - update
          type: string
        requestId:
          description: Unique identifier of the HTTP request that triggered the audit
            entry. Every audit entry generated by the same request shares this value.
          examples:
          - 74dc37479904ebe7:3957d351:18a847d4266:-8000:109
          type: string
        rootId:
          description: Identifier of the parent object. For example, the case identifier
            when a task is modified.
          examples:
          - ~327925760
          type: string
        details:
          description: Modified fields and their new values.
          examples:
          - status: InProgress
            stage: InProgress
          type: object
        objectId:
          description: Identifier of the directly affected object.
          examples:
          - ~327925760
          type: string
        objectType:
          description: Type of the directly affected object.
          examples:
          - Case
          type: string
        object:
          description: Complete state of the affected object as it is now, not as
            it was at the time of the action. Absent if the object has since been
            deleted.
          examples:
          - _id: ~327925760
            title: Suspicious network activity detected
            status: InProgress
          type: object
        context:
          description: Complete state of the parent object referenced by `rootId`,
            providing full context for the action. Returned as it is now, not as it
            was at the time of the action. Absent if the parent object has since been
            deleted.
          examples:
          - _id: ~327925760
            title: Suspicious network activity detected
            status: InProgress
          type: object
        mainAction:
          description: Whether this entry is the primary action, as opposed to a derived
            event. For example, an action is derived when it also affects another
            organization through a sharing rule.
          examples:
          - true
          type: boolean
    OutputAuth:
      title: OutputAuth
      description: Authentication configuration.
      oneOf:
      - $ref: '#/components/schemas/BasicOutputAuth'
      - $ref: '#/components/schemas/BearerOutputAuth'
      - $ref: '#/components/schemas/KeyOutputAuth'
      - $ref: '#/components/schemas/NoneOutputAuth'
      - $ref: '#/components/schemas/OAuth2OutputAuth'
      discriminator:
        propertyName: type
        mapping:
          basic: '#/components/schemas/BasicOutputAuth'
          bearer: '#/components/schemas/BearerOutputAuth'
          key: '#/components/schemas/KeyOutputAuth'
          none: '#/components/schemas/NoneOutputAuth'
          oauth2: '#/components/schemas/OAuth2OutputAuth'
    OutputBranding:
      title: OutputBranding
      type: object
      properties:
        title:
          description: Title shown in the browser tab instead of TheHive.
          examples:
          - TheOrganization
          type: string
        loginLogo:
          description: Relative URL to the login page logo. Use `GET /api/v1/branding/assets/loginLogo`
            to retrieve the image.
          examples:
          - api/v1/branding/assets/loginLogo
          type: string
        menuLogo:
          description: Relative URL to the navigation bar logo. Use `GET /api/v1/branding/assets/menuLogo`
            to retrieve the image.
          examples:
          - api/v1/branding/assets/menuLogo
          type: string
        favicon:
          description: Relative URL to the browser tab favicon. Use `GET /api/v1/branding/assets/favicon`
            to retrieve the image.
          examples:
          - api/v1/branding/assets/favicon
          type: string
    OutputCase:
      title: OutputCase
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - number
      - title
      - description
      - severity
      - severityLabel
      - startDate
      - flag
      - tlp
      - tlpLabel
      - pap
      - papLabel
      - status
      - stage
      - access
      - extraData
      - newDate
      - timeToDetect
      properties:
        _id:
          description: Internal unique identifier of the case.
          examples:
          - ~123456789
          type: string
        _type:
          description: Entity type, always `Case`.
          examples:
          - Case
          type: string
        _createdBy:
          description: Login of the user who created the case.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the case.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the case was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the case was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        number:
          description: An incremental number to reference the case. This field can
            be used in the API in place of `_id`.
          examples:
          - 42
          type: integer
          format: int32
        title:
          description: Title of the case.
          examples:
          - Suspicious Ransomware Activity
          type: string
        description:
          description: Details of the case.
          examples:
          - File encryption via PowerShell script detected on multiple workstations.
          type: string
        severity:
          description: 'Numeric severity level: 1 (Low), 2 (Medium), 3 (High), 4 (Critical).'
          examples:
          - 3
          type: integer
          format: int32
        severityLabel:
          description: Human-readable severity label.
          examples:
          - HIGH
          type: string
        startDate:
          description: Start date of the incident. Returned as a Unix timestamp in
            milliseconds.
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: End date of the incident. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: Tags assigned to the case.
          examples:
          - - TheOrganization
            - file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
        flag:
          description: Whether the case is flagged for quick filtering.
          examples:
          - false
          type: boolean
        tlp:
          description: 'Numeric Traffic Light Protocol (TLP) level: 0 (Clear), 1 (Green),
            2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        tlpLabel:
          description: Human-readable TLP label.
          examples:
          - AMBER
          type: string
        pap:
          description: 'Numeric Permissible Actions Protocol (PAP) level: 0 (Clear),
            1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        papLabel:
          description: Human-readable PAP label.
          examples:
          - AMBER
          type: string
        status:
          description: Current status of the case.
          examples:
          - New
          type: string
        stage:
          description: Stage derived from the case status. One of *New*, *InProgress*,
            or *Closed*.
          examples:
          - New
          type: string
        summary:
          description: Brief summary of the investigation findings.
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
        impactStatus:
          description: Verdict on whether the incident had real consequences for the
            organization. Only set when the case is closed with a status that requires
            an impact. One of `WithImpact`, `NoImpact`, or `NotApplicable`.
          examples:
          - NotApplicable
          type: string
        assignee:
          description: Login of the user assigned to the case.
          examples:
          - lucas@example.com
          type: string
        access:
          $ref: '#/components/schemas/Access'
          description: Access control settings of the case.
        customFields:
          description: Custom field values set on the case.
          type: array
          items:
            $ref: '#/components/schemas/OutputCustomFieldValue'
        userPermissions:
          description: Permissions the current user has on this case, based on their
            profile and the case sharing configuration.
          examples:
          - - manageCase/create
            - manageAlert/update
            - manageCaseTemplate
            - manageProcedure
          type: array
          items:
            type: string
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
        newDate:
          description: Date when the case first entered a status linked to the *New*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        inProgressDate:
          description: Date when the case first entered a status linked to the *In
            Progress* stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        closedDate:
          description: Date when the case first entered a status linked to the *Closed*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertDate:
          description: The date the incident occurred according to the earliest linked
            alert. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertNewDate:
          description: Date when the earliest linked alert first entered the *New*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertInProgressDate:
          description: Date when the earliest linked alert first entered the *In Progress*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertImportedDate:
          description: Date when the earliest linked alert was imported into a case.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        timeToDetect:
          description: '[Time to Detect (TTD)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-detect-ttd),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToTriage:
          description: '[Time to Triage (TTT)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-triage-ttt),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToQualify:
          description: '[Time to Qualify (TTQ)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-qualify-ttq),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToAcknowledge:
          description: '[Time to Acknowledge (TTA)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-acknowledge-tta),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToResolve:
          description: '[Time to Resolve (TTR)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-resolve-ttr),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        handlingDuration:
          description: '[Handling duration](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-resolve-ttr),
            in milliseconds.'
          examples:
          - 86400000
          type: integer
          format: int64
    OutputCaseReport:
      title: OutputCaseReport
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - contentType
      - size
      - filename
      properties:
        _id:
          description: Internal unique identifier of the case report.
          examples:
          - ~84512
          type: string
        _type:
          description: Entity type, always `CaseReport`.
          examples:
          - CaseReport
          type: string
        _createdBy:
          description: Login of the user who created the case report.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the case report.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time when the case report was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1716414900000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the case report was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1716415200000
          type: integer
          format: int64
        contentType:
          description: MIME type of the report file.
          examples:
          - text/html
          type: string
        size:
          description: Size of the report file in bytes.
          examples:
          - 245760
          type: integer
          format: int64
        filename:
          description: Name of the report file.
          examples:
          - Case#42 Incident Report 2025-05-22.html
          type: string
    OutputCaseReportTemplate:
      title: OutputCaseReportTemplate
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - title
      - group
      - description
      - version
      - definition
      properties:
        _id:
          description: Unique identifier of the case report template.
          examples:
          - ~42123
          type: string
        _type:
          description: Entity type, always `caseReportTemplate`.
          examples:
          - caseReportTemplate
          type: string
        _createdBy:
          description: Login of the user who created the template.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the template.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date and time when the template was created. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the template was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1718618400000
          type: integer
          format: int64
        title:
          description: Title of the case report template.
          examples:
          - Ransomware Investigation Report
          type: string
        group:
          description: Group label used to categorize the template.
          examples:
          - Incident Response
          type: string
        description:
          description: Brief summary of the template's purpose and contents.
          examples:
          - Standard template for ransomware incident investigations.
          type: string
        version:
          description: Version number of the template.
          examples:
          - 1
          type: integer
          format: int32
        definition:
          $ref: '#/components/schemas/CaseReportTemplateDefinition'
          description: 'Structure defining the template''s layout: widgets, header,
            footer, date formats, and language.'
    OutputCaseReportTemplateObjects:
      title: OutputCaseReportTemplateObjects
      type: object
      properties:
        widgets:
          description: Available widget types for use in case report templates.
          examples:
          - - Text
            - Image
            - CustomFields
            - ObservableTable
            - TaskTable
          type: array
          items:
            $ref: '#/components/schemas/Kind'
        alertFields:
          description: Available alert fields for use in alert widgets.
          examples:
          - - _id
            - title
            - severity
            - status
          type: array
          items:
            $ref: '#/components/schemas/AlertField'
        observableFields:
          description: Available observable fields for use in observable widgets.
          examples:
          - - dataType
            - data
            - tlp
          type: array
          items:
            $ref: '#/components/schemas/ObservableField'
        taskFields:
          description: Available task fields for use in task widgets.
          examples:
          - - title
            - status
            - assignee
          type: array
          items:
            $ref: '#/components/schemas/TaskField'
        ttpFields:
          description: Available TTP fields for use in TTP widgets.
          examples:
          - - tactic
            - patternId
            - description
          type: array
          items:
            $ref: '#/components/schemas/TTPField'
        logFields:
          description: Available task log fields for use in task list widgets.
          examples:
          - - message
            - date
            - createdBy
          type: array
          items:
            $ref: '#/components/schemas/LogField'
        timelineEvents:
          description: Available event types for use in timeline widgets.
          examples:
          - - Alert
            - Case
            - Task
            - Observable
          type: array
          items:
            $ref: '#/components/schemas/TimelineEvents'
    OutputCaseStatus:
      title: OutputCaseStatus
      type: object
      required:
      - _id
      - _type
      - _createdAt
      - _createdBy
      - value
      - stage
      - hidden
      - requiresImpact
      - extraData
      properties:
        _id:
          description: Unique identifier of the case status.
          examples:
          - ~84123
          type: string
        _type:
          description: Object type, always `CaseStatus`.
          examples:
          - CaseStatus
          type: string
        _updatedAt:
          description: Date and time of the last update, as a Unix timestamp in milliseconds.
          examples:
          - 1718723423000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the status.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time the status was created, as a Unix timestamp in
            milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who created the status.
          examples:
          - emma@example.com
          type: string
        value:
          description: Display name of the case status.
          examples:
          - Contained
          type: string
        stage:
          description: Stage the status belongs to. One of *New*, *In progress*, or
            *Closed*.
          examples:
          - InProgress
          type: string
        order:
          description: Position of the status in the UI dropdown list.
          examples:
          - 2
          type: integer
          format: int32
        description:
          description: Human-readable description of the status.
          examples:
          - Case has been contained but investigation continues.
          type: string
        colour:
          description: Hex color code used to display the status in the UI.
          examples:
          - '#ffa940'
          type: string
        hidden:
          description: Whether the status is hidden from the UI dropdown. Hidden statuses
            remain accessible through the API.
          examples:
          - false
          type: boolean
        requiresImpact:
          description: Whether closing a case with this status requires an `impactStatus`.
          examples:
          - false
          type: boolean
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputCaseTemplate:
      title: OutputCaseTemplate
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - name
      - displayName
      - flag
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the case template.
          examples:
          - ~84123
          type: string
        _type:
          description: Entity type, always `caseTemplate`.
          examples:
          - caseTemplate
          type: string
        _createdBy:
          description: Login of the user who created the case template.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the case template.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the case template was created. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1748476800000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the case template was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        name:
          description: Unique name of the case template within the organization.
          examples:
          - Ransomware Response
          type: string
        displayName:
          description: Name shown to users when selecting this template.
          examples:
          - Ransomware Response
          type: string
        titlePrefix:
          description: Prefix automatically added to case titles when the template
            is applied.
          examples:
          - RAN-
          type: string
        description:
          description: Default description for cases.
          examples:
          - |-
            ## Summary

            Ransomware infection detected. Containment and eradication required.
          type: string
        severity:
          description: Default severity level for cases.
          examples:
          - 3
          type: integer
          format: int32
        severityLabel:
          description: Human-readable label for the severity level.
          examples:
          - HIGH
          type: string
        tags:
          description: Default tags for cases.
          examples:
          - - ransomware
            - TheOrganization
          type: array
          uniqueItems: true
          items:
            type: string
        flag:
          description: Whether cases are flagged as important by default.
          examples:
          - false
          type: boolean
        tlp:
          description: Default [Traffic Light Protocol (TLP)](https://www.misp-project.org/taxonomies.html#_tlp)
            level for cases.
          examples:
          - 2
          type: integer
          format: int32
        tlpLabel:
          description: Human-readable label for the TLP level.
          examples:
          - AMBER
          type: string
        pap:
          description: Default [Permissible Actions Protocol (PAP)](https://www.misp-project.org/taxonomies.html#_pap)
            level for cases.
          examples:
          - 2
          type: integer
          format: int32
        papLabel:
          description: Human-readable label for the PAP level.
          examples:
          - AMBER
          type: string
        summary:
          description: Default summary for cases.
          examples:
          - Ransomware case opened following detection of file encryption activity.
          type: string
        customFields:
          type: array
          items:
            $ref: '#/components/schemas/OutputCustomFieldValue'
        tasks:
          type: array
          items:
            $ref: '#/components/schemas/OutputTask'
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputCaseWithLinks:
      title: OutputCaseWithLinks
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - number
      - title
      - description
      - severity
      - severityLabel
      - startDate
      - flag
      - tlp
      - tlpLabel
      - pap
      - papLabel
      - status
      - stage
      - access
      - extraData
      - newDate
      - timeToDetect
      - linksCount
      properties:
        _id:
          description: Internal unique identifier of the case.
          examples:
          - ~123456789
          type: string
        _type:
          description: Entity type, always `Case`.
          examples:
          - Case
          type: string
        _createdBy:
          description: Login of the user who created the case.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the case.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the case was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the case was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        number:
          description: An incremental number to reference the case. This field can
            be used in the API in place of `_id`.
          examples:
          - 42
          type: integer
          format: int32
        title:
          description: Title of the case.
          examples:
          - Suspicious Ransomware Activity
          type: string
        description:
          description: Details of the case.
          examples:
          - File encryption via PowerShell script detected on multiple workstations.
          type: string
        severity:
          description: 'Numeric severity level: 1 (Low), 2 (Medium), 3 (High), 4 (Critical).'
          examples:
          - 3
          type: integer
          format: int32
        severityLabel:
          description: Human-readable severity label.
          examples:
          - HIGH
          type: string
        startDate:
          description: Start date of the incident. Returned as a Unix timestamp in
            milliseconds.
          examples:
          - 1748736000000
          type: integer
          format: int64
        endDate:
          description: End date of the incident. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748995200000
          type: integer
          format: int64
        tags:
          description: Tags assigned to the case.
          examples:
          - - TheOrganization
            - file-encryption
          type: array
          uniqueItems: true
          items:
            type: string
        flag:
          description: Whether the case is flagged for quick filtering.
          examples:
          - false
          type: boolean
        tlp:
          description: 'Numeric Traffic Light Protocol (TLP) level: 0 (Clear), 1 (Green),
            2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        tlpLabel:
          description: Human-readable TLP label.
          examples:
          - AMBER
          type: string
        pap:
          description: 'Numeric Permissible Actions Protocol (PAP) level: 0 (Clear),
            1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        papLabel:
          description: Human-readable PAP label.
          examples:
          - AMBER
          type: string
        status:
          description: Current status of the case.
          examples:
          - New
          type: string
        stage:
          description: Stage derived from the case status. One of *New*, *InProgress*,
            or *Closed*.
          examples:
          - New
          type: string
        summary:
          description: Brief summary of the investigation findings.
          examples:
          - File encryption via PowerShell script (encrypt.ps1) on multiple workstations.
            Propagation detected before isolation. 632 files encrypted.
          type: string
        impactStatus:
          description: Verdict on whether the incident had real consequences for the
            organization. Only set when the case is closed with a status that requires
            an impact. One of `WithImpact`, `NoImpact`, or `NotApplicable`.
          examples:
          - NotApplicable
          type: string
        assignee:
          description: Login of the user assigned to the case.
          examples:
          - lucas@example.com
          type: string
        access:
          $ref: '#/components/schemas/Access'
          description: Access control settings of the case.
        customFields:
          description: Custom field values set on the case.
          type: array
          items:
            $ref: '#/components/schemas/OutputCustomFieldValue'
        userPermissions:
          description: Permissions the current user has on this case, based on their
            profile and the case sharing configuration.
          examples:
          - - manageCase/create
            - manageAlert/update
            - manageCaseTemplate
            - manageProcedure
          type: array
          items:
            type: string
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
        newDate:
          description: Date when the case first entered a status linked to the *New*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        inProgressDate:
          description: Date when the case first entered a status linked to the *In
            Progress* stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        closedDate:
          description: Date when the case first entered a status linked to the *Closed*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertDate:
          description: The date the incident occurred according to the earliest linked
            alert. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertNewDate:
          description: Date when the earliest linked alert first entered the *New*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertInProgressDate:
          description: Date when the earliest linked alert first entered the *In Progress*
            stage. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        alertImportedDate:
          description: Date when the earliest linked alert was imported into a case.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        timeToDetect:
          description: '[Time to Detect (TTD)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-detect-ttd),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToTriage:
          description: '[Time to Triage (TTT)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-triage-ttt),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToQualify:
          description: '[Time to Qualify (TTQ)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-qualify-ttq),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToAcknowledge:
          description: '[Time to Acknowledge (TTA)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-acknowledge-tta),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        timeToResolve:
          description: '[Time to Resolve (TTR)](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-resolve-ttr),
            in milliseconds.'
          examples:
          - 3600000
          type: integer
          format: int64
        handlingDuration:
          description: '[Handling duration](https://docs.strangebee.com/thehive/user-guides/key-performance-indicators/key-performance-indicators/#time-to-resolve-ttr),
            in milliseconds.'
          examples:
          - 86400000
          type: integer
          format: int64
        linkedWith:
          description: Observables shared between this case and the similar case.
          type: array
          items:
            $ref: '#/components/schemas/OutputObservable'
        linksCount:
          description: Number of observables shared between this case and the similar
            case.
          examples:
          - 1
          type: integer
          format: int32
    OutputCatalogOfPattern:
      title: OutputCatalogOfPattern
      type: object
      required:
      - _id
      - _type
      - createdBy
      - createdAt
      - name
      - extraData
      properties:
        _id:
          description: Unique identifier of the catalog.
          examples:
          - ~81920
          type: string
        _type:
          description: Entity type, always "CatalogOfPattern".
          examples:
          - CatalogOfPattern
          type: string
        createdBy:
          description: Login of the user who created the catalog.
          examples:
          - admin@example.com
          type: string
        createdAt:
          description: Date and time when the catalog was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1722513600000
          type: integer
          format: int64
        updatedAt:
          description: Date and time when the catalog was last updated. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748995200000
          type: integer
          format: int64
        name:
          description: Name of the catalog.
          examples:
          - Enterprise Attack
          type: string
        description:
          description: Description of the catalog.
          examples:
          - Covers all standard enterprise-level attack techniques from the MITRE
            ATT&CK framework.
          type: string
        variant:
          description: Variant identifier of the catalog, such as a date or matrix
            name.
          examples:
          - '2025-04-15'
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputComment:
      title: OutputComment
      type: object
      required:
      - _id
      - _type
      - createdBy
      - createdAt
      - message
      - isEdited
      - extraData
      - external
      properties:
        _id:
          description: Unique identifier of the comment.
          examples:
          - ~843456789
          type: string
        _type:
          description: Entity type, always `Comment`.
          examples:
          - Comment
          type: string
        createdBy:
          description: Login of the user who created the comment.
          examples:
          - lucas@example.com
          type: string
        createdAt:
          description: Date and time when the comment was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1747214591000
          type: integer
          format: int64
        updatedAt:
          description: Date and time when the comment was last updated. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1747218191000
          type: integer
          format: int64
        updatedBy:
          description: Login of the user who last updated the comment.
          examples:
          - emma@example.com
          type: string
        message:
          description: Text of the comment.
          examples:
          - Confirmed as ransomware. Containment measures initiated.
          type: string
        isEdited:
          description: Whether the comment has been edited since it was created.
          examples:
          - false
          type: boolean
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
        external:
          description: Whether the comment is visible to external users through TheHive
            Portal.
          examples:
          - false
          type: boolean
    OutputConfig:
      title: OutputConfig
      type: object
      required:
      - path
      - defaultValue
      - value
      properties:
        path:
          description: Key of the configuration item.
          examples:
          - dashboards
          type: string
        defaultValue:
          description: Default value of the configuration item, returned when you
            haven't set an override.
          examples:
          - []
        value:
          description: 'Current value of the configuration item: your override if
            you''ve set one, otherwise the default value.'
          examples:
          - ~7741591688:
              period: Last7Days
              refresh: 30
    OutputContextDocumentation:
      title: OutputContextDocumentation
      type: object
      properties:
        items:
          description: Context items (fields and methods) available in the function
            execution environment.
          type: array
          items:
            $ref: '#/components/schemas/OutputContextDocumentationItem'
    OutputContextDocumentationItem:
      title: OutputContextDocumentationItem
      type: object
      required:
      - name
      - kind
      properties:
        name:
          description: Name of the context field or method.
          examples:
          - alert
          type: string
        kind:
          $ref: '#/components/schemas/OutputContextDocumentationItemKind'
        args:
          description: Parameter names accepted by the method. Present only when `kind`
            is `Method`.
          examples:
          - - alertData
          type: array
          items:
            type: string
    OutputContextDocumentationItemKind:
      title: OutputContextDocumentationItemKind
      description: Whether this item is a field or a method.
      examples:
      - Field
      type: string
      enum:
      - Field
      - Method
    OutputCustomEvent:
      title: OutputCustomEvent
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - date
      - title
      properties:
        _id:
          description: Internal unique identifier of the custom event.
          examples:
          - ~24568324
          type: string
        _type:
          description: Entity type, always `CustomEvent`.
          examples:
          - CustomEvent
          type: string
        _createdBy:
          description: Login of the user who created the custom event.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the custom event.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time when the custom event was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1737020400000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the custom event was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1737025800000
          type: integer
          format: int64
        date:
          description: Start date of the custom event. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1737020400000
          type: integer
          format: int64
        endDate:
          description: End date of the custom event. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1737025800000
          type: integer
          format: int64
        title:
          description: Title of the custom event.
          examples:
          - Ransom demand received via email
          type: string
        description:
          description: Brief description of the custom event.
          examples:
          - Attacker sent a ransom demand to the security team requesting payment
            in exchange for the decryption key.
          type: string
    OutputCustomField:
      title: OutputCustomField
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - name
      - displayName
      - group
      - description
      - type
      - options
      - mandatory
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the custom field.
          examples:
          - ~123456789
          type: string
        _type:
          description: Entity type, always `customField`.
          examples:
          - customField
          type: string
        _createdBy:
          description: Login of the user who created the custom field.
          examples:
          - emma@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the custom field.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time when the custom field was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1735732800000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the custom field was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1735732800000
          type: integer
          format: int64
        name:
          description: Technical name of the custom field.
          examples:
          - threat-type
          type: string
        displayName:
          description: Display name of the custom field.
          examples:
          - Threat Type
          type: string
        group:
          description: Group of the custom field.
          examples:
          - Classification
          type: string
        description:
          description: Description of the custom field.
          examples:
          - Type of threat detected in the case.
          type: string
        type:
          $ref: '#/components/schemas/CustomFieldType'
          description: Type of the custom field.
        options:
          description: Predefined selectable values of the custom field.
          examples:
          - - Malware
            - Intrusion
            - Data Leak
          oneOf:
          - type: array
            items:
              type: integer
              format: int32
          - type: array
            items:
              type: number
              format: double
          - type: array
            items:
              type: string
        mandatory:
          description: Whether the field must be filled in before the case or alert
            can be closed.
          examples:
          - true
          type: boolean
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
    OutputCustomFieldValue:
      title: OutputCustomFieldValue
      type: object
      required:
      - _id
      - name
      - type
      - value
      - order
      properties:
        _id:
          description: Internal unique identifier of the custom field.
          examples:
          - ~123456789
          type: string
        name:
          description: Name of the custom field.
          examples:
          - threat-type
          type: string
        type:
          description: Type of the custom field.
          examples:
          - string
          type: string
        value:
          description: Value of the custom field. The type depends on the custom field
            definition.
          examples:
          - Malware
        order:
          description: Display order of the custom field value.
          examples:
          - 0
          type: integer
          format: int32
    OutputDashboard:
      title: OutputDashboard
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - title
      - group
      - description
      - status
      - definition
      - writable
      - version
      properties:
        _id:
          description: Id of the dashboard.
          examples:
          - ~123456
          type: string
        _type:
          description: Entity type, always `Dashboard`.
          examples:
          - Dashboard
          type: string
        _createdBy:
          description: Login of the user who created the dashboard.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the dashboard.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the dashboard was created. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1749563414000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the dashboard was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1749563414000
          type: integer
          format: int64
        title:
          description: Title of the dashboard.
          examples:
          - Cases overview
          type: string
        group:
          description: Group used to categorize the dashboard on the dashboards list.
          examples:
          - Security operations
          type: string
        description:
          description: Description of the dashboard.
          examples:
          - Overview of open cases across the organization, grouped by severity and
            status.
          type: string
        status:
          description: 'Visibility of the dashboard: `Private` or `Shared` with the
            entire organization.'
          examples:
          - Shared
          type: string
        owner:
          description: Login of the dashboard owner.
          examples:
          - lucas@example.com
          type: string
        definition:
          description: |-
            Widget layout and configuration for the dashboard,
            structured as rows of widgets.
          examples:
          - period: last3Months
            items:
            - type: container
              items:
              - id: wdgt-1a2b3c
                type: counter
                options:
                  title: Open cases
                  entity: case
                  periodDateField: _createdAt
                  filters: []
                  series:
                  - agg: count
                    type: bar
                    query: {}
                    label: Open cases
          type: object
        writable:
          description: Whether the current user can update or delete this dashboard.
          examples:
          - true
          type: boolean
        version:
          description: Version of the dashboard definition format.
          examples:
          - 1
          type: integer
          format: int32
    OutputEmailIntake:
      title: OutputEmailIntake
      description: Email intake module configuration, including the enabled status,
        sync interval, and all mailbox configurations.
      type: object
      required:
      - enabled
      - interval
      properties:
        enabled:
          description: Indicates whether the email intake module is globally enabled.
          examples:
          - true
          type: boolean
        interval:
          description: Time interval between automatic email fetch cycles for all
            connected mailboxes.
          examples:
          - 5 minutes
          type: string
        configs:
          description: Mailbox configurations managed by the email intake module.
          type: array
          items:
            $ref: '#/components/schemas/OutputEmailIntakeConfig'
    OutputEmailIntakeAlertProperties:
      title: OutputEmailIntakeAlertProperties
      description: Alert metadata applied to alerts created from emails in this mailbox.
      type: object
      required:
      - type
      - source
      properties:
        type:
          description: Type of the alerts created through the email intake connector.
          examples:
          - email-intake
          type: string
        source:
          description: Source of the alerts created through the email intake connector.
          examples:
          - soc-mailbox
          type: string
        tags:
          description: Tags applied to alerts created through the email intake connector.
          examples:
          - - email-intake
            - source:soc-mailbox
            - office365
          type: array
          items:
            type: string
    OutputEmailIntakeApiMailbox:
      title: OutputEmailIntakeApiMailbox
      type: object
      required:
      - provider
      - credential
      - inbox
      - markAsRead
      - _kind
      properties:
        provider:
          $ref: '#/components/schemas/OutputEmailIntakeApiProvider'
        credential:
          $ref: '#/components/schemas/OutputEmailIntakeCredential'
        inbox:
          description: Folder from which emails are fetched.
          examples:
          - Inbox
          type: string
        archive:
          description: Folder where processed emails are moved after fetching.
          examples:
          - Archive
          type: string
        markAsRead:
          description: Indicates whether processed emails are marked as read after
            fetching.
          examples:
          - false
          type: boolean
        _kind:
          description: Discriminator identifying this as an API-based mailbox configuration.
          examples:
          - api
          type: string
          enum:
          - api
          const: api
    OutputEmailIntakeApiProvider:
      title: OutputEmailIntakeApiProvider
      description: API provider settings.
      type: object
      required:
      - name
      properties:
        name:
          description: Email provider name.
          examples:
          - MSGraph365
          type: string
    OutputEmailIntakeBasicAuth:
      title: OutputEmailIntakeBasicAuth
      description: HTTP Basic authentication credentials when basic auth is configured.
      type: object
      required:
      - password
      properties:
        password:
          description: Password for the mailbox account.
          examples:
          - P@ssw0rd!
          type: string
    OutputEmailIntakeConfig:
      title: OutputEmailIntakeConfig
      type: object
      required:
      - id
      - name
      - mailbox
      - enabled
      - createdAt
      - alertProperties
      properties:
        id:
          description: Unique identifier of the mailbox configuration.
          examples:
          - ~84123
          type: string
        name:
          description: Display name of the mailbox configuration.
          examples:
          - SOC Mailbox - Office 365
          type: string
        mailbox:
          $ref: '#/components/schemas/OutputEmailIntakeMailbox'
        organisations:
          description: Organizations where emails from this mailbox create alerts.
          examples:
          - - TheOrganization
          type: array
          items:
            type: string
        enabled:
          description: Indicates whether this mailbox configuration is active.
          examples:
          - true
          type: boolean
        createdAt:
          description: Creation date of the configuration, as a Unix timestamp in
            milliseconds.
          examples:
          - 1703174400000
          type: integer
          format: int64
        alertProperties:
          $ref: '#/components/schemas/OutputEmailIntakeAlertProperties'
    OutputEmailIntakeCredential:
      title: OutputEmailIntakeCredential
      description: Credentials for the mailbox account.
      type: object
      required:
      - email
      properties:
        email:
          description: Email address or username for the mailbox account.
          examples:
          - emma@example.com
          type: string
        basicAuth:
          $ref: '#/components/schemas/OutputEmailIntakeBasicAuth'
        oAuth2:
          $ref: '#/components/schemas/OutputEmailIntakeOAuth2'
    OutputEmailIntakeImapMailbox:
      title: OutputEmailIntakeImapMailbox
      type: object
      required:
      - provider
      - credential
      - inbox
      - markAsRead
      - _kind
      properties:
        provider:
          $ref: '#/components/schemas/OutputEmailIntakeImapProvider'
        credential:
          $ref: '#/components/schemas/OutputEmailIntakeCredential'
        inbox:
          description: Folder from which emails are fetched.
          examples:
          - Inbox
          type: string
        archive:
          description: Folder where processed emails are moved after fetching.
          examples:
          - Archive
          type: string
        markAsRead:
          description: Indicates whether processed emails are marked as read after
            fetching.
          examples:
          - false
          type: boolean
        _kind:
          description: Discriminator identifying this as an IMAP mailbox configuration.
          examples:
          - imap
          type: string
          enum:
          - imap
          const: imap
    OutputEmailIntakeImapProvider:
      title: OutputEmailIntakeImapProvider
      description: IMAP provider settings.
      type: object
      required:
      - name
      properties:
        name:
          description: Email provider name.
          examples:
          - imap
          type: string
        host:
          description: Hostname of the IMAP server.
          examples:
          - outlook.office365.com
          type: string
        protocol:
          description: IMAP protocol variant.
          examples:
          - imap
          type: string
        port:
          description: Port number for the IMAP server.
          examples:
          - 993
          type: integer
          format: int32
        ssl:
          description: Indicates whether SSL is enabled for the IMAP connection.
          examples:
          - true
          type: boolean
        startTLS:
          description: Indicates whether STARTTLS is enabled for the IMAP connection.
          examples:
          - false
          type: boolean
        checkServerIdentity:
          description: Indicates whether host name verification is enabled for the
            SSL connection.
          examples:
          - true
          type: boolean
        certificates:
          description: PEM certificate authority certificates trusted for the IMAP
            server SSL connection.
          type: array
          items:
            $ref: '#/components/schemas/OutputEmailIntakeSSLCert'
    OutputEmailIntakeMailbox:
      title: OutputEmailIntakeMailbox
      description: Mailbox connection settings.
      oneOf:
      - $ref: '#/components/schemas/OutputEmailIntakeApiMailbox'
      - $ref: '#/components/schemas/OutputEmailIntakeImapMailbox'
      discriminator:
        propertyName: _kind
        mapping:
          api: '#/components/schemas/OutputEmailIntakeApiMailbox'
          imap: '#/components/schemas/OutputEmailIntakeImapMailbox'
    OutputEmailIntakeOAuth2:
      title: OutputEmailIntakeOAuth2
      description: OAuth 2.0 credentials when OAuth 2.0 is configured.
      type: object
      required:
      - clientId
      - secret
      properties:
        clientId:
          description: OAuth 2.0 client ID.
          examples:
          - a1b2c3d4-e5f6-7890-abcd-ef1234567890
          type: string
        tenantId:
          description: Tenant ID from Microsoft Entra ID. Present for Microsoft 365
            and Microsoft Graph API providers.
          examples:
          - f8a9b0c1-d2e3-4f56-7890-abcdef123456
          type: string
        secret:
          description: OAuth 2.0 client secret.
          examples:
          - ~Q8Mxx-client-secret-placeholder
          type: string
        authority:
          description: OAuth 2.0 authority URL.
          examples:
          - https://login.microsoftonline.com/
          type: string
        scopes:
          description: OAuth 2.0 permission scopes.
          examples:
          - - https://mail.google.com/
          type: array
          uniqueItems: true
          items:
            type: string
        authorizationCode:
          description: Authorization code from the Google Workspace OAuth 2.0 consent
            flow.
          examples:
          - 4/0AfJohXm-authorization-code-placeholder
          type: string
    OutputEmailIntakeSSLCert:
      title: OutputEmailIntakeSSLCert
      type: object
      required:
      - data
      properties:
        data:
          description: PEM-encoded certificate data.
          examples:
          - |-
            -----BEGIN CERTIFICATE-----
            ...
            -----END CERTIFICATE-----
          type: string
        type:
          description: Certificate type identifier.
          examples:
          - PEM
          type: string
    OutputExportFieldsMapping:
      title: OutputExportFieldsMapping
      type: object
      required:
      - fieldsByModel
      properties:
        fieldsByModel:
          $ref: '#/components/schemas/Map_Seq_ExportFieldDescription'
    OutputFunction:
      title: OutputFunction
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - name
      - mode
      - definition
      - config
      properties:
        _id:
          description: Unique identifier of the feeder function.
          examples:
          - ~123456789
          type: string
        _type:
          description: Entity type. Always `Function`.
          examples:
          - Function
          type: string
        _createdBy:
          description: Login of the user who created the function.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date and time the function was created.
          examples:
          - 1640000000000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the function.
          examples:
          - lucas@example.com
          type: string
        _updatedAt:
          description: Date and time the function was last updated.
          examples:
          - 1640000000000
          type: integer
          format: int64
        name:
          description: Name of the function.
          examples:
          - airtable-to-alert
          type: string
        mode:
          description: Execution mode of the function.
          examples:
          - enabled
          type: string
        definition:
          description: JavaScript source code of the function.
          examples:
          - function handle(alertFeeder) { return []; }
          type: string
        description:
          description: Description of the function.
          examples:
          - Converts Airtable records into TheHive alerts.
          type: string
        config:
          description: Configuration object passed to the function at runtime.
          examples:
          - {}
          type: object
        lastSuccessDate:
          description: Date and time of the most recent successful execution.
          examples:
          - 1640000000000
          type: integer
          format: int64
        lastSuccessDetails:
          description: Details from the most recent successful execution.
          examples:
          - count: 5
          type: object
        lastErrorDate:
          description: Date and time of the most recent failed execution.
          examples:
          - 1640000000000
          type: integer
          format: int64
        lastErrorDetails:
          description: Details from the most recent failed execution.
          examples:
          - error: HTTP 403 Forbidden
          type: object
        types:
          description: Function types. Includes `feeder:alert` for alert feeder functions.
          examples:
          - - feeder:alert
          type: array
          uniqueItems: true
          items:
            type: string
    OutputImportCase:
      title: OutputImportCase
      type: object
      required:
      - case
      properties:
        case:
          $ref: '#/components/schemas/OutputCase'
          description: The imported case.
        observables:
          description: Observables restored from the archive.
          type: array
          items:
            $ref: '#/components/schemas/OutputObservable'
        procedures:
          description: Procedures (TTPs) restored from the archive.
          type: array
          items:
            $ref: '#/components/schemas/OutputProcedure'
        errors:
          description: Errors encountered during import, if any.
          type: array
          items: {}
    OutputInvokeFunctionBackground:
      title: OutputInvokeFunctionBackground
      type: object
    OutputInvokeFunctionKo:
      title: OutputInvokeFunctionKo
      type: object
      required:
      - errorType
      - errorMessage
      - stdout
      - stderr
      properties:
        errorType:
          description: Error type encountered by the server.
          examples:
          - ScriptException
          type: string
        errorMessage:
          description: Error message describing the execution failure.
          examples:
          - 'ReferenceError: context is not defined'
          type: string
        stdout:
          description: Content of stdout.
          examples:
          - ''
          type: string
        stderr:
          description: Content of stderr.
          examples:
          - |-
            ReferenceError: context is not defined
                at handle (function:1:10)
          type: string
    OutputInvokeFunctionOk:
      title: OutputInvokeFunctionOk
      type: object
      required:
      - result
      - durationMillis
      - stdout
      - stderr
      properties:
        result:
          description: The value returned by the `handle` function
          examples:
          - []
        durationMillis:
          description: Time taken by the function, in milliseconds.
          examples:
          - 42
          type: integer
          format: int64
        stdout:
          description: Content of stdout.
          examples:
          - Fetched 3 records from the external system
          type: string
        stderr:
          description: Content of stderr.
          examples:
          - 'Warning: deprecated API used'
          type: string
    OutputJob:
      title: OutputJob
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - analyzerId
      - analyzerName
      - analyzerDefinition
      - status
      - startDate
      - cortexId
      - cortexJobId
      - id
      - operations
      properties:
        _id:
          description: Internal unique identifier of the job.
          examples:
          - ~380928
          type: string
        _type:
          description: Entity type, always `case_artifact_job`.
          examples:
          - case_artifact_job
          type: string
        _createdBy:
          description: Login of the user who launched the job.
          examples:
          - emma@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the job.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the job was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the job was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1748739605000
          type: integer
          format: int64
        analyzerId:
          description: ID of the analyzer that ran.
          examples:
          - 220483fde9608c580fb6a2508ff3d2d3
          type: string
        analyzerName:
          description: Display name of the analyzer that ran.
          examples:
          - VirusTotal_GetReport
          type: string
        analyzerDefinition:
          description: Definition of the analyzer that ran, as returned by Cortex.
          examples:
          - name: VirusTotal_GetReport_3_0
            version: '3.0'
          type: string
        status:
          description: Status of the job. One of `Waiting`, `InProgress`, `Success`,
            `Failure`, or `Deleted`.
          examples:
          - Success
          type: string
        startDate:
          description: Date and time when the job started. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        endDate:
          description: Date and time when the job finished. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1748739605000
          type: integer
          format: int64
        report:
          description: Cortex analysis report for the job, once the analyzer has completed.
          type: object
        cortexId:
          description: Name of the Cortex server the analyzer ran on.
          examples:
          - Cortex1
          type: string
        cortexJobId:
          description: ID of the corresponding job on the Cortex server.
          examples:
          - AWmX6HGxi3s3zwsBQJer
          type: string
        id:
          description: Internal unique identifier of the job, identical to `_id`.
          examples:
          - ~380928
          type: string
        case_artifact:
          description: The observable the job analyzed.
          type: object
        operations:
          description: Serialized JSON array of follow-up operations produced by the
            analyzer report.
          examples:
          - []
          type: string
    OutputLicense:
      title: OutputLicense
      type: object
      required:
      - _id
      - _createdAt
      - _createdBy
      - _type
      - id
      - customer
      - plan
      - kind
      - validFrom
      - expiresAt
      - current
      - quotas
      properties:
        _id:
          description: Internal ID of the license.
          examples:
          - ~84123
          type: string
        _createdAt:
          description: Date the license was added to TheHive, as a Unix timestamp
            in milliseconds.
          examples:
          - 1736849400000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who added the license.
          examples:
          - lucas@example.com
          type: string
        _type:
          description: Entity type. Always `License`.
          examples:
          - License
          type: string
        id:
          description: License identifier from the license file.
          examples:
          - LIC-GOLD-2025-001
          type: string
        customer:
          description: Customer name as recorded in the license file.
          examples:
          - TheOrganization
          type: string
        plan:
          description: License plan. One of `No`, `Community`, `Gold`, `Platinum`,
            or `One`.
          examples:
          - Gold
          type: string
        kind:
          description: License kind. One of `Regular`, `Trial`, or `Development`.
          examples:
          - Regular
          type: string
        validFrom:
          description: Start of the license validity period, as a Unix timestamp in
            milliseconds.
          examples:
          - 1719792000000
          type: integer
          format: int64
        expiresAt:
          description: End of the license validity period, as a Unix timestamp in
            milliseconds.
          examples:
          - 1814400000000
          type: integer
          format: int64
        current:
          description: Whether this is the currently active license.
          examples:
          - true
          type: boolean
        capabilities:
          description: Capability names enabled by this license.
          examples:
          - - auth.basic
            - auth.ldap
            - case.customStatus
          type: array
          uniqueItems: true
          items:
            type: string
        quotas:
          description: Resource quotas defined by the license, mapping capability
            name to its limit. A value of `-1` means unlimited.
          examples:
          - organisations: 5
            users.normal: 20
            case.template: -1
          type: object
          additionalProperties:
            type: integer
            format: int32
    OutputLicenseCurrent:
      title: OutputLicenseCurrent
      oneOf:
      - $ref: '#/components/schemas/OutputLicenseCurrentError'
      - $ref: '#/components/schemas/OutputLicenseCurrentNotFound'
      - $ref: '#/components/schemas/OutputLicenseCurrentOk'
    OutputLicenseCurrentError:
      title: OutputLicenseCurrentError
      description: Active license exists but failed validation, for example because
        it has expired.
      type: object
      required:
      - error
      - fallback
      properties:
        error:
          description: Error message describing why the license failed validation.
          examples:
          - License has expired
          type: string
        fallback:
          $ref: '#/components/schemas/OutputLicense'
          description: The license that failed validation.
    OutputLicenseCurrentNotFound:
      title: OutputLicenseCurrentNotFound
      description: No active license is configured on this instance.
      type: object
      required:
      - fallback
      properties:
        fallback:
          $ref: '#/components/schemas/OutputLicense'
          description: Placeholder license representing an unlicensed instance.
        notFound:
          description: Always `true` for this response variant.
          default: true
          examples:
          - true
          type: boolean
    OutputLicenseCurrentOk:
      title: OutputLicenseCurrentOk
      description: Active license is valid and within its validity period.
      type: object
      required:
      - license
      properties:
        license:
          $ref: '#/components/schemas/OutputLicense'
          description: The currently active license.
    OutputLicenseQuota:
      title: OutputLicenseQuota
      type: object
      required:
      - quota
      properties:
        current:
          description: Current usage for this quota. Absent when usage isn't tracked
            for this capability.
          examples:
          - 8
          type: integer
          format: int32
        quota:
          description: Maximum allowed value for this quota. `-1` means unlimited.
          examples:
          - 25
          type: integer
          format: int32
    OutputLicenseStatus:
      title: OutputLicenseStatus
      description: License status of your instance.
      type: object
      required:
      - id
      - customer
      - instance
      - plan
      - kind
      - validFrom
      - expiresAt
      - isValid
      - quotas
      properties:
        id:
          description: Unique identifier of the license.
          examples:
          - lic-a1b2c3d4
          type: string
        customer:
          description: Name of the customer this license is issued to.
          examples:
          - TheOrganization
          type: string
        instance:
          description: Identifier of the TheHive instance this license is bound to.
          examples:
          - thehive-prod-01
          type: string
        plan:
          description: 'License plan: `No`, `Community`, `Gold`, `Platinum`, or `One`.'
          examples:
          - Platinum
          type: string
        kind:
          description: 'License kind: `Regular`, `Trial`, or `Development`.'
          examples:
          - Regular
          type: string
        validFrom:
          description: Date the license became valid. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1735689600000
          type: integer
          format: int64
        expiresAt:
          description: Date the license expires. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1798761600000
          type: integer
          format: int64
        capabilities:
          description: Capabilities unlocked by the license plan.
          examples:
          - - auth.sso
            - case.timeline
          type: array
          uniqueItems: true
          items:
            type: string
        isValid:
          description: Whether the license is currently valid.
          examples:
          - true
          type: boolean
        error:
          description: Reason the license isn't valid. Absent when the license is
            valid.
          examples:
          - License signature verification failed.
          type: string
        quotas:
          description: Usage and limit for each licensed quota, keyed by capability
            name.
          examples:
          - users.normal:
              current: 8
              quota: 25
            organisations:
              current: 2
              quota: 5
          type: object
          additionalProperties:
            $ref: '#/components/schemas/OutputLicenseQuota'
    OutputListView:
      title: OutputListView
      type: object
      required:
      - _id
      - _type
      - _createdAt
      - _createdBy
      - name
      - entity
      - filter
      - listOptions
      - isShared
      properties:
        _id:
          description: Internal unique identifier of the view.
          examples:
          - ~344112
          type: string
        _type:
          description: Entity type, always `ListView`.
          examples:
          - ListView
          type: string
        _createdAt:
          description: Date and time when the view was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748476800000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who created the view.
          examples:
          - alice@example.com
          type: string
        _updatedAt:
          description: Date and time when the view was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the view.
          examples:
          - lucas@example.com
          type: string
        name:
          description: Name of the view.
          examples:
          - High severity cases
          type: string
        entity:
          description: |-
            Type of list the view applies to. Determines
            which list the view's filters, sort order,
            displayed columns, and display options apply
            to.
          examples:
          - Case
          type: string
        filter:
          description: |-
            Filter applied to the list. Uses the same
            operators as the `filter` step of the Query API.
          examples:
          - _and:
            - _eq:
                _field: status
                _value: InProgress
          type: object
        listOptions:
          $ref: '#/components/schemas/ListOptions'
          description: Display options saved for the view.
        sortList:
          description: |-
            Sort order saved for the view. Each entry is a
            field name prefixed with `+` for ascending order
            or `-` for descending order.
          examples:
          - - -_createdAt
          type: array
          items:
            type: string
        showColumns:
          description: |-
            Optional columns displayed in the list, on top of
            the fixed set of columns shown for
            that entity type.
          examples:
          - - tlp
            - tags
          type: array
          items:
            type: string
        isShared:
          description: |
            Whether the view is shared with your entire
            organization. When false, the view is private and
            visible only to you.
          examples:
          - false
          type: boolean
    OutputLog:
      title: OutputLog
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - message
      - date
      - owner
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the task log.
          examples:
          - ~123456
          type: string
        _type:
          description: Entity type, always `Log`.
          examples:
          - Log
          type: string
        _createdBy:
          description: Login of the user who created the task log.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the task log.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the task log was created. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1742048580000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the task log was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1742055780000
          type: integer
          format: int64
        message:
          description: Content of the task log.
          examples:
          - Ran memory analysis on CORP-LAPTOP-056 using Volatility. Found evidence
            of code injection into explorer.exe.
          type: string
        date:
          description: Date and time of the log entry. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1742048580000
          type: integer
          format: int64
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/OutputAttachment'
        owner:
          description: Name of the organization that owns the task log.
          examples:
          - TheOrganization
          type: string
        includeInTimeline:
          description: Date at which the log entry is pinned in the case timeline.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1742046000000
          type: integer
          format: int64
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputMergeCases:
      title: OutputMergeCases
      type: object
      required:
      - untouched
      - updated
      - deleted
      properties:
        untouched:
          description: Number of observables with no duplicates found, left unchanged.
          examples:
          - 14
          type: integer
          format: int32
        updated:
          description: Number of distinct observables updated with combined metadata
            from their duplicates.
          examples:
          - 3
          type: integer
          format: int32
        deleted:
          description: Total number of duplicate observables removed during the merge.
          examples:
          - 5
          type: integer
          format: int32
    OutputObservable:
      title: OutputObservable
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - dataType
      - startDate
      - tlp
      - tlpLabel
      - pap
      - papLabel
      - ioc
      - sighted
      - reports
      - extraData
      - ignoreSimilarity
      - external
      properties:
        _id:
          description: Internal unique identifier of the observable.
          examples:
          - ~8529344
          type: string
        _type:
          description: Entity type, always `Observable`.
          examples:
          - Observable
          type: string
        _createdBy:
          description: Login of the user who created the observable.
          examples:
          - lucas@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the observable.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date and time when the observable was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the observable was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        dataType:
          description: The observable type.
          examples:
          - ip
          type: string
        data:
          description: Observable value. `null` for attachment types.
          examples:
          - 00.01.002.003
          type: string
        startDate:
          description: Date and time when the observable was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        attachment:
          $ref: '#/components/schemas/OutputAttachment'
          description: File attachment for observable types that require a file. Absent
            for value-based observables.
        tlp:
          description: 'Numeric Traffic Light Protocol (TLP) level: 0 (Clear), 1 (Green),
            2 (Amber), 3 (Amber+Strict), 4 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        tlpLabel:
          description: Human-readable label of the TLP level.
          examples:
          - AMBER
          type: string
        pap:
          description: 'Numeric Permissible Actions Protocol (PAP) level: 0 (Clear),
            1 (Green), 2 (Amber), 3 (Red).'
          examples:
          - 2
          type: integer
          format: int32
        papLabel:
          description: Human-readable label of the PAP level.
          examples:
          - AMBER
          type: string
        tags:
          description: Tags applied to the observable.
          examples:
          - - Source IP
          type: array
          uniqueItems: true
          items:
            type: string
        ioc:
          description: Whether the observable is an indicator of compromise (IOC).
          examples:
          - true
          type: boolean
        sighted:
          description: Whether the observable has been sighted in the environment.
          examples:
          - false
          type: boolean
        sightedAt:
          description: Date and time when the observable was last sighted. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1748822400000
          type: integer
          format: int64
        reports:
          description: Analyzer reports attached to the observable, keyed by analyzer
            name.
          examples:
          - VirusTotal_GetReport:
              status: Success
              report:
                taxonomies:
                - level: malicious
                  namespace: VT
                  predicate: GetReport
                  value: 42/68
          type: object
        message:
          description: A description of the observable.
          examples:
          - Source IP of the ransomware C2 server detected on CORP-LAPTOP-056
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
        ignoreSimilarity:
          description: Whether the observable is excluded from similarity checks.
          examples:
          - false
          type: boolean
        external:
          description: Whether the observable is accessible to external users with
            [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
            Platinum or One license required.
          examples:
          - false
          type: boolean
    OutputObservableType:
      title: OutputObservableType
      type: object
      required:
      - _id
      - _type
      - _createdAt
      - _createdBy
      - name
      - isAttachment
      - isCaseSensitive
      properties:
        _id:
          description: Internal unique identifier of the observable type.
          examples:
          - ~4096
          type: string
        _type:
          description: Entity type, always `ObservableType`.
          examples:
          - ObservableType
          type: string
        _updatedAt:
          description: Date and time when the observable type was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1718016000000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the observable type.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the observable type was created. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1718016000000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who created the observable type.
          examples:
          - emma@example.com
          type: string
        name:
          description: Name of the observable type.
          examples:
          - ja4-fingerprint
          type: string
        isAttachment:
          description: When `true`, observables of this type require a file attachment
            instead of a text value.
          examples:
          - false
          type: boolean
        isCaseSensitive:
          description: When `false`, values are automatically normalized to lowercase
            upon creation.
          examples:
          - true
          type: boolean
    OutputOrganisation:
      title: OutputOrganisation
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - name
      - description
      - taskRule
      - observableRule
      - locked
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the organization.
          examples:
          - ~128458762
          type: string
        _type:
          description: Entity type, always `Organisation`.
          examples:
          - Organisation
          type: string
        _createdBy:
          description: Login of the user who created the organization.
          examples:
          - admin@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the organization.
          examples:
          - admin@example.com
          type: string
        _createdAt:
          description: Date and time when the organization was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the organization was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        name:
          description: Unique name of the organization, which can be used instead
            of `_id`.
          examples:
          - TheOrganization
          type: string
        description:
          description: Description of the organization.
          examples:
          - The primary investigation organization.
          type: string
        taskRule:
          description: Task-sharing rule applied to new case shares with this organization.
            One of `autoShare`, `manual`.
          examples:
          - manual
          type: string
        observableRule:
          description: Observable-sharing rule applied to new case shares with this
            organization. One of `autoShare`, `manual`.
          examples:
          - autoShare
          type: string
        links:
          description: Sharing links configured for this organization.
          type: array
          items:
            $ref: '#/components/schemas/OrganisationLink'
        avatar:
          description: Base64-encoded avatar image of the organization.
          examples:
          - iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==
          type: string
        locked:
          description: Whether the organization is locked. Members of a locked organization
            can't log in.
          examples:
          - false
          type: boolean
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputOrganisationLink:
      title: OutputOrganisationLink
      type: object
      required:
      - linkType
      - otherLinkType
      - organisation
      properties:
        linkType:
          description: Sharing profile applied when the current organization shares
            a case with this organization.
          examples:
          - default
          type: string
        otherLinkType:
          description: Sharing profile applied when this organization shares a case
            with the current organization.
          examples:
          - supervised
          type: string
        organisation:
          $ref: '#/components/schemas/OutputOrganisation'
          description: Details of the linked organization.
    OutputOrganisationProfile:
      title: OutputOrganisationProfile
      type: object
      required:
      - organisationId
      - organisation
      - profile
      properties:
        organisationId:
          description: Internal unique identifier of the organization.
          examples:
          - ~128458762
          type: string
        organisation:
          description: Name of the organization.
          examples:
          - TheOrganization
          type: string
        profile:
          description: Permission profile of the user in this organization.
          examples:
          - analyst
          type: string
        avatar:
          description: Relative path to the organization's avatar image.
          examples:
          - api/v1/organisation/~1048576/avatar/e3b0c44298fc1c14
          type: string
        links:
          description: Sharing links configured for this organization.
          type: array
          items:
            $ref: '#/components/schemas/OrganisationLink'
    OutputPage:
      title: OutputPage
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - title
      - content
      - order
      - category
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the page.
          examples:
          - ~84123456
          type: string
        _type:
          description: Entity type, always `Page`.
          examples:
          - Page
          type: string
        _createdBy:
          description: Login of the user who created the page.
          examples:
          - sami@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the page.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the page was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1718532000000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the page was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1718618400000
          type: integer
          format: int64
        title:
          description: Title of the page.
          examples:
          - Investigation Notes
          type: string
        content:
          description: Content of the page in [TheHive-flavored Markdown](https://docs.strangebee.com/thehive/user-guides/thehive-flavored-markdown/).
          examples:
          - |-
            ## Summary

            File encryption via PowerShell script detected on multiple workstations.
          type: string
        order:
          description: Display order of the page within its category.
          examples:
          - 0
          type: integer
          format: int32
        category:
          description: Category the page belongs to.
          examples:
          - Investigation
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputPattern:
      title: OutputPattern
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - patternId
      - name
      - url
      - patternType
      - revoked
      - remoteSupport
      - extraData
      properties:
        _id:
          description: Unique identifier of the attack technique.
          examples:
          - ~163840
          type: string
        _type:
          description: Entity type, always "Pattern".
          examples:
          - Pattern
          type: string
        _createdBy:
          description: Login of the user who created the attack technique record.
          examples:
          - admin@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the attack technique record.
          examples:
          - emma@example.com
          type: string
        _createdAt:
          description: Date and time when the attack technique record was created.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1722513600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the attack technique record was last updated.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748995200000
          type: integer
          format: int64
        patternId:
          description: MITRE ATT&CK pattern identifier.
          examples:
          - T1486
          type: string
        name:
          description: Name of the attack technique.
          examples:
          - Data Encrypted for Impact
          type: string
        description:
          description: Description of the attack technique.
          examples:
          - Adversaries may encrypt data on target systems to interrupt availability
            to system and network resources.
          type: string
        tactics:
          description: MITRE ATT&CK tactics associated with this technique.
          examples:
          - - impact
          type: array
          uniqueItems: true
          items:
            type: string
        url:
          description: URL of the MITRE ATT&CK page for this technique.
          examples:
          - https://attack.mitre.org/techniques/T1486
          type: string
        patternType:
          description: MITRE ATT&CK object type for this entry.
          examples:
          - attack-pattern
          type: string
        capecId:
          description: CAPEC (Common Attack Pattern Enumeration and Classification)
            identifier, if applicable.
          examples:
          - CAPEC-242
          type: string
        capecUrl:
          description: URL of the CAPEC entry for this technique, if applicable.
          examples:
          - https://capec.mitre.org/data/definitions/242.html
          type: string
        revoked:
          description: Whether this technique has been revoked in the MITRE ATT&CK
            framework.
          examples:
          - false
          type: boolean
        dataSources:
          description: Data sources that can be used to detect this technique.
          examples:
          - - Process
            - File
          type: array
          items:
            type: string
        defenseBypassed:
          description: Defenses this technique can bypass.
          examples:
          - - Antivirus
          type: array
          items:
            type: string
        detection:
          description: Guidance for detecting this technique.
          examples:
          - Monitor process execution and command line parameters for activity associated
            with data destruction.
          type: string
        permissionsRequired:
          description: Permissions required to execute this technique.
          examples:
          - - User
          type: array
          items:
            type: string
        platforms:
          description: Target platforms for this technique.
          examples:
          - - Windows
            - macOS
            - Linux
          type: array
          items:
            type: string
        remoteSupport:
          description: Whether this technique can be executed remotely.
          examples:
          - false
          type: boolean
        systemRequirements:
          description: System requirements for executing this technique.
          examples:
          - - Elevated privileges
          type: array
          items:
            type: string
        version:
          description: Version of this technique in the MITRE ATT&CK framework.
          examples:
          - 1.3
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputProcedure:
      title: OutputProcedure
      type: object
      required:
      - _id
      - _createdAt
      - _createdBy
      - occurDate
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the procedure.
          examples:
          - ~234567890
          type: string
        _createdAt:
          description: Date and time when the procedure was created. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _createdBy:
          description: Login of the user who created the procedure.
          examples:
          - lucas@example.com
          type: string
        _updatedAt:
          description: Date and time when the procedure was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        _updatedBy:
          description: Login of the user who last updated the procedure.
          examples:
          - alice@example.com
          type: string
        description:
          description: Description of how the technique was applied in this incident,
            referred to as the procedure.
          examples:
          - PowerShell script used to encrypt files across multiple workstations.
          type: string
        occurDate:
          description: Date and time when the technique occurred during the incident.
            Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        patternId:
          description: Technique ID from the catalog, for example a MITRE ATT&CK technique
            ID.
          examples:
          - T1486
          type: string
        patternName:
          description: Name of the technique in the catalog, for example a MITRE ATT&CK
            technique name.
          examples:
          - Data Encrypted for Impact
          type: string
        tactic:
          description: Tactic identifier the technique belongs to. Present when the
            technique belongs to multiple tactics.
          examples:
          - impact
          type: string
        tacticLabel:
          description: Human-readable tactic name.
          examples:
          - Impact
          type: string
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
    OutputProfile:
      title: OutputProfile
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - type
      - name
      - editable
      - forAdmin
      - forOrg
      - forExternal
      - consumesLicense
      properties:
        _id:
          description: Internal unique identifier of the profile.
          examples:
          - ~84123
          type: string
        _type:
          description: Entity type, always `profile`.
          examples:
          - profile
          type: string
        _createdBy:
          description: Login of the user who created the profile.
          examples:
          - admin@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the profile.
          examples:
          - admin@example.com
          type: string
        _createdAt:
          description: Date and time when the profile was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the profile was last updated. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        type:
          $ref: '#/components/schemas/ProfileType'
          description: Profile type.
        name:
          description: Name of the profile.
          examples:
          - SOC-Tier1-Analyst
          type: string
        permissions:
          description: Permissions assigned to the profile.
          examples:
          - - manageCase/create
            - manageCase/update
            - manageObservable
            - manageTask
          type: array
          items:
            type: string
        editable:
          description: Indicates whether the profile can be modified.
          examples:
          - true
          type: boolean
        forAdmin:
          description: Indicates whether the profile can be assigned in the Admin
            organization.
          examples:
          - false
          type: boolean
        forOrg:
          description: Indicates whether the profile can be assigned in non-admin
            organizations.
          examples:
          - true
          type: boolean
        forExternal:
          description: Indicates whether the profile can be assigned to external users
            accessing [TheHive Portal](https://docs.strangebee.com/thehive/administration/thehive-portal/about-thehive-portal/).
          examples:
          - false
          type: boolean
        consumesLicense:
          description: Indicates whether assigning this profile to a user consumes
            a license.
          examples:
          - true
          type: boolean
    OutputPublicStatus:
      title: OutputPublicStatus
      type: object
      required:
      - sso
      - version
      - imports
      properties:
        sso:
          description: Whether single sign-on is turned on.
          examples:
          - true
          type: boolean
        ssoProviders:
          description: SSO providers available on the sign-in page. Each item describes
            one configured provider.
          type: array
          items:
            $ref: '#/components/schemas/OutputSsoProvider'
        version:
          description: Version of your TheHive instance.
          examples:
          - 5.8.0
          type: string
        imports:
          $ref: '#/components/schemas/Imports'
    OutputRichEmailIntake:
      title: OutputRichEmailIntake
      type: object
      required:
      - outputEmailIntake
      properties:
        outputEmailIntake:
          $ref: '#/components/schemas/OutputEmailIntake'
    OutputRichEmailIntakeProvider:
      title: OutputRichEmailIntakeProvider
      type: object
      required:
      - name
      - _kind
      properties:
        name:
          $ref: '#/components/schemas/EmailIntakeProviderName'
          description: Name of the email provider.
          examples:
          - office365
        _kind:
          $ref: '#/components/schemas/EmailIntakeConfigKind'
    OutputSetUserOrganisations:
      title: OutputSetUserOrganisations
      type: object
      properties:
        organisations:
          type: array
          items:
            $ref: '#/components/schemas/OutputUserOrganisation'
    OutputShare:
      title: OutputShare
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - caseId
      - profileName
      - organisationName
      - owner
      - taskRule
      - observableRule
      properties:
        _id:
          description: Unique identifier of the share.
          examples:
          - ~1234567890
          type: string
        _type:
          description: Object type, always `Share`.
          examples:
          - Share
          type: string
        _createdBy:
          description: Login of the user who created the share.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the share.
          examples:
          - alice@example.com
          type: string
        _createdAt:
          description: Date the sharing record was created, as a Unix timestamp in
            milliseconds.
          examples:
          - 1716299974000
          type: integer
          format: int64
        _updatedAt:
          description: Date the sharing record was last updated, as a Unix timestamp
            in milliseconds.
          examples:
          - 1716299974000
          type: integer
          format: int64
        caseId:
          description: ID of the case this share belongs to.
          examples:
          - ~4123456789
          type: string
        profileName:
          description: Name of the permission profile granted to the organization.
          examples:
          - analyst
          type: string
        organisationName:
          description: Name of the organization this sharing record is for.
          examples:
          - TheOrganization
          type: string
        owner:
          description: Whether this organization owns the case.
          examples:
          - false
          type: boolean
        taskRule:
          description: Task-sharing rule for the organization. One of `autoShare`
            or `manual`.
          examples:
          - manual
          type: string
        observableRule:
          description: Observable-sharing rule for the organization. One of `autoShare`
            or `manual`.
          examples:
          - autoShare
          type: string
    OutputSharingProfile:
      title: OutputSharingProfile
      type: object
      required:
      - name
      - description
      - autoShare
      - editable
      - permissionProfile
      - taskRule
      - observableRule
      properties:
        name:
          description: Unique name of the sharing profile.
          examples:
          - default
          type: string
        description:
          description: Description of the sharing profile.
          examples:
          - Default sharing profile.
          type: string
        autoShare:
          description: Whether cases owned by the organization are automatically shared
            when this profile is applied.
          examples:
          - false
          type: boolean
        editable:
          description: Whether the sharing rules of this profile can be overridden
            per case.
          examples:
          - true
          type: boolean
        permissionProfile:
          description: Permission profile applied to members of the linked organization
            when this profile is used.
          examples:
          - analyst
          type: string
        taskRule:
          description: Task-sharing rule applied by this profile. One of `autoShare`,
            `manual`.
          examples:
          - autoShare
          type: string
        observableRule:
          description: Observable-sharing rule applied by this profile. One of `autoShare`,
            `manual`.
          examples:
          - autoShare
          type: string
    OutputSsoProvider:
      title: OutputSsoProvider
      type: object
      required:
      - name
      - displayName
      - url
      properties:
        name:
          description: Internal identifier of the SSO provider.
          examples:
          - okta
          type: string
        displayName:
          description: Label shown on the sign-in button for this SSO provider.
          examples:
          - Sign in with Okta
          type: string
        url:
          description: URL that starts the sign-in flow for this SSO provider.
          examples:
          - https://sso.example.com/oauth2/authorize
          type: string
    OutputStatus:
      title: OutputStatus
      type: object
      required:
      - version
      - gitDescription
      - connectors
      - config
      - license
      properties:
        version:
          description: Version of your TheHive instance.
          examples:
          - 5.8.0
          type: string
        gitDescription:
          description: Abbreviated commit hash TheHive was built from.
          examples:
          - a1b2c3d4e
          type: string
        connectors:
          description: Status of each connector configured on your instance, keyed
            by connector name.
          examples:
          - cortex:
              enabled: true
              status: OK
            misp:
              enabled: true
              status: OK
          type: object
          additionalProperties:
            type: object
        config:
          description: Non-sensitive authentication and platform configuration.
          examples:
          - protectDownloadsWith: infected
            authType: local
            multifactor: disabled
            capabilities:
            - changePassword
            - setPassword
            ssoAutoLogin: false
            pollingDuration: 5000
            freeTagDefaultColour: '#a1eafb'
          type: object
        license:
          $ref: '#/components/schemas/OutputLicenseStatus'
        cluster:
          description: Filled when `verbose` is `true`. Pekko cluster state of your
            instance.
          examples:
          - members:
            - address: pekko://thehive@10.0.0.1:2551
              status: Up
              roles:
              - dc-default
            - address: pekko://thehive@10.0.0.2:2551
              status: Up
              roles:
              - dc-default
            unreachable:
            - address: pekko://thehive@10.0.0.3:2551
              status: Up
              roles:
              - dc-default
            seenBy:
            - pekko://thehive@10.0.0.1:2551
            - pekko://thehive@10.0.0.2:2551
            leader: pekko://thehive@10.0.0.1:2551
            unreachableDataCenters: []
          type: object
        schemaStatus:
          description: Filled when `verbose` is `true`. Database schema version of
            each module.
          examples:
          - - name: thehiveCore
              currentVersion: 42
              expectedVersion: 42
          type: array
          items:
            type: object
        features:
          description: Enabled feature flags on your instance.
          examples:
          - - StreamSSE
            - Automation
          type: array
          items:
            type: string
    OutputStreamAudit:
      title: OutputStreamAudit
      type: object
      required:
      - base
      - summary
      properties:
        base:
          $ref: '#/components/schemas/OutputAudit'
        summary:
          description: Aggregated count of audit entries created by the same request,
            grouped by object type and then by action.
          examples:
          - Task:
              create: 2
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Map_Int'
    OutputTOTPSecret:
      title: OutputTOTPSecret
      type: object
      required:
      - secret
      - uri
      properties:
        secret:
          description: Base32-encoded secret used to generate time-based one-time
            passwords for your account. Send it back in the `secret` field of `POST
            /api/v1/auth/totp/set` to activate it.
          examples:
          - JBSWY3DPEHPK3PXP
          type: string
        uri:
          description: otpauth URI containing `secret`, rendered as a QR code in TheHive
            interface for you to scan with an authenticator app.
          examples:
          - otpauth://totp/TheHive:lucas@example.com?secret=JBSWY3DPEHPK3PXP&issuer=TheHive
          type: string
    OutputTag:
      title: OutputTag
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - namespace
      - predicate
      - colour
      - hidden
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the tag.
          examples:
          - ~83456
          type: string
        _type:
          description: Entity type, always `Tag`.
          examples:
          - Tag
          type: string
        _createdBy:
          description: Login of the user who created the tag.
          examples:
          - emma@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the tag.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the tag was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1744660800000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the tag was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1744747200000
          type: integer
          format: int64
        namespace:
          description: Namespace of the tag. For custom tags, this is `_freetags_`.
            For taxonomy tags, this is the taxonomy namespace.
          examples:
          - _freetags_
          type: string
        predicate:
          description: The tag name.
          examples:
          - ransomware
          type: string
        value:
          description: Value component of the tag, used for taxonomy tags with a value.
            Empty for custom tags.
          examples:
          - amber
          type: string
        description:
          description: Description of the tag.
          examples:
          - Identifies ransomware-related cases and observables
          type: string
        colour:
          description: Hex color code for the tag's visual appearance.
          examples:
          - '#e8560a'
          type: string
        hidden:
          description: Whether the tag is hidden. Hidden taxonomy tags can't be added
            to cases, alerts, and observables, but stay attached to any that already
            have them.
          examples:
          - false
          type: boolean
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputTask:
      title: OutputTask
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - title
      - group
      - status
      - flag
      - order
      - mandatory
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the task.
          examples:
          - ~84123
          type: string
        _type:
          description: Entity type, always `Task`.
          examples:
          - Task
          type: string
        _createdBy:
          description: Login of the user who created the task.
          examples:
          - alice@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the task.
          examples:
          - lucas@example.com
          type: string
        _createdAt:
          description: Date and time when the task was created. Returned as a Unix
            timestamp in milliseconds.
          examples:
          - 1748476800000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the task was last updated. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        title:
          description: Title of the task.
          examples:
          - Isolate affected workstation from the network
          type: string
        group:
          description: Group name used to organize the task within the case.
          examples:
          - Containment
          type: string
        description:
          description: Details of the task.
          examples:
          - Disconnect CORP-LAPTOP-056 from the network immediately.
          type: string
        status:
          description: Current status of the task. One of `Waiting`, `InProgress`,
            `Completed`,or `Cancel`.
          examples:
          - InProgress
          type: string
        flag:
          description: Whether the task is flagged as important.
          examples:
          - false
          type: boolean
        startDate:
          description: Date and time when the task started. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1748476800000
          type: integer
          format: int64
        endDate:
          description: Date and time when the task ended. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        assignee:
          description: Login of the user assigned to the task.
          examples:
          - sami@example.com
          type: string
        order:
          description: Display order of the task within its group.
          examples:
          - 0
          type: integer
          format: int32
        dueDate:
          description: Due date for the task. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1748563200000
          type: integer
          format: int64
        mandatory:
          description: Whether the task must be completed before the case can be closed.
          examples:
          - false
          type: boolean
        extraData:
          $ref: '#/components/schemas/JsObject'
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
        timeToHandle:
          description: Duration of the task from start to completion, in milliseconds.
          examples:
          - 86400000
          type: integer
          format: int64
    OutputTaxonomy:
      title: OutputTaxonomy
      type: object
      required:
      - _id
      - _type
      - _createdBy
      - _createdAt
      - namespace
      - description
      - version
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the taxonomy.
          examples:
          - ~84123
          type: string
        _type:
          description: Entity type, always `Taxonomy`.
          examples:
          - Taxonomy
          type: string
        _createdBy:
          description: Login of the user who created the taxonomy.
          examples:
          - emma@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the taxonomy.
          examples:
          - sami@example.com
          type: string
        _createdAt:
          description: Date and time when the taxonomy was created. Returned as a
            Unix timestamp in milliseconds.
          examples:
          - 1744660800000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the taxonomy was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1744747200000
          type: integer
          format: int64
        namespace:
          description: Namespace identifier of the taxonomy.
          examples:
          - tlp
          type: string
        description:
          description: Description of what this taxonomy covers.
          examples:
          - Traffic Light Protocol for information sharing
          type: string
        version:
          description: Version number of the taxonomy.
          examples:
          - 6
          type: integer
          format: int32
        tags:
          type: array
          items:
            $ref: '#/components/schemas/OutputTag'
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputTimeline:
      title: OutputTimeline
      type: object
      properties:
        events:
          description: Chronological list of all events in the case timeline, sorted
            by date.
          type: array
          items:
            $ref: '#/components/schemas/OutputTimelineEvent'
    OutputTimelineEvent:
      title: OutputTimelineEvent
      type: object
      required:
      - date
      - kind
      - entity
      - entityId
      - details
      properties:
        date:
          description: Start date and time of the event. Returned as a Unix timestamp
            in milliseconds.
          examples:
          - 1736849400000
          type: integer
          format: int64
        kind:
          description: |-
            The event type. Possible values: `case.start`, `case.created`, `case.new`,
            `case.inProgress`, `case.closed`, `case.end`, `alert.occurred`,
            `procedure.occurred`, `observable.sighted`, `task`, `log.created`,
            `custom`.
          examples:
          - task
          type: string
        entity:
          description: |-
            The entity type involved in the event. Possible values: `Case`, `Alert`,
            `Procedure`, `Observable`, `Task`, `Log`, `CustomEvent`.
          examples:
          - Task
          type: string
        entityId:
          description: Unique identifier of the entity involved in the event.
          examples:
          - ~72637286
          type: string
        details:
          description: |-
            Event-specific details. Content varies by `kind`. For entity events, holds the full JSON representation of the
            related entity under a key matching the entity type
            (for example, `{"task": {...}}`). Empty for case lifecycle events.
          examples:
          - task:
              title: Isolate affected workstation from the network
              status: InProgress
          type: object
        endDate:
          description: End date and time of range events such as tasks. `null` for
            point-in-time events. Returned as a Unix timestamp in milliseconds.
          examples:
          - 1736939400000
          type: integer
          format: int64
    OutputUser:
      title: OutputUser
      type: object
      required:
      - _id
      - _createdBy
      - _createdAt
      - login
      - name
      - hasKey
      - hasPassword
      - hasMFA
      - locked
      - profile
      - organisation
      - type
      - extraData
      properties:
        _id:
          description: Internal unique identifier of the user.
          examples:
          - ~192024
          type: string
        _createdBy:
          description: Login of the user who created the user account.
          examples:
          - admin@example.com
          type: string
        _updatedBy:
          description: Login of the user who last updated the user account.
          examples:
          - admin@example.com
          type: string
        _createdAt:
          description: Date and time when the user account was created. Returned as
            a Unix timestamp in milliseconds.
          examples:
          - 1748739600000
          type: integer
          format: int64
        _updatedAt:
          description: Date and time when the user account was last updated. Returned
            as a Unix timestamp in milliseconds.
          examples:
          - 1776902400000
          type: integer
          format: int64
        login:
          description: Login name for the user account. Always a valid email address.
          examples:
          - lucas@example.com
          type: string
        name:
          description: Display name for the user account.
          examples:
          - Sami Analyst
          type: string
        email:
          description: Email address of the user for notifications.
          examples:
          - lucas@example.com
          type: string
        hasKey:
          description: Whether the user account has an API key.
          examples:
          - true
          type: boolean
        hasPassword:
          description: Whether the user account has a password set.
          examples:
          - true
          type: boolean
        hasMFA:
          description: Whether multi-factor authentication (MFA) is enabled for the
            user account.
          examples:
          - false
          type: boolean
        locked:
          description: Whether the user account is locked. A locked account can't
            sign in or use the API.
          examples:
          - false
          type: boolean
        profile:
          description: Permission profile of the user in the current organization.
          examples:
          - analyst
          type: string
        permissions:
          description: Set of permissions granted to the user in the current organization.
          examples:
          - - manageCase
            - manageAlert
          type: array
          uniqueItems: true
          items:
            type: string
        organisation:
          description: Name of the organization in the context of which the user was
            retrieved.
          examples:
          - TheOrganization
          type: string
        avatar:
          description: Relative path to the user's avatar image.
          examples:
          - api/v1/user/~1048576/avatar/e3b0c44298fc1c14
          type: string
        organisations:
          description: Organizations the user belongs to, with the profile and avatar
            used in each one.
          type: array
          items:
            $ref: '#/components/schemas/OutputOrganisationProfile'
        type:
          $ref: '#/components/schemas/UserType'
          description: Type of user account.
        defaultOrganisation:
          description: Default organization used when the user signs in.
          examples:
          - TheOrganization
          type: string
        extraData:
          description: Extra data fields populated when specific keys are requested
            in the `extraData` query parameter.
          type: object
    OutputUserOrganisation:
      title: OutputUserOrganisation
      type: object
      required:
      - organisation
      - profile
      - default
      properties:
        organisation:
          description: Organization name.
          examples:
          - TheOrganization
          type: string
        profile:
          description: Permission profile of the user in this organization.
          examples:
          - analyst
          type: string
        default:
          description: Whether this is the user's default organization, used when
            signing in and when the `X-Organisation` header is not specified in API
            requests.
          examples:
          - true
          type: boolean
    OutputWorker:
      title: OutputWorker
      type: object
      required:
      - id
      - name
      - version
      - description
      properties:
        id:
          description: ID of the analyzer once enabled within the organization.
          examples:
          - 220483fde9608c580fb6a2508ff3d2d3
          type: string
        name:
          description: Display name of the analyzer.
          examples:
          - VirusTotal_GetReport
          type: string
        version:
          description: Version of the analyzer.
          examples:
          - 3.0
          type: string
        description:
          description: Description of what the analyzer does.
          examples:
          - Search for a specific hash, IP, domain, or URL in the VirusTotal database.
          type: string
        dataTypeList:
          description: Observable data types the analyzer supports.
          examples:
          - - hash
            - domain
            - ip
            - url
          type: array
          items:
            type: string
        cortexIds:
          description: Names of the Cortex servers on which the analyzer is available.
          examples:
          - - Cortex1
          type: array
          items:
            type: string
    OutputWorker1:
      title: OutputWorker
      type: object
      required:
      - id
      - name
      - description
      properties:
        id:
          description: ID of the responder once enabled within the organization.
          examples:
          - b7fa3af4dd7a6de1d8c1f1f4a9c6e7ab
          type: string
        name:
          description: Display name of the responder.
          examples:
          - Mailer
          type: string
        description:
          description: Description of what the responder does.
          examples:
          - Send an email through an SMTP relay.
          type: string
    Pages:
      title: Pages
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Case Pages
          type: string
          maxLength: 512
          minLength: 1
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the page list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        _kind:
          $ref: '#/components/schemas/Kind'
    PermissionDesc:
      title: PermissionDesc
      type: object
      required:
      - name
      - label
      - consumesLicense
      properties:
        name:
          $ref: '#/components/schemas/Permissions'
        label:
          description: Human-readable label for the permission.
          examples:
          - Create cases
          type: string
        consumesLicense:
          description: '`true` if the permission consumes a license.'
          examples:
          - true
          type: boolean
        scope:
          description: Scopes where the permission applies.
          examples:
          - - organisation
          type: array
          items:
            type: string
    Permissions:
      title: Permissions
      description: Name of the permission.
      examples:
      - manageCase/create
      type: string
      enum:
      - accessTheHiveFS
      - manageAction
      - manageAlert/create
      - manageAlert/delete
      - manageAlert/import
      - manageAlert/reopen
      - manageAlert/update
      - manageAnalyse
      - manageAnalyzerTemplate
      - manageCase/changeOwnership
      - manageCase/create
      - manageCase/delete
      - manageCase/merge
      - manageCase/reopen
      - manageCase/update
      - manageCaseAccess/external
      - manageCaseAccess/restrict
      - manageCaseReport
      - manageCaseReportTemplate
      - manageCaseTemplate
      - manageComment
      - manageConfig
      - manageCustomEvent
      - manageCustomField
      - manageDashboard
      - manageFunction/create
      - manageFunction/invoke
      - manageKnowledgeBase
      - manageObservable
      - manageObservableTemplate
      - manageOrchestrator/deleteVariables
      - manageOrchestrator/deleteWorkflows
      - manageOrchestrator/readVariables
      - manageOrchestrator/readWorkflows
      - manageOrchestrator/writeVariables
      - manageOrchestrator/writeWorkflows
      - manageOrganisation
      - managePage
      - managePageTemplate
      - managePattern
      - managePlatform
      - manageProcedure
      - manageProfile
      - manageShare
      - manageSla
      - manageTag
      - manageTask
      - manageTaxonomy
      - manageUser
    ProfileType:
      title: ProfileType
      examples:
      - Organisation
      type: string
      enum:
      - Organisation
      - Admin
      - External
    PropertyDescription:
      title: PropertyDescription
      oneOf:
      - $ref: '#/components/schemas/BooleanPropertyDescription'
      - $ref: '#/components/schemas/DatePropertyDescription'
      - $ref: '#/components/schemas/EnumerationPropertyDescription'
      - $ref: '#/components/schemas/FloatPropertyDescription'
      - $ref: '#/components/schemas/IntegerPropertyDescription'
      - $ref: '#/components/schemas/StringPropertyDescription'
      - $ref: '#/components/schemas/UrlPropertyDescription'
      - $ref: '#/components/schemas/UserPropertyDescription'
      discriminator:
        propertyName: type
        mapping:
          boolean: '#/components/schemas/BooleanPropertyDescription'
          date: '#/components/schemas/DatePropertyDescription'
          enumeration: '#/components/schemas/EnumerationPropertyDescription'
          float: '#/components/schemas/FloatPropertyDescription'
          integer: '#/components/schemas/IntegerPropertyDescription'
          string: '#/components/schemas/StringPropertyDescription'
          url: '#/components/schemas/UrlPropertyDescription'
          user: '#/components/schemas/UserPropertyDescription'
    ProxyConfig:
      title: ProxyConfig
      description: Proxy server configuration. If not set, no proxy is used.
      type: object
      required:
      - state
      properties:
        host:
          description: Hostname or IP address of the proxy server.
          examples:
          - proxy.example.com
          type: string
          maxLength: 128
          minLength: 1
        port:
          description: Port number of the proxy server.
          examples:
          - 8080
          type: integer
          format: int32
        state:
          $ref: '#/components/schemas/State'
        protocol:
          description: Proxy protocol. Accepts `http` or `https`.
          examples:
          - http
          type: string
          maxLength: 16
          minLength: 1
        principal:
          description: Username to authenticate with the proxy server.
          examples:
          - proxy-user
          type: string
          maxLength: 32
          minLength: 1
        password:
          description: Password to authenticate with the proxy server.
          examples:
          - p@ssw0rd
          type: string
          maxLength: 128
          minLength: 1
        ntlmDomain:
          description: NTLM domain for proxy authentication.
          examples:
          - CORP
          type: string
          maxLength: 128
          minLength: 1
        encoding:
          description: Character encoding for proxy authentication.
          examples:
          - UTF-8
          type: string
          maxLength: 32
          minLength: 1
        nonProxyHosts:
          description: List of hostnames or patterns that bypass the proxy.
          examples:
          - - localhost
            - '*.internal.example.com'
          type: array
          items:
            type: string
            maxLength: 128
            minLength: 1
    SSLConfig:
      title: SSLConfig
      description: SSL/TLS configuration.
      type: object
      required:
      - loose
      properties:
        default:
          description: Whether to use the default JVM SSL configuration.
          default: false
          examples:
          - false
          type: boolean
        protocol:
          description: SSL/TLS protocol version to use.
          default: TLSv1.2
          examples:
          - TLSv1.2
          type: string
        checkRevocation:
          description: Whether to check certificate revocation lists.
          type: boolean
        revocationLists:
          description: Certificate revocation list URLs to check.
          examples:
          - - http://crl.example.com/ca.crl
          type: array
          items:
            type: string
            maxLength: 128
            minLength: 1
        enabledCipherSuites:
          description: Override for the platform default cipher suites.
          examples:
          - - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
            - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
          type: array
          items:
            type: string
            maxLength: 128
            minLength: 1
        enabledProtocols:
          description: Override for the platform default TLS protocols.
          examples:
          - - TLSv1.2
            - TLSv1.1
            - TLSv1
          type: array
          items:
            type: string
        hostnameVerifierClass:
          description: Hostname verifier class name.
          default: NoopHostnameVerifier
          examples:
          - com.typesafe.sslconfig.ssl.NoopHostnameVerifier
          type: string
          maxLength: 128
          minLength: 1
        secureRandom:
          description: SecureRandom implementation class name.
          examples:
          - SHA1PRNG
          type: string
          maxLength: 128
          minLength: 1
        trustManager:
          $ref: '#/components/schemas/Manager'
          description: Trust manager configuration.
          default:
            stores: []
        keyManager:
          $ref: '#/components/schemas/Manager'
          description: Key manager configuration.
        sslParametersConfig:
          $ref: '#/components/schemas/SSLParameters'
        debug:
          $ref: '#/components/schemas/SSLDebugConfig'
        loose:
          $ref: '#/components/schemas/SSLLooseConfig'
    SSLDebugConfig:
      title: SSLDebugConfig
      description: SSL debug logging configuration.
      type: object
      properties:
        all:
          description: Enable tracing of SSLContext, SSLEngine, SSLSocketFactory,
            and key and trust managers.
          default: false
          examples:
          - false
          type: boolean
        keymanager:
          description: Enable tracing of key manager operations.
          default: false
          examples:
          - false
          type: boolean
        ssl:
          description: Enable tracing of SSLEngine and SSLSocketFactory operations.
          default: false
          examples:
          - false
          type: boolean
        sslctx:
          description: Enable tracing of SSLContext operations.
          default: false
          examples:
          - false
          type: boolean
        trustmanager:
          description: Enable tracing of trust manager operations.
          default: false
          examples:
          - false
          type: boolean
    SSLLooseConfig:
      title: SSLLooseConfig
      description: Loose SSL configuration that relaxes security constraints.
      type: object
      properties:
        acceptAnyCertificate:
          description: Whether to accept any X.509 certificate, including self-signed
            ones. Not recommended for production.
          default: false
          examples:
          - false
          type: boolean
        allowLegacyHelloMessages:
          description: Whether to allow legacy SSL hello messages. Uses the platform
            default when not set.
          type: boolean
        allowUnsafeRenegotiation:
          description: Whether to allow unsafe TLS renegotiation. Uses the platform
            default when not set.
          type: boolean
        disableHostnameVerification:
          description: Whether to turn off hostname verification.
          default: false
          examples:
          - false
          type: boolean
        disableSNI:
          description: Whether to turn off Server Name Indication (SNI).
          default: false
          examples:
          - false
          type: boolean
    SSLParameters:
      title: SSLParameters
      description: SSL parameters configuration.
      type: object
      properties:
        clientAuth:
          description: Client authentication mode. `Need` fails the handshake if the
            peer doesn't provide credentials, `Want` verifies them if provided, `Default`
            uses the platform default.
          default: Default
          examples:
          - Default
          type: string
          maxLength: 16
          minLength: 1
        protocols:
          description: TLS protocol versions to enable for this SSL engine.
          examples:
          - - TLSv1.2
          type: array
          items:
            type: string
            maxLength: 16
            minLength: 1
    State:
      title: State
      description: Whether the proxy is enabled, turned off, or uses the default system
        setting.
      examples:
      - enabled
      type: string
      enum:
      - enabled
      - disabled
      - default
    StoreConfig:
      title: StoreConfig
      type: object
      required:
      - type
      properties:
        data:
          description: PEM or base64-encoded key store data, used as an alternative
            to a file path.
          examples:
          - LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t
          type: string
        filePath:
          description: Path to the key store file on disk.
          examples:
          - /etc/ssl/certs/thehive.jks
          type: string
        isFileOnClasspath:
          description: Whether the key store file is on the classpath.
          default: false
          examples:
          - false
          type: boolean
        password:
          description: Password to unlock the key store file.
          examples:
          - p@ssw0rd
          type: string
        type:
          description: Key store format.
          examples:
          - JKS
          type: string
    StringPropertyDescription:
      title: StringPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - customFields.threat-type
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - list
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/AnyIndexType'
        type:
          description: Identifies this property as a string.
          examples:
          - string
          type: string
          enum:
          - string
          const: string
    TTPField:
      title: TTPField
      type: string
      enum:
      - tactic
      - patternId
      - description
      - occurDate
      - _createdAt
      - _createdBy
      - _updatedAt
      - _updatedBy
    TTPList:
      title: TTPList
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - MITRE ATT&CK TTPs
          type: string
          maxLength: 512
          minLength: 1
        fields:
          description: TTP fields to display for each item in the list.
          type: array
          items:
            $ref: '#/components/schemas/TTPField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the TTP list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the TTP list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of TTPs to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    TTPTable:
      title: TTPTable
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - MITRE ATT&CK TTPs
          type: string
          maxLength: 512
          minLength: 1
        columns:
          description: TTP fields to include as columns in the table.
          type: array
          items:
            $ref: '#/components/schemas/TTPField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the TTP list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the TTP list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of TTPs to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    TaskField:
      title: TaskField
      type: string
      enum:
      - group
      - title
      - description
      - status
      - flag
      - startDate
      - endDate
      - assignee
      - dueDate
      - mandatory
      - _createdAt
      - _createdBy
      - _updatedAt
      - _updatedBy
    TaskList:
      title: TaskList
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Tasks
          type: string
          maxLength: 512
          minLength: 1
        fields:
          description: Task fields to display for each item in the list.
          type: array
          items:
            $ref: '#/components/schemas/TaskField'
        logColumns:
          description: Task log fields to display under each task when `withTaskLogs`
            is `true`.
          type: array
          items:
            $ref: '#/components/schemas/LogField'
        withTaskLogs:
          description: When `true`, includes task logs under each task entry.
          default: true
          examples:
          - true
          type: boolean
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the task list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the task list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of tasks to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    TaskTable:
      title: TaskTable
      type: object
      required:
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Tasks
          type: string
          maxLength: 512
          minLength: 1
        columns:
          description: Task fields to include as columns in the table.
          type: array
          items:
            $ref: '#/components/schemas/TaskField'
        filter:
          $ref: '#/components/schemas/Filter'
          description: Filter to apply to the task list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the filter syntax.
        sort:
          description: Sort order for the task list. See the [Query and Export](https://docs.strangebee.com/thehive/api-docs/#tag/Query-and-Export)
            section for the sort syntax.
          type: array
          items:
            examples:
            - +_createdAt
            oneOf:
            - $ref: '#/components/schemas/FieldDirection'
            - $ref: '#/components/schemas/Map_Direction'
            - examples:
              - +_createdAt
              type: string
        maxElements:
          description: Maximum number of tasks to include in the widget. If omitted,
            the global `maxElements` limit applies.
          examples:
          - 20
          type: integer
          format: int32
          exclusiveMinimum: 0
        _kind:
          $ref: '#/components/schemas/Kind'
    Text:
      title: Text
      type: object
      required:
      - template
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Executive Summary
          type: string
          maxLength: 512
          minLength: 1
        template:
          description: Mustache template string rendered as the widget body.
          examples:
          - This report covers the investigation of **{{case.title}}**.
          type: string
        _kind:
          $ref: '#/components/schemas/Kind'
    Timeline:
      title: Timeline
      type: object
      required:
      - withCustomEventsDescription
      - _kind
      properties:
        title:
          description: Title displayed above the widget.
          examples:
          - Case Timeline
          type: string
          maxLength: 512
          minLength: 1
        events:
          description: Types of events to include in the timeline.
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/TimelineEvents'
        withCustomEventsDescription:
          description: When `true`, includes the description field for custom timeline
            events.
          examples:
          - false
          type: boolean
        _kind:
          $ref: '#/components/schemas/Kind'
    TimelineEvents:
      title: TimelineEvents
      type: string
      enum:
      - Alert
      - Case
      - Task
      - Log
      - Observable
      - Procedure
      - Custom
    Timeout:
      title: Timeout
      description: Connection, idle, and request timeout settings.
      type: object
      required:
      - connection
      - idle
      - request
      properties:
        connection:
          description: Maximum time to wait to establish a connection.
          examples:
          - 2 minutes
          type: string
        idle:
          description: Maximum time a connection may remain idle before being closed.
          examples:
          - 2 minutes
          type: string
        request:
          description: Maximum time to wait for a complete response.
          examples:
          - 2 minutes
          type: string
    TokenParameter:
      title: TokenParameter
      type: object
      required:
      - key
      - value
      properties:
        key:
          description: Additional parameter key to include in the OAuth 2.0 token
            request.
          examples:
          - audience
          type: string
        value:
          description: Additional parameter value.
          examples:
          - thehive-api
          type: string
    UpdateAuth:
      title: UpdateAuth
      oneOf:
      - $ref: '#/components/schemas/BasicUpdateAuth'
      - $ref: '#/components/schemas/BearerUpdateAuth'
      - $ref: '#/components/schemas/KeyUpdateAuth'
      - $ref: '#/components/schemas/NoneUpdateAuth'
      - $ref: '#/components/schemas/OAuth2UpdateAuth'
      discriminator:
        propertyName: type
        mapping:
          basic: '#/components/schemas/BasicUpdateAuth'
          bearer: '#/components/schemas/BearerUpdateAuth'
          key: '#/components/schemas/KeyUpdateAuth'
          none: '#/components/schemas/NoneUpdateAuth'
          oauth2: '#/components/schemas/OAuth2UpdateAuth'
    UrlPropertyDescription:
      title: UrlPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - customFields.reference-link
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - list
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/AnyIndexType'
        type:
          description: Identifies this property as a URL.
          examples:
          - url
          type: string
          enum:
          - url
          const: url
    UserAccess:
      title: UserAccess
      type: object
      required:
      - users
      - _kind
      properties:
        users:
          description: Logins of the users who can access the case. Must include at
            least the case assignee and the user making the request. Must be a valid
            email address. Use `POST /api/v1/query` with `listUser` to retrieve available
            users and their email addresses.
          type: array
          items:
            type: string
            maxLength: 128
            pattern: ^(([^()\[\]\\.,;:\s@"]+(\.[^()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9 -퟿豈-﷏ﷰ-￯]+\.)+[a-zA-Z -퟿豈-﷏ﷰ-￯]{2,}))$
        _kind:
          description: Only a specific set of internal users can see the case. Platinum
            or One license required.
          type: string
          const: UserAccessKind
    UserPropertyDescription:
      title: UserPropertyDescription
      type: object
      required:
      - name
      - cardinality
      - aggregable
      - indexType
      - type
      properties:
        name:
          description: Name of the property, as used in `filter` and `sort` steps
            of `POST /api/v1/query`.
          examples:
          - assignee
          type: string
        cardinality:
          $ref: '#/components/schemas/Cardinality'
          examples:
          - option
        aggregable:
          description: Whether the property can be used in aggregation operations,
            such as grouping or counting, when building a query with `POST /api/v1/query`.
          examples:
          - true
          type: boolean
        indexType:
          $ref: '#/components/schemas/BasicIndexType'
        type:
          description: Identifies this property as a user reference.
          examples:
          - user
          type: string
          enum:
          - user
          const: user
    UserType:
      title: UserType
      examples:
      - Normal
      type: string
      enum:
      - Service
      - Normal
      - External
    Widget:
      title: Widget
      examples:
      - _kind: ObservableTable
        title: Observables
        columns:
        - dataType
        - data
        - tlp
        filter:
          _eq:
            _field: ioc
            _value: true
        sort:
        - +_createdAt
      oneOf:
      - $ref: '#/components/schemas/AlertList'
      - $ref: '#/components/schemas/AlertTable'
      - $ref: '#/components/schemas/Comments'
      - $ref: '#/components/schemas/CustomFields'
      - $ref: '#/components/schemas/CustomFieldsList'
      - $ref: '#/components/schemas/Image'
      - $ref: '#/components/schemas/ObservableList'
      - $ref: '#/components/schemas/ObservableTable'
      - $ref: '#/components/schemas/Pages'
      - $ref: '#/components/schemas/TTPList'
      - $ref: '#/components/schemas/TTPTable'
      - $ref: '#/components/schemas/TaskList'
      - $ref: '#/components/schemas/TaskTable'
      - $ref: '#/components/schemas/Text'
      - $ref: '#/components/schemas/Timeline'
      discriminator:
        propertyName: _kind
        mapping:
          AlertList: '#/components/schemas/AlertList'
          AlertTable: '#/components/schemas/AlertTable'
          Comments: '#/components/schemas/Comments'
          CustomFields: '#/components/schemas/CustomFields'
          CustomFieldsList: '#/components/schemas/CustomFieldsList'
          Image: '#/components/schemas/Image'
          ObservableList: '#/components/schemas/ObservableList'
          ObservableTable: '#/components/schemas/ObservableTable'
          Pages: '#/components/schemas/Pages'
          TTPList: '#/components/schemas/TTPList'
          TTPTable: '#/components/schemas/TTPTable'
          TaskList: '#/components/schemas/TaskList'
          TaskTable: '#/components/schemas/TaskTable'
          Text: '#/components/schemas/Text'
          Timeline: '#/components/schemas/Timeline'
    _and:
      title: _and
      description: Match records where all child filters match.
      type: object
      properties:
        _and:
          type: array
          items:
            $ref: '#/components/schemas/Filter'
    _any:
      title: _any
      description: Match all records.
      type: object
      required:
      - _any
      properties:
        _any: {}
    _between:
      title: _between
      description: Match records where the field value falls within the specified
        range.
      type: object
      required:
      - _between
      properties:
        _between:
          $ref: '#/components/schemas/FieldFromTo'
    _contains:
      title: _contains
      description: Match records where an array field contains the specified value.
      type: object
      required:
      - _contains
      properties:
        _contains:
          type: string
    _endsWith:
      title: _endsWith
      description: Match records where the field value ends with the specified string.
      type: object
      required:
      - _endsWith
      properties:
        _endsWith:
          $ref: '#/components/schemas/FieldValue'
    _eq:
      title: _eq
      description: Match records where the field value equals the specified value.
        Also accepts `_is` as a key.
      type: object
      required:
      - _eq
      properties:
        _eq:
          $ref: '#/components/schemas/FieldValue'
    _gt:
      title: _gt
      description: Match records where the field value is strictly greater than the
        specified value.
      type: object
      required:
      - _gt
      properties:
        _gt:
          $ref: '#/components/schemas/FieldValue'
    _gte:
      title: _gte
      description: Match records where the field value is greater than or equal to
        the specified value.
      type: object
      required:
      - _gte
      properties:
        _gte:
          $ref: '#/components/schemas/FieldValue'
    _id:
      title: _id
      description: Match a specific record by its internal ID.
      type: object
      required:
      - _id
      properties:
        _id:
          examples:
          - ~354
          type: string
    _in:
      title: _in
      description: Match records where the field value is one of the specified values.
      type: object
      required:
      - _in
      properties:
        _in:
          $ref: '#/components/schemas/FieldValues'
    _like:
      title: _like
      description: Match records where the field value contains the specified string
        (case-insensitive).
      type: object
      required:
      - _like
      properties:
        _like:
          $ref: '#/components/schemas/FieldValue'
    _lt:
      title: _lt
      description: Match records where the field value is strictly less than the specified
        value.
      type: object
      required:
      - _lt
      properties:
        _lt:
          $ref: '#/components/schemas/FieldValue'
    _lte:
      title: _lte
      description: Match records where the field value is less than or equal to the
        specified value.
      type: object
      required:
      - _lte
      properties:
        _lte:
          $ref: '#/components/schemas/FieldValue'
    _match:
      title: _match
      description: Match records where the field value contains the specified string
        using full-text search.
      type: object
      required:
      - _match
      properties:
        _match:
          $ref: '#/components/schemas/FieldValue'
    _ne:
      title: _ne
      description: Match records where the field value does not equal the specified
        value.
      type: object
      required:
      - _ne
      properties:
        _ne:
          $ref: '#/components/schemas/FieldValue'
    _not:
      title: _not
      description: Match records where the child filter does not match.
      type: object
      required:
      - _not
      properties:
        _not:
          $ref: '#/components/schemas/Filter'
    _or:
      title: _or
      description: Match records where at least one child filter matches.
      type: object
      properties:
        _or:
          type: array
          items:
            $ref: '#/components/schemas/Filter'
    _startsWith:
      title: _startsWith
      description: Match records where the field value starts with the specified string.
      type: object
      required:
      - _startsWith
      properties:
        _startsWith:
          $ref: '#/components/schemas/FieldValue'
    customFieldsAsObject:
      title: customFieldsAsObject
      examples:
      - threat-type: Malware
        severity: 3
      type: object
      additionalProperties: {}
    modelDescriptions:
      title: modelDescriptions
      examples:
      - case:
          label: case
          path: ''
          initialQuery: listCase
          attributes:
          - name: customFields.threat-type
            cardinality: list
            aggregable: true
            indexType: fulltext
            type: string
          - name: severity
            cardinality: single
            values:
            - 1
            - 2
            - 3
            - 4
            labels:
            - low
            - medium
            - high
            - critical
            aggregable: true
            indexType: standard
            type: enumeration
      type: object
      additionalProperties:
        $ref: '#/components/schemas/EntityDescription'
  securitySchemes:
    ApiKey:
      type: http
      description: |
        Use your API key as a bearer token in the `Authorization` header.

        Generate a new API key with `POST /api/v1/user/{userId}/key/renew`, or retrieve an existing one with `GET /api/v1/user/{userId}/key`.

        If you have a [Normal user account](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/#types), you can also manage your API key in your [user settings](https://docs.strangebee.com/thehive/user-guides/manage-user-settings/#manage-your-api-key).

        **curl:**
        ```bash
        curl -X <http_method> -H 'Authorization: Bearer <api_key>' \
          https://<thehive_host>/api/v1/<endpoint>
        ```

        **python:**
        ```python
        import requests

        headers = {"Authorization": "Bearer <api_key>"}
        response = requests.<http_method>("https://<thehive_host>/api/v1/<endpoint>", headers=headers)
        ```
      scheme: bearer
    Basic:
      type: http
      description: |
        Only available for [Normal user accounts](https://docs.strangebee.com/thehive/user-guides/organization/configure-organization/manage-user-accounts/about-user-accounts/#types).

        Pass your login and password using HTTP Basic authentication. The login is typically an email address. If a default domain is configured in the [authentication settings](https://docs.strangebee.com/thehive/administration/authentication/configure-authentication), a plain username is also accepted.

        **curl:**
        ```bash
        curl -X <http_method> -u <login>:<password> \
          https://<thehive_host>/api/v1/<endpoint>
        ```

        **python:**
        ```python
        import requests

        response = requests.<http_method>("https://<thehive_host>/api/v1/<endpoint>", auth=("<login>", "<password>"))
        ```
      scheme: basic
    Session:
      type: apiKey
      description: |2

        This will retrieve the user information from the cookies. This is used by the frontend of TheHive and not suited for bots and automation.
        A Cookie is set in the browser after a user logs in (with login/password or SSO) with the name `THEHIVE-SESSION`
      name: THEHIVE-SESSION
      in: cookie
    Header:
      type: http
      description: |2

        In config, you must set which header field is used to identify user. You don't need to specify a password. This technique is used when authentication is performed upstream.

        With curl for instance:
        ```
        curl -H 'X-USER:myuser@thehive.local' ...
        ```
      scheme: basic
x-tagGroups:
- name: Standard Features
  tags:
  - Query and Export
- name: Case Management
  tags:
  - Case
  - Alert
  - Task
  - Task Log
  - Observable
  - Comment
  - Timeline
  - TTP
  - Share
  - Case Report
- name: User Management
  tags:
  - Organization
  - User
  - Profile
  - Permission
- name: Entities
  tags:
  - CustomField
  - AlertStatus
  - CaseStatus
  - Taxonomy
  - CaseTemplate
  - PageTemplate
  - SlaRule
  - Observable Type
  - Case Report Template
  - Tag
  - Att&ck
  - Page
- name: Connectors
  tags:
  - MISP
  - Email Intake
  - Alert Feeder
  - Orchestrator
  - Cortex
  - ThirdPartyProviders
  - Function
- name: Portal
  tags:
  - Attachment (Portal)
  - Case (Portal)
  - Comment (Portal)
  - Observable (Portal)
  - User (Portal)
  - Status (Portal)
- name: Admin
  tags:
  - Admin
  - License
  - Branding
  - Config
  - Features
  - GDPR
- name: Other
  tags:
  - Audit
  - Views
  - Describe
  - Dashboard
  - Status
  - Authenticated
  - Authentication