TheHive — API

274 endpoints
8 deprecated
4 versions archived since Jul 20, 2026
Last checked Nov 2, 2026

This guide covers everything you need to make your first successful API call to TheHive.

first call

$ curl "/api/v1/status" \
  -H "Authorization: Bearer $TOKEN"

Set $TOKEN first, then paste.

Base URL: /
Authenticate: Bearer token in the Authorization header Use your API key as a bearer token in the Authorization header.

3 other schemes

HTTP basic: username and password
API key in the THEHIVE-SESSION cookie
HTTP basic: username and password
Shape: GET86
POST94
PUT15
PATCH33
DELETE46

What it covers

Case 28 A case is the primary investigation entity in TheHive.
Alert 17 An alert is a security event generated by external detection tools such as SIEM, EDR, or threat intelligence platforms.
Cortex 16 A Cortex analyzer enriches an observable with contextual intelligence and produces a report.
User 14 You can identify a user by their _id or login.
Organization 13 An organization is an independent tenant in TheHive with its own users, cases, and settings.
Share 13 A share is a case-level access grant for a linked organization, with a permission profile and local sharing rules for tasks and observables.
Case Report Template 11 Case report templates define the layout used to generate reports from case descriptions.
Email Intake 11 The email intake connector connects TheHive to one or more mailboxes and automatically converts incoming emails into alerts.
Authentication 8 These endpoints handle authentication for TheHive: signing in and out, activating or deactivating multifactor authentication with a time-based one-time password app, and retrieving the password policy enforced by the…
Case Report 8 A case report is a generated document that summarizes key data from a case.
Function 8 A function is a user-defined JavaScript script that processes data and calls TheHive API.
Task 8 A task is a unit of work tracked within a case.

29 more areas

Task Log 8 A task log—also referred to as an activity—records actions, observations, and decisions made in response to a task.
Att&ck 7 Attack techniques, also called patterns, and tactics describe the behaviors and methods used by threat actors.
Observable 7 Observables are data points tracked within cases and alerts that represent specific events or indicators of suspicious or malicious activity.
Ttp 7 Tactics, techniques, and procedures (TTPs) record which attack techniques were observed on a case or alert, when they occurred, and optionally how they were carried out—referred to as the procedure.
Alert Feeder 6 An alert feeder retrieves data from an external system on a schedule and converts it into alerts using a JavaScript function.
License 6 A license controls the features and quotas available on a TheHive instance.
Page 6 Pages are structured Markdown documents for documentation within TheHive.
Taxonomy 6 Taxonomies are catalogs of structured tags used to label cases, alerts, and observables in TheHive.
Casetemplate 5 Case templates pre-fill fields when creating cases or applying templates to existing cases.
Dashboard 5 A dashboard compiles and visualizes data to give you key insights at a glance.
Branding 4 Branding lets you personalize TheHive with your own login page logo, navigation bar logo, favicon, and browser tab title.
Comment 4 Comments are short conversational notes attached to cases and alerts.
Customfield 4 Custom fields are additional fields that enrich cases and alerts in TheHive.
Misp 4 MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for sharing indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs) across organizations.
Observable Type 4 Observable types define the category of an observable in TheHive.
Profile 4 A profile defines the permissions available to a user within an organization in TheHive.
Views 4 Views save the filters, sort order, displayed columns, and display options applied to a list, so you can reapply them later without rebuilding them each time.
Alertstatus 3 An alert status represents the current state of an alert and belongs to one of four stages: New, In progress, Closed, or Imported.
Casestatus 3 A case status represents the current state of a case and belongs to one of three stages: New, In progress, or Closed.
Config 3 Your personal configuration items, stored as arbitrary JSON values under a key you choose.
Pagetemplate 3 Case pages are investigation-scoped documents for sharing notes, reports, and other content within a case.
Query And Export 3 A query is an array of chained steps that lets you search, filter, sort, and paginate data across any entity type.
Tag 3 Tags are labels assigned to cases, alerts, and observables in TheHive.
Timeline 3 A case timeline is a chronological view of all events that occurred during the case lifecycle.
Describe 2 Describe endpoints return metadata about entity models: their properties, each property's data type, cardinality, whether it's aggregable, its index type, and, for enumerated properties, the list of allowed values.
Status 2 Status endpoints return operational information about your TheHive instance: the platform version, license status, the status of each connector, enabled feature flags, and, for the authenticated endpoint, the Pekko…
Admin 1 Platform-level administration endpoint for TheHive.
Audit 1 An audit log entry records a single create, update, delete, merge, or function invocation performed in TheHive, capturing the action, the user who performed it, and the affected objects.
Permission 1 Permissions are the building blocks of profiles in TheHive.

Open an endpoint for a runnable command, its inputs and what it returns.

Case 28

Alert 17

DELETE /api/v1/alert/{alertId} Delete an alert

Loading…
DELETE /api/v1/alert/{alertId}/attachment/{attachmentId} Remove an attachment from an alert

Loading…
GET /api/v1/alert/{alertId} Get an alert

Loading…
GET /api/v1/alert/{alertId}/attachment/{attachmentId} Get an attachment from an alert deprecated

Loading…
GET /api/v1/alert/{alertId}/attachment/{attachmentId}/download Download an attachment from an alert deprecated

Loading…
GET /api/v1/alert/{alertId}/similar/{alertOrCaseId}/observables List observables shared with another alert or case

Loading…
PATCH /api/v1/alert/_bulk Update multiple alerts

Loading…
PATCH /api/v1/alert/{alertId} Update an alert

Loading…
POST /api/v1/alert Create an alert

Loading…
POST /api/v1/alert/delete/_bulk Delete multiple alerts

Loading…
POST /api/v1/alert/merge/_bulk Merge multiple alerts into a case

Loading…
POST /api/v1/alert/{alertId}/attachments Add attachments to an alert

Loading…
POST /api/v1/alert/{alertId}/case Create a case from an alert

Loading…
POST /api/v1/alert/{alertId}/follow Follow an alert

Loading…
POST /api/v1/alert/{alertId}/import/{caseId} Import alert observables and procedures into a case

Loading…
POST /api/v1/alert/{alertId}/merge/{caseId} Merge an alert into an existing case

Loading…
POST /api/v1/alert/{alertId}/unfollow Unfollow an alert

Loading…

Cortex 16

DELETE /api/v1/connector/cortex/analyzer/template/{analyzerTemplateId} Delete an analyzer template

Loading…
GET /api/v1/connector/cortex/analyzer List available analyzers

Loading…
GET /api/v1/connector/cortex/analyzer/template/content/{analyzerId} Get an analyzer template's content

Loading…
GET /api/v1/connector/cortex/analyzer/type/{dataType} List analyzers by observable data type

Loading…
GET /api/v1/connector/cortex/analyzer/{analyzerId} Get an analyzer

Loading…
GET /api/v1/connector/cortex/job/{jobId} Get a Cortex job

Loading…
GET /api/v1/connector/cortex/responder/{entityType}/{entityId} List responders available for an entity

Loading…
GET /api/v1/connector/cortex/responders/{entityType} List responders available for an entity type

Loading…
GET /api/v1/responder-execution/{scope}/{rootId} List responder executions for a case or alert

Loading…
GET /api/v1/responder-execution/{scope}/{rootId}/count Count responder executions for a case or alert

Loading…
PATCH /api/v1/connector/cortex/analyzer/template/{analyzerTemplateId} Update an analyzer template

Loading…
POST /api/v1/connector/cortex/action Run a responder

Loading…
POST /api/v1/connector/cortex/actions Run responders in bulk

Loading…
POST /api/v1/connector/cortex/analyzer/template Create an analyzer template

Loading…
POST /api/v1/connector/cortex/analyzer/template/_import Import analyzer templates in bulk

Loading…
POST /api/v1/connector/cortex/job Run an analyzer on an observable

Loading…

User 14

DELETE /api/v1/user/{userId} Lock a user account deprecated

Loading…
DELETE /api/v1/user/{userId}/force Delete a user account

Loading…
DELETE /api/v1/user/{userId}/key Revoke a user API key

Loading…
GET /api/v1/user/current Get current user info

Loading…
GET /api/v1/user/{userId} Get a user account

Loading…
GET /api/v1/user/{userId}/avatar/{file} Get a user avatar

Loading…
GET /api/v1/user/{userId}/key Get a user API key

Loading…
PATCH /api/v1/user/{userId} Update a user account

Loading…
POST /api/v1/user Create a user account

Loading…
POST /api/v1/user/current/attachments Upload temporary attachments

Loading…
POST /api/v1/user/{userId}/key/renew Renew a user API key

Loading…
POST /api/v1/user/{userId}/password/change Change a user account password

Loading…
POST /api/v1/user/{userId}/password/set Set a user account password

Loading…
PUT /api/v1/user/{userId}/organisations Set user account organizations

Loading…

Organization 13

DELETE /api/v1/attachment/{attachmentId} Remove a file from an organization

Loading…
DELETE /api/v1/organisation/{orgId}/link/{otherOrgId} Remove a link between two organizations

Loading…
GET /api/v1/attachment/{attachmentId} Get a file from an organization

Loading…
GET /api/v1/attachment/{attachmentId}/download Download a file from an organization

Loading…
GET /api/v1/organisation/{orgId} Get an organization

Loading…
GET /api/v1/organisation/{orgId}/avatar/{fileHash} Get the avatar of an organization

Loading…
GET /api/v1/organisation/{orgId}/links List organization links

Loading…
GET /api/v1/sharingProfile List sharing profiles

Loading…
PATCH /api/v1/organisation/{orgId} Update an organization

Loading…
POST /api/v1/attachment Add files to an organization

Loading…
POST /api/v1/organisation Create an organization

Loading…
PUT /api/v1/organisation/{orgId}/link/{otherOrgId} Link two organizations

Loading…
PUT /api/v1/organisation/{orgId}/links Replace all links for an organization

Loading…

Case Report Template 11

DELETE /api/v1/caseReportTemplate/{idOrName} Delete a case report template

Loading…
DELETE /api/v1/caseReportTemplate/{templateId}/attachment/{attachmentId} Remove an attachment from a case report template

Loading…
GET /api/v1/caseReportTemplate/_info List available widget types and field options

Loading…
GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export Export a case report template as a file

Loading…
GET /api/v1/caseReportTemplate/{templateId} Get a case report template

Loading…
GET /api/v1/caseReportTemplate/{templateId}/attachment/{attachmentId} Get an attachment from a case report template

Loading…
GET /api/v1/caseReportTemplate/{templateId}/attachment/{attachmentId}/download Download an attachment from a case report template

Loading…
PATCH /api/v1/caseReportTemplate/{idOrName} Update a case report template

Loading…
POST /api/v1/caseReportTemplate Create a case report template

Loading…
POST /api/v1/caseReportTemplate/import Import a case report template from a file

Loading…
POST /api/v1/caseReportTemplate/{templateId}/attachment Add an attachment to a case report template

Loading…

Email Intake 11

DELETE /api/v1/connector/email-intake/config/{configId} Delete a mailbox configuration

Loading…
GET /api/v1/connector/email-intake/config/{configId} Get a mailbox configuration

Loading…
GET /api/v1/connector/email-intake/configs Get the email intake module configuration

Loading…
GET /api/v1/connector/email-intake/providers List available email intake providers

Loading…
POST /api/v1/connector/email-intake/config Add a mailbox configuration

Loading…
POST /api/v1/connector/email-intake/config/authorizationCode Complete Google Workspace OAuth 2.0 authorization

Loading…
POST /api/v1/connector/email-intake/config/test Test a mailbox connection

Loading…
POST /api/v1/connector/email-intake/folders List mailbox folders

Loading…
POST /api/v1/connector/email-intake/sync Trigger an immediate email fetch

Loading…
PUT /api/v1/connector/email-intake/config/{configId} Update a mailbox configuration

Loading…
PUT /api/v1/connector/email-intake/configs Update the email intake module settings

Loading…

Authentication 8

GET /api/v1/auth/local/passwordPolicy Get the local authentication password policy

Loading…
GET /api/v1/auth/totp/get Get a TOTP secret to set up multifactor authentication

Loading…
GET /api/v1/logout Log out of your session

Loading…
POST /api/v1/auth/totp/set Activate multifactor authentication with a TOTP code

Loading…
POST /api/v1/auth/totp/unset Deactivate multifactor authentication for your account

Loading…
POST /api/v1/auth/totp/unset/{user} Deactivate multifactor authentication for another user

Loading…
POST /api/v1/login Log in to TheHive

Loading…
POST /api/v1/logout Log out of your session

Loading…

Case Report 8

DELETE /api/v1/caseReport/{reportId} Delete a case report

Loading…
GET /api/v1/caseReport/render Preview a case report without saving

Loading…
GET /api/v1/caseReport/{reportId}/download Download a case report file

Loading…
GET /api/v1/caseReport/{reportId}/view View a case report in the browser

Loading…
PATCH /api/v1/caseReport/{reportId} Replace the content of a case report

Loading…
POST /api/v1/case/{caseId}/report Generate a case report from a template

Loading…
POST /api/v1/case/{caseId}/report/upload Upload a case report file

Loading…
POST /api/v1/caseReport/render Preview a case report without saving

Loading…

Function 8

DELETE /api/v1/function/{functionId} Delete a function

Loading…
GET /api/v1/function/_context/documentation Get context object documentation

Loading…
GET /api/v1/function/{functionId} Get a function

Loading…
PATCH /api/v1/function/{functionId} Update a function

Loading…
POST /api/v1/function Create a function

Loading…
POST /api/v1/function/_test Test a function

Loading…
POST /api/v1/function/{function} Invoke a function

Loading…
POST /api/v1/function/{function}/{objectType}/{objectIdOrName} Invoke a function on a case or alert

Loading…

Task 8

DELETE /api/v1/task/{taskId} Delete a task

Loading…
GET /api/v1/task/{taskId} Get a task

Loading…
GET /api/v1/task/{taskId}/actionRequired Check action required for a task

Loading…
PATCH /api/v1/task/_bulk Update multiple tasks

Loading…
PATCH /api/v1/task/{taskId} Update a task

Loading…
POST /api/v1/case/{caseId}/task Create a task in a case

Loading…
PUT /api/v1/task/{taskId}/actionDone/{orgId} Set action done on a task

Loading…
PUT /api/v1/task/{taskId}/actionRequired/{orgId} Set action required on a task

Loading…

Task Log 8

DELETE /api/v1/log/{logId} Delete a task log

Loading…
DELETE /api/v1/log/{logId}/attachments/{attachmentId} Delete an attachment from a task log

Loading…
GET /api/v1/log/{caseId}/attachment/{attachmentId} Get an attachment from a task log deprecated

Loading…
GET /api/v1/log/{logId}/attachment/{attachmentId}/download Download an attachment from a task log deprecated

Loading…
GET /api/v1/observable/{observableId}/attachment/{attachmentId} Get an observable attachment

Loading…
PATCH /api/v1/log/{logId} Update a task log

Loading…
POST /api/v1/log/{logId}/attachments Add attachments to a task log

Loading…
POST /api/v1/task/{taskId}/log Create a task log

Loading…

Att&ck 7

DELETE /api/v1/catalog/{catalogId} Delete an attack technique catalog

Loading…
DELETE /api/v1/pattern/{patternId} Delete an attack technique

Loading…
GET /api/v1/pattern/case/{caseId} List attack techniques linked to a case

Loading…
GET /api/v1/pattern/{patternId} Get an attack technique

Loading…
PATCH /api/v1/catalog/{catalogId} Update an attack technique catalog

Loading…
POST /api/v1/catalog Create an attack technique catalog

Loading…
POST /api/v1/pattern/import/attack Import MITRE ATT&CK techniques

Loading…

Observable 7

DELETE /api/v1/observable/{observableId} Delete an observable

Loading…
GET /api/v1/observable/{observableId} Get an observable

Loading…
GET /api/v1/observable/{observableId}/attachment/{attachmentId}/download Download an attachment from an observable

Loading…
PATCH /api/v1/observable/_bulk Update multiple observables

Loading…
PATCH /api/v1/observable/{observableId} Update an observable

Loading…
POST /api/v1/alert/{alertId}/observable Add an observable to an alert

Loading…
POST /api/v1/case/{caseId}/observable Add an observable to a case

Loading…

Ttp 7

DELETE /api/v1/procedure/{procedureId} Delete a TTP

Loading…
PATCH /api/v1/procedure/{procedureId} Update a TTP

Loading…
POST /api/v1/alert/{alertId}/procedure Add a TTP to an alert

Loading…
POST /api/v1/alert/{alertId}/procedures Add multiple TTPs to an alert

Loading…
POST /api/v1/case/{caseId}/procedure Add a TTP to a case

Loading…
POST /api/v1/case/{caseId}/procedures Add multiple TTPs to a case

Loading…
POST /api/v1/procedure/delete/_bulk Delete multiple TTPs

Loading…

Alert Feeder 6

DELETE /api/v1/connector/alert-feeder/{alertFeederName} Delete an alert feeder

Loading…
GET /api/v1/connector/alert-feeder List all alert feeders

Loading…
POST /api/v1/connector/alert-feeder Create an alert feeder

Loading…
POST /api/v1/connector/alert-feeder/run/{alertFeederName} Run an alert feeder immediately

Loading…
POST /api/v1/connector/alert-feeder/test Test an alert feeder connection

Loading…
PUT /api/v1/connector/alert-feeder/{alertFeederName} Update an alert feeder

Loading…

License 6

GET /api/v1/license List all licenses

Loading…
GET /api/v1/license/challenge Get the license challenge token

Loading…
GET /api/v1/license/current Get the current license status

Loading…
GET /api/v1/license/{licenseId} Get a license

Loading…
POST /api/v1/license Add and activate a license

Loading…
PUT /api/v1/license/{licenseId}/activate Activate an existing license

Loading…

Page 6

DELETE /api/v1/case/{caseId}/page/{pageId} Delete a case page

Loading…
DELETE /api/v1/page/{pageId} Delete a Knowledge Base page

Loading…
PATCH /api/v1/case/{caseId}/page/{pageId} Update a case page

Loading…
PATCH /api/v1/page/{pageId} Update a Knowledge Base page

Loading…
POST /api/v1/case/{caseId}/page Create a case page

Loading…
POST /api/v1/page Create a Knowledge Base page

Loading…

Taxonomy 6

DELETE /api/v1/taxonomy/{taxonomyId} Delete a taxonomy

Loading…
GET /api/v1/taxonomy/{taxonomyId} Get a taxonomy

Loading…
POST /api/v1/taxonomy Create a taxonomy

Loading…
POST /api/v1/taxonomy/import-zip Import taxonomies from a ZIP archive

Loading…
PUT /api/v1/taxonomy/{taxonomyId}/activate Activate a taxonomy

Loading…
PUT /api/v1/taxonomy/{taxonomyId}/deactivate Deactivate a taxonomy

Loading…

Casetemplate 5

DELETE /api/v1/caseTemplate/{caseTemplateNameOrId} Delete a case template

Loading…
GET /api/v1/caseTemplate/{caseTemplateNameOrId} Get a case template

Loading…
PATCH /api/v1/caseTemplate/{caseTemplateNameOrId} Update a case template

Loading…
POST /api/v1/caseTemplate Create a case template

Loading…
PUT /api/v1/caseTemplate/{caseTemplateNameOrId}/pageTemplate/link Link page templates to a case template

Loading…

Dashboard 5

DELETE /api/v1/dashboard/{dashboardId} Delete a dashboard

Loading…
GET /api/v1/dashboard/{dashboardId} Get a dashboard

Loading…
PATCH /api/v1/dashboard/{dashboardId} Update a dashboard

Loading…
POST /api/v1/dashboard Create a dashboard

Loading…
POST /api/v1/dashboard/{dashboardId}/owner Change the owner of a dashboard

Loading…

Branding 4

DELETE /api/v1/branding/assets/{kind} Delete a branding asset

Loading…
GET /api/v1/branding Get branding

Loading…
GET /api/v1/branding/assets/{kind} Get a branding asset

Loading…
POST /api/v1/branding Set branding

Loading…

Comment 4

DELETE /api/v1/comment/{commentId} Delete a comment

Loading…
PATCH /api/v1/comment/{commentId} Update a comment

Loading…
POST /api/v1/alert/{alertId}/comment Add a comment to an alert

Loading…
POST /api/v1/case/{caseId}/comment Add a comment to a case

Loading…

Customfield 4

DELETE /api/v1/customField/{customFieldId} Delete a custom field

Loading…
GET /api/v1/customField List all custom fields

Loading…
PATCH /api/v1/customField/{customFieldId} Update a custom field

Loading…
POST /api/v1/customField Create a custom field

Loading…

Misp 4

GET /api/v1/connector/misp/_syncAlerts Trigger a MISP event synchronization

Loading…
GET /api/v1/connector/misp/status Get MISP server sync status

Loading…
POST /api/v1/connector/misp/case/import Import a MISP event as a case

Loading…
POST /api/v1/connector/misp/export/{caseId}/{mispName} Export a case to a MISP server

Loading…

Observable Type 4

DELETE /api/v1/observable/type/{typeId} Delete an observable type

Loading…
GET /api/v1/observable/type/{typeId} Get an observable type

Loading…
PATCH /api/v1/observable/type/{typeId} Update the case sensitivity of an observable type

Loading…
POST /api/v1/observable/type Create an observable type

Loading…

Profile 4

DELETE /api/v1/profile/{profileId} Delete a profile

Loading…
GET /api/v1/profile/{profileId} Get a profile

Loading…
PATCH /api/v1/profile/{profileId} Update a profile

Loading…
POST /api/v1/profile Create a profile

Loading…

Views 4

DELETE /api/v1/views/{viewsId} Delete a view

Loading…
GET /api/v1/views/{viewsId} Get a view

Loading…
PATCH /api/v1/views/{viewsId} Update a view

Loading…
POST /api/v1/views Create a view

Loading…

Alertstatus 3

DELETE /api/v1/alertStatus/{id} Delete an alert status

Loading…
PATCH /api/v1/alertStatus/{id} Update an alert status

Loading…
POST /api/v1/alertStatus Create an alert status

Loading…

Casestatus 3

DELETE /api/v1/caseStatus/{id} Delete a case status

Loading…
PATCH /api/v1/caseStatus/{id} Update a case status

Loading…
POST /api/v1/caseStatus Create a case status

Loading…

Config 3

GET /api/v1/config/user List your configuration items

Loading…
GET /api/v1/config/user/{path} Get a configuration item

Loading…
PUT /api/v1/config/user/{path} Set a configuration item

Loading…

Pagetemplate 3

DELETE /api/v1/pageTemplate/{pageTemplateId} Delete a case page template

Loading…
PATCH /api/v1/pageTemplate/{pageTemplateId} Update a case page template

Loading…
POST /api/v1/pageTemplate Create a case page template

Loading…

Query And Export 3

GET /api/v1/export Warning: This is an unstable route.

Loading…
GET /api/v1/export/_fields Warning: This is an unstable route.

Loading…
POST /api/v1/query Primary operations by entity | Entity | Operation | Description | |---|---|---| | Any entity | listAny | Lists all alerts, cases, observables, tasks, and task logs accessible to the current user, in a

Loading…

Tag 3

DELETE /api/v1/tag/{tagId} Delete a tag

Loading…
GET /api/v1/tag/{tagId} Get a tag

Loading…
PATCH /api/v1/tag/{tagId} Update a tag

Loading…

Timeline 3

DELETE /api/v1/customEvent/{eventId} Delete a custom event

Loading…
PATCH /api/v1/customEvent/{eventId} Update a custom event

Loading…
POST /api/v1/case/{caseId}/customEvent Add a custom event to a case timeline

Loading…

Describe 2

GET /api/v1/describe/_all Get the property metadata of every entity model

Loading…
GET /api/v1/describe/{model} Get the property metadata of an entity model

Loading…

Status 2

GET /api/v1/status Get the platform status

Loading…
GET /api/v1/status/public Get the public platform status

Loading…

Admin 1

PUT /api/v1/admin/log/set/{packageName}/{level} Set the log level for a package

Loading…

Audit 1

GET /api/v1/flow Get the audit trail of an object

Loading…

Permission 1

GET /api/v1/permission List all permissions

Loading…

Change log

2026-10-23
- +GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export
- +POST /api/v1/caseReportTemplate/import
2026-09-14
- +GET /api/v1/responder-execution/{scope}/{rootId}
- +GET /api/v1/responder-execution/{scope}/{rootId}/count
- −GET /api/v1/admin/check/stats
- −GET /api/v1/admin/index/status
- −GET /api/v1/admin/stats
- −GET /api/v1/caseReport/formats
- −GET /api/v1/connector/cortex/action/{entityType}/{entityId}
- −GET /api/v1/stream/{streamId}
- −POST /api/v1/admin/check/cancel
- −POST /api/v1/admin/check/{name}/dedup/trigger
- −POST /api/v1/admin/check/{name}/global/trigger
- −POST /api/v1/admin/index/{name}/rebuild
- −POST /api/v1/admin/index/{name}/reindex
- −POST /api/v1/admin/schema/info/{schemaName}
- −POST /api/v1/admin/schema/repair/{schemaName}
- −POST /api/v1/connector/cortex/job/_bulk
- −POST /api/v1/stream
- −POST /api/v1/user/{userId}/login/set
- −PUT /api/v1/admin/check/_all/trigger
- −PUT /api/v1/admin/check/{name}/trigger
2026-08-04
- ⚠DELETE /api/v1/user/{userId}
- ⚠GET /api/v1/alert/{alertId}/attachment/{attachmentId}
- ⚠GET /api/v1/alert/{alertId}/attachment/{attachmentId}/download
- ⚠GET /api/v1/case/{caseId}/attachment/{attachmentId}
- ⚠GET /api/v1/case/{caseId}/attachment/{attachmentId}/download
- ⚠GET /api/v1/case/{caseId}/links
- ⚠GET /api/v1/log/{caseId}/attachment/{attachmentId}
- ⚠GET /api/v1/log/{logId}/attachment/{attachmentId}/download