openapi: 3.0.0 info: description: This is a generic OAS 3.0 specification of Cloud Security APIs. version: 1.0.0 contact: name: Sophos Central APIs email: apis@sophos.com url: 'https://developer.sophos.com' title: Cloud Security APIs tags: - name: runtime-detections description: Runtime detections. servers: - url: 'https://api-{dataRegion}.central.sophos.com/cloud-security/v1' description: Regional service in the production environment. variables: dataRegion: description: The data region where tenant data is stored. default: eu01 enum: - eu01 - eu02 - us01 - us03 - ca01 - au01 - jp01 - in01 - br01 - ae01 security: - bearerAuth: [] paths: /profiles: get: x-soph-permissions: 'cns_runtime_detection:read' summary: List profiles description: List runtime detection profiles (Latest version). operationId: listProfiles tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid - in: query name: page required: false schema: type: integer default: 1 description: 'The page number to fetch, starting with 1.' - in: query name: pageSize required: false schema: type: integer default: 50 description: The size of the page requested. - name: searchTerm in: query description: Search by profile name. required: false schema: type: string minLength: 1 maxLength: 50 responses: '200': description: Runtime detection profiles fetched successfully. content: application/json: schema: type: object description: A page of runtime detection profiles (latest version). required: - items - pages properties: items: type: array description: List of runtime detection profiles. items: type: object description: Runtime detection profile metadata. required: - id - name - createdAt - version - defaultContentId properties: id: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: ID of the runtime detection profile. name: type: string example: RTD Profile 1 description: Name of the runtime detection profile. defaultContentId: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: >- ID of the default content used to create the runtime detection profile. contentVersion: type: string example: 3.4.8 description: >- Version of the default content used to create the runtime detection profile. createdAt: type: string format: date-time example: '2024-06-17T11:51:08' description: >- Creation date of the runtime detection profile in UTC. version: type: integer example: 3 description: Latest version of the runtime detection profile. policies: type: array description: >- List of policies using the runtime detection profile. items: type: object description: Policy metadata. required: - id - name - version properties: id: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: ID of the policy. name: type: string example: RTD Profile 1 description: Name of the policy. version: type: integer example: 3 description: Version of the profile linked to the policy. pages: type: object required: - current - size - maxSize properties: current: type: integer description: The 1-based page number being returned. size: type: integer description: The size of the page being returned. total: type: integer description: >- (Optional) The total number of pages that exist, if pageTotal=true in the request. items: type: integer description: (Optional) The total number of items across all pages. maxSize: type: integer description: The maximum page size that can be requested. '400': description: Invalid request for fetching profiles. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri delete: x-soph-permissions: 'cns_runtime_detection:write' summary: Delete profiles description: Delete profiles with provided IDs. operationId: deleteProfiles tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid - name: profileIds in: query description: List of runtime detection profile IDs to be deleted. required: true style: form explode: true schema: type: array items: type: string format: uuid maxItems: 500 responses: '200': description: Runtime detection profiles deleted successfully. content: application/json: schema: type: object description: Response for deletion request. properties: skippedProfiles: type: array description: >- List of profile IDs not deleted because they're in use. Remove them from the deletion request and try again. items: type: string format: uuid '400': description: Invalid request for deleting profiles. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri post: x-soph-permissions: 'cns_runtime_detection:write' summary: Create profile description: Create runtime detection profile or new version of existing profile. operationId: createProfile tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid requestBody: description: Create runtime detection profile request. required: true content: application/json: schema: type: object description: Create a profile. required: - contentVersion - settings properties: name: type: string description: >- Name of the runtime detection profile to create. Only include this parameter when creating a new profile. example: Profile name profileDescription: type: string example: RTD Profile1 is configured for prod deployments. description: Description of the new runtime detection profile version. profileId: type: string format: uuid description: >- ID of the profile for which to create a new version. Only include this parameter when creating a new version of an existing profile. example: 7b2d94de-2f89-4433-9901-c65d31195899 contentVersion: type: string description: >- Version of the default content to be used. Use the default content list API to get a list of supported versions. example: 6.4.8 settings: type: object description: >- Override settings for runtime detection profile. All settings override the default settings used on an endpoint or agent. properties: rules: type: array description: Rule override settings for runtime detection profile. items: type: object description: Settings for a rule in a runtime detection profile. properties: name: type: string example: Bootloader must be configured description: Rule name. enabled: type: boolean description: Whether the rule is enabled. lists: type: array description: >- Allow/block list override settings for runtime detection profile. items: type: object description: Override settings for a allow/block list. properties: name: type: string example: Boot_Files_Modified-programName-allowList description: The name of the list. operations: type: array description: List of override operations. items: type: object description: Override operation details. properties: behavior: type: string format: enum enum: - add - remove description: Type of override operation. list: type: array description: >- Allow/block list items included in the operation. items: type: string responses: '201': description: Runtime detection profile created successfully. content: application/json: schema: type: object description: Details of the runtime detection profile created. required: - id - version properties: id: type: string format: uuid description: ID of the runtime detection profile created. example: d7c15eef-9016-4c67-9a12-0e7a71c63db4 version: type: integer description: Version of the runtime detection profile created. '400': description: Invalid request for creating runtime detection profile. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '404': description: Profile ID doesn't exist. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '/profiles/{profileId}': get: x-soph-permissions: 'cns_runtime_detection:read' summary: Get profile description: Get runtime detection profile details. operationId: getProfile tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid - name: profileId in: path description: Runtime detection profile ID. required: true schema: type: string format: uuid - name: version in: query description: Profile version. required: false schema: type: integer responses: '200': description: Runtime detection profile fetched successfully. content: application/json: schema: type: object description: Runtime detection profile metadata. properties: id: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: ID of the runtime detection profile. name: type: string example: RTD Profile 1 description: Name of the runtime detection profile. profileDescription: type: string example: RTD Profile1 is configured for prod deployments description: Description of the runtime detection profile version. defaultContentId: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: >- ID of the default content used to create the runtime detection profile. contentVersion: type: string example: 3.4.8 description: >- Version of the default content used to create the runtime detection profile. diff: type: string example: YAML as a string here description: >- Override settings of the runtime detection profile in YAML format. createdAt: type: string format: date-time example: '2024-06-17T11:51:08' description: Creation date of the runtime detection profile in UTC. versions: type: array description: List of versions of the runtime detection profile. items: type: object description: Runtime detection profile version metadata. properties: version: type: integer example: 3 description: Version of the runtime detection profile. createdAt: type: string format: date-time example: '2024-06-17T11:51:08' description: >- Creation date of the runtime detection profile in UTC. '400': description: Invalid request for fetching profile. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '404': description: Runtime detection profile or profile version doesn't exist. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri put: x-soph-permissions: 'cns_runtime_detection:write' summary: Update profile name description: Update the name of a runtime detection profile. operationId: updateProfileName tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid - name: profileId in: path description: Runtime detection profile ID. required: true schema: type: string format: uuid - name: name in: query description: Runtime detection profile name to use. required: true schema: type: string minLength: 1 maxLength: 50 responses: '200': description: Runtime detection profile name updated. '400': description: Invalid request for updating the profile name. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '404': description: Profile ID doesn't exist. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri /profiles/default-contents: get: x-soph-permissions: 'cns_runtime_detection:read' summary: List content description: List available default contents. operationId: listDefaultContents tags: - runtime-detections parameters: - name: X-Tenant-ID in: header description: Tenant ID. required: true schema: type: string format: uuid responses: '200': description: Default contents list fetched successfully. content: application/json: schema: type: object description: The list of default contents. required: - items properties: items: type: array description: List of default contents. items: type: object description: Default content metadata. properties: id: type: string format: uuid example: 8adde1bf-3f94-451f-b218-3bbd2cb7010c description: The ID of the default content. version: type: string example: 5.4.8 description: The version of the default content. '401': description: Authentication failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '403': description: Authorization failed. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT