New Fusion XDR GraphQL APIs and Classic XDR API deprecation

Date: 2026-09-18 API: Fusion XDR APIs

What changed¶

We added five GraphQL APIs to Fusion XDR. Use GraphQL for all new Fusion XDR integrations and write workflows.

• Detections GraphQL API v2: Search and manage detections from endpoints, network sensors, and other data sources. Read the Detections GraphQL API reference and getting started guide.
• Cases GraphQL API v2: Query and manage cases, evidence, comments, files, and links. Read the Cases GraphQL API reference and getting started guide.
• Threat Timeline GraphQL API v2: Search process lineage for up to 100 processes in one call. Read the Threat Timeline GraphQL API reference and getting started guide.
• Events GraphQL API v1: Retrieve event details by event ID. Read the Events GraphQL API reference and getting started guide.
• Live Endpoint Search GraphQL API v1: Run osquery-style queries against connected endpoints. Browse the catalog, author queries, target endpoints, and retrieve results and telemetry. Read the Live Endpoint Search GraphQL API reference and migration guide.

More GraphQL APIs are coming¶

We will publish more GraphQL API references in the coming weeks. The Assets API and Entity Graph API do not have references on this site yet.

We plan to release the Search GraphQL API in October 2026. Until then, use Data Lake Search for interactive searches. Continue to use the XDR Query API to access historical data in the Central Data Lake.

The Cases REST to GraphQL migration guide explains how to use these APIs to resolve case evidence and impacted entities.

Classic XDR API deprecation¶

The Cases REST API and Detections REST API are now called the Classic XDR APIs. These APIs are deprecated. The Cases REST API remains available for existing integrations, and the Detections REST API is already read-only.

At a later time, we will make the Cases REST API read-only. Both APIs will then provide historical data until we remove them.

The Live Discover REST API isn't part of this deprecation. Existing integrations continue to work. Live Endpoint Search provides the equivalent endpoint-query workflow over GraphQL.

Breaking change¶

No. The Classic XDR APIs remain available for existing integrations, and so does the Live Discover REST API.

Migration steps¶

• Cases REST API: Follow the Cases REST to GraphQL migration guide.
• Detections REST API: Follow the Detections REST to GraphQL migration guide.
• Live Discover REST API: Not required. For new integrations, follow Migrating from the Live Discover REST API, which maps each workflow and lists new capabilities and items to confirm before you migrate.