Skip to main content
GET
/
api
/
detection-rules
/
proposals
cURL
curl -X GET "https://app.cotool.ai/api/detection-rules/proposals" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
{
  "proposals": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>",
      "description": "<string>",
      "query": "<string>",
      "siemPlatform": "<string>",
      "reasoning": "<string>",
      "mitreTechniqueIds": [
        "<string>"
      ],
      "mitreTechniqueNames": [
        "<string>"
      ],
      "mitreTacticIds": [
        "<string>"
      ],
      "dataSourcesRequired": [
        "<string>"
      ],
      "suggestedTuning": {
        "exclusions": [
          "<string>"
        ],
        "thresholds": [
          "<string>"
        ],
        "expectedVolume": "<string>"
      },
      "status": "proposed",
      "validationResult": {
        "valid": true,
        "details": {
          "syntaxOk": true,
          "executionOk": true,
          "resultCount": 123,
          "executionTimeMs": 123
        },
        "error": "<string>"
      },
      "volumeCheckResult": {
        "checkedAt": "2023-11-07T05:31:56Z",
        "rowCount": 123,
        "executionTimeMs": 123,
        "timeRangeHours": 123,
        "bytesScanned": 123,
        "sampleResults": [
          {}
        ],
        "querySnapshot": "<string>"
      },
      "prUrl": "<string>",
      "prMergedAt": "2023-11-07T05:31:56Z",
      "publishMethod": "api",
      "publishedAt": "2023-11-07T05:31:56Z",
      "publishedRuleId": "<string>",
      "jobRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "dismissedReason": "<string>",
      "dismissedBy": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "dismissedAt": "2023-11-07T05:31:56Z",
      "publishingStartedAt": "2023-11-07T05:31:56Z",
      "createdAt": "2023-11-07T05:31:56Z",
      "updatedAt": "2023-11-07T05:31:56Z",
      "grade": 10,
      "gradeReason": "<string>",
      "testResultsSummary": "<string>"
    }
  ],
  "total": 123
}

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Query Parameters

status
string

Filter by status (comma-separated for multiple)

platform
string

Filter by SIEM platform

limit
string

Max results to return (default 50)

offset
string

Offset for pagination

includeDismissed
string

Include dismissed proposals (true/false, default false)

Response

200 - application/json

Successful response

proposals
object[]
required
total
number
required