Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Body

application/json
intent
string
required

What the detection should look for and why

Minimum string length: 1
toolNames
string[]
required

Tool names available to the detection agent (used to infer data sources)

cliNames
string[]

CLI integration ids available to the detection agent (used as data sources at runtime)

detectionCadence
enum<string> | null

Cadence the detection will run on; the runtime prompt derives the primary lookback window from this metadata

Available options:
hourly,
daily,
weekly,
null
detectionId
string<uuid>

Optional detection ID when regenerating a plan for an existing detection

Response

Successful response

investigationPlan
string
required

Markdown investigation plan for backwards compatibility.

steps
object[]
required

Structured investigation plan steps.

Minimum array length: 1
systemPrompt
string
required

The assembled system prompt with intent + plan embedded