> ## Documentation Index > Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get detections overview > Unified detection-efficacy view across the whole detection suite: Cotool detection agents, the synced external rule inventory (detection_rules), and usable alert-reported detection labels active in the window that matched no inventory rule. Each item carries alert counts and dispositions (true positive / false positive / benign / escalated) over a rolling window, sorted noisiest-first. ## OpenAPI ````yaml https://app.cotool.ai/api/docs/openapi.json get /api/detections/overview openapi: 3.1.0 info: title: Cotool API version: 1.0.0 description: >- # Cotool API Documentation The Cotool API allows you to interact with the Cotool platform programmatically, enabling you to build powerful integrations and automate your workflows. ## Getting an API Key Follow these steps to generate your API key: 1. **Log in** to the Cotool web interface 2. **Navigate** to `/settings/api-keys` 3. **Click** "Generate Key" 4. **Copy and store** your API key securely ⚠️ *It won't be shown again* ## API Key Authentication For programmatic access and integrations, use your API key with the Authorization header: ```http Authorization: Bearer your_api_key_here ``` ```bash curl -X GET "https://app.cotool.ai/api/endpoint" \ -H "Authorization: Bearer your_api_key_here" \ -H "Content-Type: application/json" ``` servers: - url: https://app.cotool.ai description: Production server security: - ApiKeyAuth: [] paths: /api/detections/overview: get: tags: - Detections summary: Get detections overview description: >- Unified detection-efficacy view across the whole detection suite: Cotool detection agents, the synced external rule inventory (detection_rules), and usable alert-reported detection labels active in the window that matched no inventory rule. Each item carries alert counts and dispositions (true positive / false positive / benign / escalated) over a rolling window, sorted noisiest-first. parameters: - in: query name: windowDays description: Rolling window in days for alert counts. Defaults to 30. schema: type: integer minimum: 1 maximum: 365 description: Rolling window in days for alert counts. Defaults to 30. responses: '200': description: Successful response content: application/json: schema: type: object properties: windowDays: type: integer exclusiveMinimum: 0 description: Window applied to alert counts items: type: array items: type: object properties: key: type: string minLength: 1 description: >- Stable row key: cotool:, rule:, or external: kind: type: string enum: - cotool - external_rule - external_unlinked description: >- cotool = Cotool detection agent; external_rule = synced platform rule; external_unlinked = alert-reported detection label with no matching inventory rule id: type: - string - 'null' format: uuid description: >- Detection agent id (cotool) or detection rule id (external_rule); null for unlinked names name: type: string minLength: 1 description: Detection display name platform: type: string minLength: 1 description: >- Source platform for external rules (e.g. 'panther'); 'cotool' for detection agents; 'unknown' for unlinked names ruleType: type: - string - 'null' description: >- Platform-native rule type when known (e.g. Datadog 'log_detection' vs 'cloud_configuration'); null for Cotool agents and unlinked names severity: type: - string - 'null' description: >- Rule severity as reported by the platform, when available isEnabled: type: - boolean - 'null' description: >- Whether the detection is enabled; null when the platform does not expose it url: type: - string - 'null' description: Console deep link for external rules, when available alerts: type: object properties: total: type: integer minimum: 0 description: Alerts created within the window open: type: integer minimum: 0 description: Alerts currently open (within the window) inProgress: type: integer minimum: 0 description: Alerts currently in progress (within the window) escalated: type: integer minimum: 0 description: >- Alerts currently in escalated status — pending human closure (within the window) everEscalated: type: integer minimum: 0 description: >- Alerts (within the window) that reached escalated status at any point in their lifecycle, regardless of final disposition. Escalation is a stage, not a terminal outcome, so this overlaps with the closed_* counts. closedTruePositive: type: integer minimum: 0 description: >- Alerts closed as true positive (within the window) closedFalsePositive: type: integer minimum: 0 description: >- Alerts closed as false positive (within the window) closedTruePositiveBenign: type: integer minimum: 0 description: >- Alerts closed as true positive benign (within the window) dismissed: type: integer minimum: 0 description: >- Alerts dismissed/archived by a human (within the window) meanTimeToRespondSeconds: type: - number - 'null' minimum: 0 description: >- Mean seconds from alert creation to final closure for closed alerts created within the window; null when no alerts are closed lastAlertAt: type: - string - 'null' description: >- ISO timestamp of the most recent alert for this detection, regardless of window required: - total - open - inProgress - escalated - everEscalated - closedTruePositive - closedFalsePositive - closedTruePositiveBenign - dismissed - meanTimeToRespondSeconds - lastAlertAt description: >- Alert counts and dispositions attributed to this detection required: - key - kind - id - name - platform - ruleType - severity - isEnabled - url - alerts description: >- All Cotool agents and external inventory rules, plus usable unmatched alert-reported labels active in the window, sorted by windowed alert count descending required: - windowDays - items '400': description: Bad request — input validation failed or the request was malformed content: application/json: schema: $ref: '#/components/schemas/ValidationError' '401': description: Unauthorized — missing or invalid API key / session content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — the authenticated user lacks the required permissions content: application/json: schema: $ref: '#/components/schemas/PermissionError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: shell label: cURL source: |- curl -X GET "https://app.cotool.ai/api/detections/overview" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" components: schemas: ValidationError: type: object properties: error: type: string description: Error message describing what went wrong issues: type: array description: >- Detailed validation issues, present when request or response schema validation fails items: type: object additionalProperties: true required: - error Error: type: object properties: error: type: string description: Error message describing what went wrong required: - error PermissionError: type: object properties: error: type: string description: Error message describing what went wrong missingPerms: type: array description: Permissions the authenticated user is missing for this operation items: type: string required: - error securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here` ````