Skip to main content
GET
/
api
/
detections
/
suggestions
cURL
curl -X GET "https://app.cotool.ai/api/detections/suggestions" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
{
  "suggestions": [
    {
      "id": "<string>",
      "organizationId": "<string>",
      "name": "<string>",
      "description": "<string>",
      "createdAt": "<string>",
      "updatedAt": "<string>",
      "deletedAt": "<string>",
      "toolNames": [
        "<string>"
      ],
      "inputs": [
        {
          "type": "text",
          "name": "<string>",
          "description": "<string>",
          "required": true
        }
      ],
      "modelAlias": "<unknown>",
      "planningMode": "auto",
      "agentType": "response",
      "isBuiltIn": true,
      "builtInAgentType": "threat-relevancy",
      "contextDocs": [
        {
          "provider": "googleDocs",
          "id": "<string>",
          "name": "<string>",
          "mimeType": "<string>"
        }
      ],
      "tinesStoryImportId": "<string>",
      "triggerSummary": [
        {
          "id": "<string>",
          "source": "jira",
          "name": "<string>",
          "enabled": true
        }
      ],
      "structuredOutputSchema": {
        "type": "string",
        "title": "<string>",
        "description": "<string>",
        "properties": {},
        "items": "<unknown>",
        "required": [
          "<string>"
        ],
        "enum": [
          "<string>"
        ],
        "x-cotool": {
          "presetId": "classification"
        }
      },
      "detectionCategory": "baseline_anomaly",
      "detectionQuery": "<string>",
      "siemType": "<string>",
      "detectionCadence": "hourly",
      "isSuggestion": true,
      "lastDetectionRunAt": "<string>",
      "activeSystemPrompt": {
        "id": "<string>",
        "prompt": "<string>",
        "description": "<string>"
      }
    }
  ]
}

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Response

200 - application/json

Successful response

suggestions
object[]
required

Array of detection suggestions

Agent configuration - can be either a built in (system-managed) or custom (user-created) agent