> ## Documentation Index > Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt > Use this file to discover all available pages before exploring further. # List Threats > The durable Threat catalog. Filterable by derived status, canonical type, coverage state, exposure state, hunt result badge, actor, linked Alert state, and free-text query. ## OpenAPI ````yaml https://app.cotool.ai/api/docs/openapi.json get /api/threats openapi: 3.1.0 info: title: Cotool API version: 1.0.0 description: >- # Cotool API Documentation The Cotool API allows you to interact with the Cotool platform programmatically, enabling you to build powerful integrations and automate your workflows. ## Getting an API Key Follow these steps to generate your API key: 1. **Log in** to the Cotool web interface 2. **Navigate** to `/settings/api-keys` 3. **Click** "Generate Key" 4. **Copy and store** your API key securely ⚠️ *It won't be shown again* ## API Key Authentication For programmatic access and integrations, use your API key with the Authorization header: ```http Authorization: Bearer your_api_key_here ``` ```bash curl -X GET "https://app.cotool.ai/api/endpoint" \ -H "Authorization: Bearer your_api_key_here" \ -H "Content-Type: application/json" ``` servers: - url: https://app.cotool.ai description: Production server security: - ApiKeyAuth: [] paths: /api/threats: get: tags: - Hunt summary: List Threats description: >- The durable Threat catalog. Filterable by derived status, canonical type, coverage state, exposure state, hunt result badge, actor, linked Alert state, and free-text query. parameters: - in: query name: q schema: type: string - in: query name: status schema: type: string enum: - active - assessing - assessment_failed - blocked - monitoring - covered - clear - not_relevant - resolved - dismissed - in: query name: canonicalType schema: type: string enum: - vulnerability - campaign - in: query name: coverageState schema: type: string enum: - none - partial - covered - unknown - in: query name: exposureState schema: type: string enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive - in: query name: huntResultBadge schema: type: string enum: - compromise_signal_found - exposure_found - covered_by_existing_detection - no_exposure_found - inconclusive - in: query name: actorId schema: type: string - in: query name: linkedAlertState schema: type: string enum: - active - terminal - none responses: '200': description: Successful response content: application/json: schema: type: object properties: threats: type: array items: type: object properties: threat: type: object properties: id: type: string organizationId: type: string canonicalType: type: string enum: - vulnerability - campaign canonicalKeyType: type: string enum: - cve - advisory - vendor_advisory - campaign_name - malware_family canonicalKey: type: string title: type: string aliases: type: array items: type: string actorId: type: - string - 'null' intelItemIds: type: array items: type: string relevancyScore: type: - number - 'null' exposureScore: type: - number - 'null' exposureState: type: - string - 'null' enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive - null coverageState: type: - string - 'null' enum: - none - partial - covered - unknown - null detectionEngineeringNote: type: - string - 'null' latestRunId: type: - string - 'null' assessmentRunningExecutionId: type: - string - 'null' assessmentFailedAt: type: - string - 'null' latestAlertId: type: - string - 'null' activeHuntAlertId: type: - string - 'null' dismissedAt: type: - string - 'null' dismissedByUserId: type: - string - 'null' dismissedReason: type: - string - 'null' createdAt: type: string updatedAt: type: string required: - id - organizationId - canonicalType - canonicalKeyType - canonicalKey - title - aliases - actorId - intelItemIds - relevancyScore - exposureScore - exposureState - coverageState - detectionEngineeringNote - latestRunId - assessmentRunningExecutionId - assessmentFailedAt - latestAlertId - activeHuntAlertId - dismissedAt - dismissedByUserId - dismissedReason - createdAt - updatedAt runs: type: array items: type: object properties: id: type: string threatId: type: string kind: type: string enum: - create - update trigger: type: string enum: - new_threat - intel_attached - manual - backfill - reclassification runAt: type: string relevancyExecutionId: type: string relevancyScore: type: number relevancyExplanation: type: array items: type: string exposureExecutionId: type: - string - 'null' exposureScore: type: - number - 'null' exposureState: type: - string - 'null' enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive - null exposureStory: type: - object - 'null' properties: exposureState: type: string enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive headline: type: string summary: type: array items: type: string exposureChecks: type: array items: type: object properties: purpose: type: string enum: - exposure - ioc - telemetry - detection_coverage iocType: type: string enum: - ip - domain - url - hash - file_path - process - registry_key - certificate - cloud_id - package - email - user_agent - mutex - other indicatorRole: type: string enum: - compromise - relevance checked: type: string source: type: string scope: type: string timeWindow: type: - object - 'null' properties: start: type: string end: type: string required: - start - end outcome: type: string enum: - found - not_found - inconclusive evidence: type: string limitations: type: array items: type: string required: - purpose - checked - source - scope - timeWindow - outcome - evidence - limitations assets: type: array items: type: object properties: identifier: type: string kind: type: string enum: - repository - host - service - cloud_resource - identity - package - domain - saas_account - container_image - other default: other platform: type: - string - 'null' default: null source: type: string internetFacing: type: - boolean - 'null' evidence: type: string required: - identifier - kind - platform - source - internetFacing - evidence iocFindings: type: array items: type: object properties: iocType: type: string enum: - ip - domain - url - hash - file_path - process - registry_key - certificate - cloud_id - package - email - user_agent - mutex - other role: type: string enum: - compromise - relevance default: compromise platform: type: - string - 'null' default: null iocValue: type: string evidence: type: string affectedSystems: type: array items: type: string required: - iocType - role - platform - iocValue - evidence - affectedSystems detectionCoverage: type: object properties: state: type: string enum: - none - partial - covered - unknown searches: type: array items: type: object properties: source: type: string criteria: type: string resultCount: type: number evidence: type: string limitations: type: array items: type: string required: - source - criteria - resultCount - evidence - limitations matches: type: array items: type: object properties: ref: type: object properties: id: type: string name: type: string kind: type: string enum: - rule_proposal - deployed_rule - detection_agent platform: type: - string - 'null' url: type: - string - 'null' required: - id - name - kind coverage: type: string enum: - partial - covered - unknown rationale: type: string limitations: type: array items: type: string required: - ref - coverage - rationale - limitations required: - state - searches - matches gaps: type: array items: type: object properties: product: type: string logSource: type: string scopeType: type: string enum: - org - integration - account - environment - asset_group - tenant - domain scopeId: type: - string - 'null' scopeKey: type: string blocking: type: boolean description: type: string limitations: type: array items: type: string required: - product - logSource - scopeType - scopeId - scopeKey - blocking - description - limitations nextSteps: type: array items: type: string timeline: type: array items: type: object properties: timestamp: type: string description: type: string required: - timestamp - description executionId: type: string runAt: type: string required: - exposureState - summary - exposureChecks - assets - iocFindings - detectionCoverage - gaps - nextSteps - executionId - runAt coverageState: type: - string - 'null' enum: - none - partial - covered - unknown - null hasFoundIoc: type: boolean hasBlockingGap: type: boolean diff: type: - object - 'null' properties: prevRunId: type: string beforeExposureScore: type: - number - 'null' afterExposureScore: type: - number - 'null' beforeExposureState: type: - string - 'null' enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive - null afterExposureState: type: - string - 'null' enum: - compromise_signal_found - exposure_found - no_exposure_found - inconclusive - null beforeCoverageState: type: - string - 'null' enum: - none - partial - covered - unknown - null afterCoverageState: type: - string - 'null' enum: - none - partial - covered - unknown - null reasons: type: array items: type: string required: - prevRunId - beforeExposureScore - afterExposureScore - beforeExposureState - afterExposureState - beforeCoverageState - afterCoverageState - reasons required: - id - threatId - kind - trigger - runAt - relevancyExecutionId - relevancyScore - relevancyExplanation - exposureExecutionId - exposureScore - exposureState - exposureStory - coverageState - hasFoundIoc - hasBlockingGap - diff deliverables: type: array items: oneOf: - type: object properties: id: type: string organizationId: type: string threatId: type: string executionId: type: string createdAt: type: string supersededById: type: - string - 'null' kind: type: string const: rule_proposal proposalId: type: - string - 'null' pullRequestUrl: type: - string - 'null' intent: type: string pinning: type: string enum: - ioc_pinned - behavioral - mixed pinnedIocs: type: array items: type: object properties: type: type: string value: type: string required: - type - value targetProduct: type: - string - 'null' targetLogSource: type: - string - 'null' lifecycleStatus: type: string enum: - authoring - drafted - in_review - shipped - dismissed - failed required: - id - organizationId - threatId - executionId - createdAt - supersededById - kind - proposalId - pullRequestUrl - intent - pinning - pinnedIocs - targetProduct - targetLogSource - lifecycleStatus - type: object properties: id: type: string organizationId: type: string threatId: type: string executionId: type: string createdAt: type: string supersededById: type: - string - 'null' kind: type: string const: gap gapId: type: - string - 'null' product: type: string logSource: type: string scopeType: type: string enum: - org - integration - account - environment - asset_group - tenant - domain scopeId: type: - string - 'null' scopeKey: type: string blocking: type: boolean description: type: string gapStatus: type: string enum: - open - resolved - dismissed establishedAt: type: string statusAt: type: - string - 'null' statusActor: anyOf: - type: object properties: type: type: string const: agent runId: type: string required: - type - runId - type: object properties: type: type: string const: human userId: type: string required: - type - userId - type: 'null' statusReason: type: - string - 'null' otherLinkedThreats: type: array items: type: object properties: threatId: type: string threatTitle: type: string canonicalKey: type: string blocking: type: boolean required: - threatId - threatTitle - canonicalKey - blocking required: - id - organizationId - threatId - executionId - createdAt - supersededById - kind - product - logSource - scopeType - scopeId - scopeKey - blocking - description - gapStatus - establishedAt - statusAt - statusActor - statusReason intelItems: type: array items: type: object properties: id: type: string title: type: string publisher: type: string sourceName: type: - string - 'null' url: type: - string - 'null' publishedAt: type: string tldr: type: - string - 'null' attackPath: type: array items: type: string summary: type: - string - 'null' attackTechniques: type: array items: type: object properties: id: type: string name: type: - string - 'null' required: - id - name malware: type: array items: type: string actors: type: array items: type: string platforms: type: array items: type: string affectedProducts: type: array items: type: object properties: name: type: string versions: type: array items: type: string required: - name - versions eventFirstSeen: type: - string - 'null' eventLastSeen: type: - string - 'null' required: - id - title - publisher - url - publishedAt - tldr - attackPath alerts: type: array items: type: object properties: id: type: string format: uuid description: Internal alert identifier displayId: type: string pattern: ^COT-\d+$ description: Human-readable alert identifier organizationId: type: string format: uuid description: Organization that owns the alert organizationName: type: string minLength: 1 description: >- URL-safe organization name used in durable alert paths title: type: string minLength: 1 description: Human-readable alert title description: type: - string - 'null' description: Markdown summary or details for the alert severity: type: - string - 'null' enum: - low - medium - high - critical - null description: Alert severity when known status: type: string enum: - open - in_progress - escalated - closed_true_positive - closed_false_positive - closed_true_positive_benign - dismissed description: >- Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed archives the alert and hides it from alert lists. source: type: object properties: category: type: string enum: - detection - trigger - hunt description: >- Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface. name: type: string enum: - cotool_detection - hunt - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone description: >- Filter-oriented alert source name. Trigger-created alerts use the trigger type. triggerType: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source when category is trigger required: - category - name - triggerType description: >- Filter-oriented source attribution for an alert. detection: type: - object - 'null' properties: id: type: - string - 'null' format: uuid description: Cotool detection identifier when known agentId: type: - string - 'null' format: uuid description: >- Cotool detection agent identifier when known ruleId: type: - string - 'null' format: uuid description: >- Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule name: type: string minLength: 1 description: Detection display name kind: type: string enum: - cotool - external description: >- Whether this detection attribution is internal or extracted origin: type: - string - 'null' enum: - user - orchestrator - null description: >- Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature. required: - id - agentId - ruleId - name - kind description: >- Detection attribution for the alert, when known. createdBy: type: string enum: - agent - trigger - system description: Actor class that created the alert. originAgentId: type: - string - 'null' format: uuid description: Agent that produced or owns the source flow originTriggerId: type: - string - 'null' format: uuid description: >- Trigger that created this alert, when source is an external trigger originRunId: type: - string - 'null' format: uuid description: Run that minted the alert, stored as chats.id originDetectionHitId: type: - string - 'null' format: uuid description: >- Detection hit that produced this alert, when applicable externalProvider: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: >- External trigger provider such as jira, linear, email, or webhook externalRef: type: - string - 'null' description: >- Provider-native event, ticket, message, or alert identifier externalUrl: type: - string - 'null' format: uri description: Provider-native URL for the originating object assignedAgentId: type: - string - 'null' format: uuid description: >- Response agent currently assigned to triage this alert triageRunId: type: - string - 'null' format: uuid description: >- Latest response-agent triage run for this alert, stored as chats.id dedupeKey: type: - string - 'null' description: Stable key used for idempotent alert creation createdAt: type: string description: ISO timestamp when the alert was created updatedAt: type: string description: ISO timestamp when the alert was last updated firstTriagedAt: type: - string - 'null' description: ISO timestamp when triage first started resolvedAt: type: - string - 'null' description: >- ISO timestamp when the alert reached a terminal closed status derivedDisposition: type: - string - 'null' enum: - true_positive - false_positive - true_positive_benign - null description: Disposition derived from terminal alert status originAgentName: type: - string - 'null' description: >- Display name for the origin agent, when available assignedAgentName: type: - string - 'null' description: >- Display name for the assigned triage agent, when available triggerSource: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source for external-trigger alerts resolvedByType: type: - string - 'null' enum: - human - agent - system - null description: >- Actor class that moved the alert to its terminal status. Null while the alert is not closed. resolvedByUserId: type: - string - 'null' format: uuid description: >- User who closed the alert, when a human closed it resolvedByAgentName: type: - string - 'null' description: >- Display name of the agent that closed the alert, when an agent closed it resolvedReason: type: - string - 'null' description: >- Reason recorded with the closing status change, when provided huntQualifiedBy: type: - string - 'null' enum: - compromise_signal_found - exposure_found - null description: >- Qualifying condition that opened this Hunt alert. Null for non-hunt alerts. required: - id - displayId - organizationId - organizationName - title - description - severity - status - source - detection - createdBy - originAgentId - originTriggerId - originRunId - originDetectionHitId - externalProvider - externalRef - externalUrl - assignedAgentId - triageRunId - dedupeKey - createdAt - updatedAt - firstTriagedAt - resolvedAt - derivedDisposition - originAgentName - assignedAgentName - triggerSource activeHuntAlert: type: - object - 'null' properties: id: type: string format: uuid description: Internal alert identifier displayId: type: string pattern: ^COT-\d+$ description: Human-readable alert identifier organizationId: type: string format: uuid description: Organization that owns the alert organizationName: type: string minLength: 1 description: >- URL-safe organization name used in durable alert paths title: type: string minLength: 1 description: Human-readable alert title description: type: - string - 'null' description: Markdown summary or details for the alert severity: type: - string - 'null' enum: - low - medium - high - critical - null description: Alert severity when known status: type: string enum: - open - in_progress - escalated - closed_true_positive - closed_false_positive - closed_true_positive_benign - dismissed description: >- Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed archives the alert and hides it from alert lists. source: type: object properties: category: type: string enum: - detection - trigger - hunt description: >- Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface. name: type: string enum: - cotool_detection - hunt - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone description: >- Filter-oriented alert source name. Trigger-created alerts use the trigger type. triggerType: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source when category is trigger required: - category - name - triggerType description: Filter-oriented source attribution for an alert. detection: type: - object - 'null' properties: id: type: - string - 'null' format: uuid description: Cotool detection identifier when known agentId: type: - string - 'null' format: uuid description: Cotool detection agent identifier when known ruleId: type: - string - 'null' format: uuid description: >- Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule name: type: string minLength: 1 description: Detection display name kind: type: string enum: - cotool - external description: >- Whether this detection attribution is internal or extracted origin: type: - string - 'null' enum: - user - orchestrator - null description: >- Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature. required: - id - agentId - ruleId - name - kind description: Detection attribution for the alert, when known. createdBy: type: string enum: - agent - trigger - system description: Actor class that created the alert. originAgentId: type: - string - 'null' format: uuid description: Agent that produced or owns the source flow originTriggerId: type: - string - 'null' format: uuid description: >- Trigger that created this alert, when source is an external trigger originRunId: type: - string - 'null' format: uuid description: Run that minted the alert, stored as chats.id originDetectionHitId: type: - string - 'null' format: uuid description: >- Detection hit that produced this alert, when applicable externalProvider: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: >- External trigger provider such as jira, linear, email, or webhook externalRef: type: - string - 'null' description: >- Provider-native event, ticket, message, or alert identifier externalUrl: type: - string - 'null' format: uri description: Provider-native URL for the originating object assignedAgentId: type: - string - 'null' format: uuid description: >- Response agent currently assigned to triage this alert triageRunId: type: - string - 'null' format: uuid description: >- Latest response-agent triage run for this alert, stored as chats.id dedupeKey: type: - string - 'null' description: Stable key used for idempotent alert creation createdAt: type: string description: ISO timestamp when the alert was created updatedAt: type: string description: ISO timestamp when the alert was last updated firstTriagedAt: type: - string - 'null' description: ISO timestamp when triage first started resolvedAt: type: - string - 'null' description: >- ISO timestamp when the alert reached a terminal closed status derivedDisposition: type: - string - 'null' enum: - true_positive - false_positive - true_positive_benign - null description: Disposition derived from terminal alert status originAgentName: type: - string - 'null' description: >- Display name for the origin agent, when available assignedAgentName: type: - string - 'null' description: >- Display name for the assigned triage agent, when available triggerSource: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source for external-trigger alerts resolvedByType: type: - string - 'null' enum: - human - agent - system - null description: >- Actor class that moved the alert to its terminal status. Null while the alert is not closed. resolvedByUserId: type: - string - 'null' format: uuid description: >- User who closed the alert, when a human closed it resolvedByAgentName: type: - string - 'null' description: >- Display name of the agent that closed the alert, when an agent closed it resolvedReason: type: - string - 'null' description: >- Reason recorded with the closing status change, when provided huntQualifiedBy: type: - string - 'null' enum: - compromise_signal_found - exposure_found - null description: >- Qualifying condition that opened this Hunt alert. Null for non-hunt alerts. required: - id - displayId - organizationId - organizationName - title - description - severity - status - source - detection - createdBy - originAgentId - originTriggerId - originRunId - originDetectionHitId - externalProvider - externalRef - externalUrl - assignedAgentId - triageRunId - dedupeKey - createdAt - updatedAt - firstTriagedAt - resolvedAt - derivedDisposition - originAgentName - assignedAgentName - triggerSource latestAlert: type: - object - 'null' properties: id: type: string format: uuid description: Internal alert identifier displayId: type: string pattern: ^COT-\d+$ description: Human-readable alert identifier organizationId: type: string format: uuid description: Organization that owns the alert organizationName: type: string minLength: 1 description: >- URL-safe organization name used in durable alert paths title: type: string minLength: 1 description: Human-readable alert title description: type: - string - 'null' description: Markdown summary or details for the alert severity: type: - string - 'null' enum: - low - medium - high - critical - null description: Alert severity when known status: type: string enum: - open - in_progress - escalated - closed_true_positive - closed_false_positive - closed_true_positive_benign - dismissed description: >- Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed archives the alert and hides it from alert lists. source: type: object properties: category: type: string enum: - detection - trigger - hunt description: >- Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface. name: type: string enum: - cotool_detection - hunt - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone description: >- Filter-oriented alert source name. Trigger-created alerts use the trigger type. triggerType: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source when category is trigger required: - category - name - triggerType description: Filter-oriented source attribution for an alert. detection: type: - object - 'null' properties: id: type: - string - 'null' format: uuid description: Cotool detection identifier when known agentId: type: - string - 'null' format: uuid description: Cotool detection agent identifier when known ruleId: type: - string - 'null' format: uuid description: >- Platform detection rule identifier (detection_rules inventory) when an external detection was matched to a synced rule name: type: string minLength: 1 description: Detection display name kind: type: string enum: - cotool - external description: >- Whether this detection attribution is internal or extracted origin: type: - string - 'null' enum: - user - orchestrator - null description: >- Origin of the Cotool detection agent when known. `orchestrator` marks a detection created by the retired Auto Detect feature. required: - id - agentId - ruleId - name - kind description: Detection attribution for the alert, when known. createdBy: type: string enum: - agent - trigger - system description: Actor class that created the alert. originAgentId: type: - string - 'null' format: uuid description: Agent that produced or owns the source flow originTriggerId: type: - string - 'null' format: uuid description: >- Trigger that created this alert, when source is an external trigger originRunId: type: - string - 'null' format: uuid description: Run that minted the alert, stored as chats.id originDetectionHitId: type: - string - 'null' format: uuid description: >- Detection hit that produced this alert, when applicable externalProvider: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: >- External trigger provider such as jira, linear, email, or webhook externalRef: type: - string - 'null' description: >- Provider-native event, ticket, message, or alert identifier externalUrl: type: - string - 'null' format: uri description: Provider-native URL for the originating object assignedAgentId: type: - string - 'null' format: uuid description: >- Response agent currently assigned to triage this alert triageRunId: type: - string - 'null' format: uuid description: >- Latest response-agent triage run for this alert, stored as chats.id dedupeKey: type: - string - 'null' description: Stable key used for idempotent alert creation createdAt: type: string description: ISO timestamp when the alert was created updatedAt: type: string description: ISO timestamp when the alert was last updated firstTriagedAt: type: - string - 'null' description: ISO timestamp when triage first started resolvedAt: type: - string - 'null' description: >- ISO timestamp when the alert reached a terminal closed status derivedDisposition: type: - string - 'null' enum: - true_positive - false_positive - true_positive_benign - null description: Disposition derived from terminal alert status originAgentName: type: - string - 'null' description: >- Display name for the origin agent, when available assignedAgentName: type: - string - 'null' description: >- Display name for the assigned triage agent, when available triggerSource: type: - string - 'null' enum: - jira - jira-automation - slack - linear - cron - webhook - email - bugcrowd - hackerone - null description: Trigger source for external-trigger alerts resolvedByType: type: - string - 'null' enum: - human - agent - system - null description: >- Actor class that moved the alert to its terminal status. Null while the alert is not closed. resolvedByUserId: type: - string - 'null' format: uuid description: >- User who closed the alert, when a human closed it resolvedByAgentName: type: - string - 'null' description: >- Display name of the agent that closed the alert, when an agent closed it resolvedReason: type: - string - 'null' description: >- Reason recorded with the closing status change, when provided huntQualifiedBy: type: - string - 'null' enum: - compromise_signal_found - exposure_found - null description: >- Qualifying condition that opened this Hunt alert. Null for non-hunt alerts. required: - id - displayId - organizationId - organizationName - title - description - severity - status - source - detection - createdBy - originAgentId - originTriggerId - originRunId - originDetectionHitId - externalProvider - externalRef - externalUrl - assignedAgentId - triageRunId - dedupeKey - createdAt - updatedAt - firstTriagedAt - resolvedAt - derivedDisposition - originAgentName - assignedAgentName - triggerSource activityEvents: type: array items: type: object properties: id: type: string threatId: type: string kind: type: string enum: - threat_created - intel_attached - reassessment_requested - assessment_started - relevancy_completed - exposure_started - assessment_failed actorType: type: string enum: - system - agent - human runId: type: - string - 'null' metadata: type: - object - 'null' properties: score: type: number hunting: type: boolean executionId: type: string canonicalKey: type: string label: type: string userId: type: string createdAt: type: string required: - id - threatId - kind - actorType - runId - metadata - createdAt capabilities: type: object properties: canReadEvidence: type: boolean canReassess: type: boolean canTriage: type: boolean required: - canReadEvidence - canReassess - canTriage required: - threat - runs - deliverables - intelItems - alerts - activeHuntAlert - latestAlert - activityEvents required: - threats '400': description: Bad request — input validation failed or the request was malformed content: application/json: schema: $ref: '#/components/schemas/ValidationError' '401': description: Unauthorized — missing or invalid API key / session content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — the authenticated user lacks the required permissions content: application/json: schema: $ref: '#/components/schemas/PermissionError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: shell label: cURL source: |- curl -X GET "https://app.cotool.ai/api/threats" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" components: schemas: ValidationError: type: object properties: error: type: string description: Error message describing what went wrong issues: type: array description: >- Detailed validation issues, present when request or response schema validation fails items: type: object additionalProperties: true required: - error Error: type: object properties: error: type: string description: Error message describing what went wrong required: - error PermissionError: type: object properties: error: type: string description: Error message describing what went wrong missingPerms: type: array description: Permissions the authenticated user is missing for this operation items: type: string required: - error securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here` ````