> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# List threat intelligence items
> Retrieves a paginated list of threat intelligence items with support for filtering by severity, platform, status, source, and text search
## OpenAPI
````yaml https://app.cotool.ai/api/docs/openapi.json get /items
openapi: 3.1.0
info:
title: Cotool API
version: 1.0.0
description: >-
# Cotool API Documentation
The Cotool API allows you to interact with the Cotool platform
programmatically, enabling you to build powerful integrations and automate
your workflows.
## Getting an API Key
Follow these steps to generate your API key:
1. **Log in** to the Cotool web interface
2. **Navigate** to `/settings/api-keys`
3. **Click** "Generate Key"
4. **Copy and store** your API key securely ⚠️ *It won't be shown again*
## API Key Authentication
For programmatic access and integrations, use your API key with the
Authorization header:
```http
Authorization: Bearer your_api_key_here
```
```bash
curl -X GET "https://app.cotool.ai/api/endpoint" \
-H "Authorization: Bearer your_api_key_here" \
-H "Content-Type: application/json"
```
servers:
- url: https://app.cotool.ai
description: Production server
security:
- ApiKeyAuth: []
paths:
/items:
get:
tags: []
summary: List threat intelligence items
description: >-
Retrieves a paginated list of threat intelligence items with support for
filtering by severity, platform, status, source, and text search
parameters:
- in: query
name: page
schema:
type: number
minimum: 1
- in: query
name: perPage
schema:
type: number
minimum: 1
maximum: 100
- in: query
name: severity
schema:
type: string
enum:
- none
- low
- medium
- high
- critical
- in: query
name: platform
schema:
type: string
- in: query
name: status
schema:
type: string
enum:
- active
- corrected
- retracted
- in: query
name: source
schema:
type: string
- in: query
name: search
schema:
type: string
- in: query
name: minRelevancyScore
schema:
type: number
minimum: 0
maximum: 100
- in: query
name: relevancyMode
schema:
type: string
enum:
- relevant
- all
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
properties:
id:
type: string
externalId:
type: string
source:
type: object
properties:
url:
type: string
format: uri
name:
type: string
publisher:
type: string
publishTime:
type: string
tlp:
type: string
enum:
- CLEAR
- GREEN
- AMBER
- AMBER+STRICT
- RED
license:
type: string
language:
type: string
required:
- url
- publisher
- publishTime
- language
event:
type: object
properties:
title:
type: string
eventFirstSeen:
type: string
eventLastSeen:
type: string
severity:
type: string
enum:
- none
- low
- medium
- high
- critical
confidence:
type: number
minimum: 0
maximum: 1
status:
type: string
enum:
- active
- corrected
- retracted
required:
- title
- severity
- confidence
- status
summary:
type: string
abstract:
type: string
tldr:
type: string
maxLength: 240
attackPath:
type: array
items:
type: string
classification:
type: object
properties:
attack:
type: array
items:
type: object
properties:
technique:
type: string
description: >-
Canonical MITRE ATT&CK technique ID (e.g.,
T1059 or T1059.001).
subTechnique:
type: string
description: >-
Sub-technique ID when applicable (e.g.,
T1059.001).
techniqueName:
type: string
description: >-
Resolved human-readable technique name.
Omit when unknown.
confidence:
type: number
minimum: 0
maximum: 1
description: >-
Confidence score in [0,1] based on
evidence quality.
evidenceRef:
type: string
description: >-
Optional reference to supporting evidence
(e.g., passage index or quote id).
required:
- technique
- confidence
description: >-
ATT&CK technique mapping with confidence.
Include techniqueName when resolvable.
description: >-
List of specific MITRE ATT&CK
techniques/sub-techniques with confidence.
Return [] when not explicitly evidenced—do not
infer.
killChain:
type: array
items:
type: string
enum:
- reconnaissance
- weaponization
- delivery
- exploitation
- installation
- c2
- actions
description: >-
Relevant kill chain phases demonstrated in the
content. Return [] when not evidenced.
malware:
type: array
items:
type: object
properties:
name:
type: string
description: Malware family/tool name.
confidence:
type: number
minimum: 0
maximum: 1
description: >-
Confidence score in [0,1] for malware
identification.
aliases:
type: array
items:
type: string
description: Known aliases for the malware family/tool.
required:
- name
- confidence
description: Malware identification claim.
description: >-
Malware families/tools implicated with
confidence. Return [] when none are mentioned.
actor:
type: array
items:
type: object
properties:
name:
type: string
description: Threat actor/group name.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for attribution.
aliases:
type: array
items:
type: string
description: Known aliases for the actor/group.
required:
- name
- confidence
description: Threat actor attribution claim.
description: >-
Threat actor/group attributions with confidence
and aliases. Return [] when attribution is
absent or speculative.
platforms:
type: array
items:
type: string
enum:
- windows
- linux
- macos
- ios
- android
- aws
- gcp
- azure
- o365
- okta
- kubernetes
description: >-
Affected platforms/environments. Return [] when
not stated.
mappings:
type: array
items:
type: object
properties:
framework:
type: string
description: Framework name (e.g., NIST, CIS).
id:
type: string
description: Framework control/technique identifier.
confidence:
type: number
minimum: 0
maximum: 1
description: Optional confidence in mapping in [0,1].
required:
- framework
- id
description: Mapping to other security frameworks.
description: >-
Mappings to other frameworks (e.g., NIST, CIS).
Return [] when not applicable.
required:
- attack
- killChain
- malware
- actor
- platforms
- mappings
description: >-
Classification including ATT&CK mapping, kill chain
phases, actors, malware, and platforms.
affectedProducts:
type: array
items:
type: object
properties:
vendor:
type: string
description: Vendor name of the affected product.
product:
type: string
description: Product name.
versions:
type: array
items:
type: string
description: >-
List of affected versions (ranges or specific
releases). Use [] when not specified. When
specific versions are known, always reference
them by a numerical value or range (no vague
references to "patch" or "latest" without a
specific version).
confidence:
type: number
minimum: 0
maximum: 1
description: >-
Optional confidence in product impact in
[0,1].
required:
- vendor
- product
- versions
description: >-
Affected vendor/product versions relevant for
scoping detections.
iocs:
type: object
properties:
ipv4:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
IPv4 address indicators. Omit this property when
none.
ipv6:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
IPv6 address indicators. Omit this property when
none.
domains:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Domain name indicators. Omit this property when
none.
urls:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: URL indicators. Omit this property when none.
hashes:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
File hash indicators (e.g., MD5/SHA1/SHA256).
Omit this property when none.
files:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
File path/name indicators. Omit this property
when none.
registryKeys:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Windows Registry key/path indicators. Omit this
property when none.
processes:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Process name/executable indicators. Omit this
property when none.
certs:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Certificate-related indicators (e.g., serial
numbers, SHA-1). Omit this property when none.
cloudIds:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Cloud resource identifiers (e.g., ARN, project
IDs). Omit this property when none.
mobileIds:
type: array
items:
type: object
properties:
type:
type: string
description: >-
IOC type (e.g., ipv4, domain, url,
sha256).
value:
type: string
description: Indicator value string as observed.
normalizedValue:
type: string
description: >-
Optional normalized form (e.g., lowercase
domain without trailing dot).
firstSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was first
observed. Omit when unknown.
lastSeen:
type: string
description: >-
ISO-8601 timestamp when IOC was last
observed. Omit when unknown.
ttlDays:
type: number
description: >-
Suggested TTL in days (domains≈30, IPs≈7,
hashes≈365). Omit when unknown.
status:
type: string
enum:
- active
- revoked
- superseded
- expired
description: >-
IOC lifecycle status: 'active', 'revoked',
'superseded', or 'expired'. Default to
'active' unless explicitly stated
otherwise.
confidence:
type: number
minimum: 0
maximum: 1
description: Confidence score in [0,1] for this IOC.
required:
- type
- value
- status
- confidence
description: >-
A single indicator of compromise with temporal
context and confidence.
description: >-
Mobile-specific identifiers (e.g., package
names). Omit this property when none.
description: >-
Grouped indicators of compromise extracted from the
content.
provenance:
type: object
properties:
supportingPassages:
type: array
items:
type: object
properties:
text:
type: string
description: >-
Exact quoted text supporting a technical
claim. Do not paraphrase.
sourceUrl:
type: string
format: uri
description: >-
Optional URL if the passage is from a
different source.
charSpan:
type: object
properties:
start:
type: number
description: >-
Start character offset (inclusive) of
quoted span within content.
end:
type: number
description: >-
End character offset (exclusive) of
quoted span within the analyzed content.
required:
- start
- end
description: >-
Character span for the quoted passage
within the analyzed content.
required:
- text
description: >-
Supporting evidence passages used to justify
extracted claims.
description: >-
Evidence snippets grounding technical claims and
mappings. Use [] when no precise evidence
exists.
required:
- supportingPassages
description: >-
Provenance information tying claims to exact
sources/passages.
version:
type: integer
exclusiveMinimum: 0
lastUpdated:
type: string
createdAt:
type: string
addedToFeedAt:
type: string
canonicalKey:
type: string
duplicateOf:
type: string
tenantOverrides: {}
required:
- id
- source
- event
- summary
- tldr
- attackPath
- classification
- affectedProducts
- iocs
- provenance
- version
total:
type: number
page:
type: number
perPage:
type: number
hasNext:
type: boolean
validations:
type: object
additionalProperties:
type:
- object
- 'null'
properties:
relevancyScore:
type: number
minimum: 0
maximum: 100
description: >-
Single numeric score (0-100) for how relevant the
threat is to this organization based on tool-derived
evidence. ≥70 generally indicates proceed to hunt;
0-30 not relevant; 31-69 uncertain/limited.
explanation:
type: array
items:
type: string
description: >-
3-6 compact bullets, each 1 sentence, citing
specific tool observations (e.g.,
platform/product/version presence, data sources
confirmed, explicit gaps). Avoid generic statements.
Wrap the specific clause(s) backed by a tool call in
inline citation spans of the form ..., where qN matches a
marker that preceded a
tool result in this run.
agentId:
type: string
format: uuid
executionId:
type: string
format: uuid
runAt:
type: string
format: date-time
description: ISO timestamp when the validation completed.
toolsUsed:
type: array
items:
type: string
description: >-
Tool identifiers actually invoked during validation
(e.g., "splunk.query", "sentinelone.search",
"aws.ec2.describe").
required:
- relevancyScore
- explanation
- agentId
- executionId
- runAt
- toolsUsed
outputs:
type: object
additionalProperties:
type:
- object
- 'null'
properties:
exposureScore:
type: number
minimum: 0
maximum: 100
description: >-
Single numeric score (0-100) estimating likelihood
of exposure, based strictly on tool evidence.
~90-100: compromised; 60-89: suspicious activity;
1-59: no evidence; 0: unknown.
exposureExplanation:
type: array
items:
type: string
description: >-
3-8 concise bullets summarizing the strongest
findings that drive the score. Each bullet should
reference specific tool evidence (hostnames, query
ids, brief log snippet summaries). Wrap the specific
clause(s) backed by a tool call in inline citation
spans of the form ..., where qN
matches a marker that
preceded a tool result in this run.
iocFindings:
type: array
items:
type: object
properties:
iocType:
type: string
description: >-
IOC category: one of "domain", "ip", "hash",
"url", "file-path", "process", "registry", or
a threat-specific label.
iocValue:
type: string
description: Exact indicator value that was searched.
found:
type: boolean
description: >-
True if any credible matches were identified
in tool results.
evidence:
type: string
description: >-
Short evidence note (≤280 chars): include
minimal context such as a timestamp, log id,
query reference, or snippet summary. Do not
paste full logs. May contain inline citation
spans of the form ...
referencing the tool call that produced the
finding.
affectedSystems:
type: array
items:
type: string
description: >-
Compact list of implicated assets (hostnames,
asset ids, instance ids) if applicable.
required:
- iocType
- iocValue
- found
description: >-
Per-indicator results actually searched. Include
only when indicators were checked; omit entirely if
no indicator search was performed.
timeline:
type: array
items:
type: object
properties:
timestamp:
type: string
format: date-time
description: >-
ISO timestamp of a notable event discovered
during the hunt.
description:
type: string
description: >-
One short sentence describing the event (what,
where).
required:
- timestamp
- description
description: >-
Optional, up to 10 items, ordered by time. Include
only if notable events were established from tool
evidence.
agentId:
type: string
format: uuid
executionId:
type: string
format: uuid
runAt:
type: string
format: date-time
description: ISO timestamp when the threat hunt completed.
toolsUsed:
type: array
items:
type: string
description: >-
Tool identifiers actually invoked during the hunt
(e.g., "splunk.query", "crowdstrike.search",
"vpcflow.scan").
required:
- exposureScore
- exposureExplanation
- agentId
- executionId
- runAt
- toolsUsed
required:
- items
- total
- page
- perPage
- hasNext
'400':
description: Bad request — input validation failed or the request was malformed
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
'401':
description: Unauthorized — missing or invalid API key / session
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden — the authenticated user lacks the required permissions
content:
application/json:
schema:
$ref: '#/components/schemas/PermissionError'
'500':
description: Internal server error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
x-codeSamples:
- lang: shell
label: cURL
source: |-
curl -X GET "https://app.cotool.ai/items" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"
components:
schemas:
ValidationError:
type: object
properties:
error:
type: string
description: Error message describing what went wrong
issues:
type: array
description: >-
Detailed validation issues, present when request or response schema
validation fails
items:
type: object
additionalProperties: true
required:
- error
Error:
type: object
properties:
error:
type: string
description: Error message describing what went wrong
required:
- error
PermissionError:
type: object
properties:
error:
type: string
description: Error message describing what went wrong
missingPerms:
type: array
description: Permissions the authenticated user is missing for this operation
items:
type: string
required:
- error
securitySchemes:
ApiKeyAuth:
type: http
scheme: bearer
bearerFormat: API Key
description: >-
API Key authentication for programmatic access. Include your API key in
the Authorization header as: `Bearer your_api_key_here`
````