bigid/openapi/bigid-data-posture-api-openapi.yml at main · api-evangelist/bigid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
openapi: 3.0.3
info:
  title: BigID Data Posture API
  description: >-
    Fetch and remediate Data Security Posture Management (DSPM) findings via
    BigID's actionable insights API. List open security cases, update status in
    bulk, and resolve individual cases with audit reasons.
  version: '1.0'
  contact:
    name: BigID Support
    url: https://developer.bigid.com/
    email: support@bigid.com
  license:
    name: BigID Terms of Service
    url: https://bigid.com/terms/
servers:
  - url: https://{deployment}.bigid.com/api/v1
    description: Customer-hosted BigID deployment.
    variables:
      deployment:
        default: tenant
tags:
  - name: Actionable Insights
    description: DSPM cases and remediation.
paths:
  /actionable-insights/all-cases:
    get:
      tags:
        - Actionable Insights
      operationId: listActionableInsightsCases
      summary: List Actionable Insights Cases
      description: >-
        Fetch all existing security issues. Limit the selection with query
        parameters that filter by severity, status, asset type, or policy.
      security:
        - BearerAuth: []
      parameters:
        - name: filter
          in: query
          schema:
            type: string
        - name: limit
          in: query
          schema:
            type: integer
        - name: skip
          in: query
          schema:
            type: integer
      responses:
        '200':
          description: Cases retrieved.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      cases:
                        type: array
                        items:
                          $ref: '#/components/schemas/Case'
  /actionable-insights/cases:{actionType}:
    patch:
      tags:
        - Actionable Insights
      operationId: bulkUpdateActionableInsightsCases
      summary: Bulk Update Actionable Insights Cases
      description: Mark issues as resolved or update field values in bulk based on a filter expression.
      security:
        - BearerAuth: []
      parameters:
        - name: actionType
          in: path
          required: true
          schema:
            type: string
            enum:
              - resolve
              - update
              - acknowledge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                filter:
                  type: string
                update:
                  type: object
      responses:
        '200':
          description: Update accepted.
  /actionable-insights/case-status/{caseId}:
    patch:
      tags:
        - Actionable Insights
      operationId: updateActionableInsightsCaseStatus
      summary: Update Actionable Insights Case Status
      description: Update the status of a specific case (e.g. resolved) with an audit reason.
      security:
        - BearerAuth: []
      parameters:
        - name: caseId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
                  enum:
                    - open
                    - resolved
                    - silenced
                    - acknowledged
                auditReason:
                  type: string
      responses:
        '200':
          description: Case status updated.
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  schemas:
    Case:
      type: object
      properties:
        caseId:
          type: string
        caseStatus:
          type: string
          enum:
            - open
            - resolved
            - silenced
            - acknowledged
        severityLevel:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
        policyName:
          type: string
        dataSourceName:
          type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        auditReason:
          type: string