REST API Documentation
Basic Authorization header
A list of all currently added tags
GET /settings/tags HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
A list of all currently added tags
[
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"tag": "text",
"createdAt": "2025-12-07T02:40:54.556Z"
}
]Basic Authorization header
Tag was successfully added
Bad request was sent
Tag limit was reached
POST /settings/tags HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 14
{
"tag": "text"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"tag": "text",
"createdAt": "2025-12-07T02:40:54.556Z"
}Basic Authorization header
Tag was removed
Bad request was sent
DELETE /settings/tags/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
Password was successfully updated
Request validation failed
Configuration file is malformed
PUT /authentication/password HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 22
{
"newPassword": "text"
}No content
Basic Authorization header
Updated file system events configuration
Request validation failed
PUT /settings/events HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 45
{
"queryingDelay": "text",
"savingDelay": "text"
}{
"queryingDelay": "text",
"savingDelay": "text",
"incidentDetection": {
"enabled": true,
"yaraAnalysisEnabled": true,
"inactivityPeriod": "text"
}
}Basic Authorization header
Current file system events configuration
GET /settings/events HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current file system events configuration
{
"queryingDelay": "text",
"savingDelay": "text",
"incidentDetection": {
"enabled": true,
"yaraAnalysisEnabled": true,
"inactivityPeriod": "text"
}
}Basic Authorization header
Current listing of excluded paths
Excluded paths file was not found
GET /settings/excluded-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}
]
}Basic Authorization header
Path to exclude
Username for which the path should be excluded from monitoring
An excluded path entry was created
Request validation failed
Excluded paths file was not found
Excluded path already exists in the file
POST /settings/excluded-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 29
{
"path": "text",
"user": "text"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}Basic Authorization header
Excluded path identifier
Excluded path was removed
Excluded paths file was not found
DELETE /settings/excluded-paths/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
Excluded path identifier
A single excluded path
Excluded path was not found or excluded paths file was not found
GET /settings/excluded-paths/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}Basic Authorization header
OK
GET /settings/reports/file-event-report HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
OK
{
"enabled": true,
"scheduledHours": [
"02:40:54"
]
}Basic Authorization header
OK
Bad Request
PUT /settings/reports/file-event-report HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 16
{
"enabled": true
}{
"enabled": true,
"scheduledHours": [
"02:40:54"
]
}Basic Authorization header
OK
Bad Request
Conflict
POST /settings/reports/file-event-report/hours HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 19
{
"hour": "02:40:54"
}{
"enabled": true,
"scheduledHours": [
"02:40:54"
]
}Basic Authorization header
OK
Bad Request
Unprocessable Content
DELETE /settings/reports/file-event-report/hours HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"enabled": true,
"scheduledHours": [
"02:40:54"
]
}Basic Authorization header
OK
GET /settings/reports/file-event-report/excluded-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
OK
[
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}
]Basic Authorization header
Path to exclude
Username for which the path should be excluded from monitoring
Created
Bad Request
Conflict
POST /settings/reports/file-event-report/excluded-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 29
{
"path": "text",
"user": "text"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}Basic Authorization header
No Content
Bad Request
DELETE /settings/reports/file-event-report/excluded-paths/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
OK
GET /settings/reports/file-event-report/included-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
OK
[
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}
]Basic Authorization header
Path to include
Username for which the path should be included in file event reports
Created
Bad Request
Conflict
POST /settings/reports/file-event-report/included-paths HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 29
{
"path": "text",
"user": "text"
}{
"id": "123e4567-e89b-12d3-a456-426614174000",
"path": "text",
"user": "text"
}Basic Authorization header
No Content
Bad Request
DELETE /settings/reports/file-event-report/included-paths/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
File integrity configuration
GET /settings/file-integrity HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
File integrity configuration
{
"enabled": true,
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"prefix": "text",
"checkFileContents": true
}
]
}Basic Authorization header
Request to add new monitored path to file integrity configuration
Path prefix to monitor
Indicates if the file contents are checked to reduce number of false positives
OK
New path was successfully added
Request validation failed
Conflict
POST /settings/file-integrity HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 42
{
"prefix": "text",
"checkFileContents": true
}{
"enabled": true,
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"prefix": "text",
"checkFileContents": true
}
]
}Basic Authorization header
Updates file integrity strategy configuration
Indicates if the file integrity strategy is enabled
OK
Request validation failed
PUT /settings/file-integrity HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 16
{
"enabled": true
}{
"enabled": true,
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"prefix": "text",
"checkFileContents": true
}
]
}Basic Authorization header
ID of the path to be removed
Path was successfully removed
No Content
Request validation failed
DELETE /settings/file-integrity HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"enabled": true,
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"prefix": "text",
"checkFileContents": true
}
]
}Basic Authorization header
ID of path to update
Indicates if the file contents are checked to reduce number of false positives
OK
Not Found
PUT /settings/file-integrity/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 26
{
"checkFileContents": true
}{
"enabled": true,
"paths": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"prefix": "text",
"checkFileContents": true
}
]
}Basic Authorization header
A collection of all file system event types
GET /events/types HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
A collection of all file system event types
[
{
"id": 1,
"name": "text"
}
]Basic Authorization header
A collection of file system events
Request validation failed
GET /events HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"events": [
{
"filename": "text",
"oldFilename": "text",
"occurrenceTimeStamp": "2025-12-07T02:40:54.556Z",
"insertionTimeStamp": "2025-12-07T02:40:54.556Z",
"type": {
"id": 1,
"name": "text"
},
"username": "text",
"pid": 1,
"networkUsername": "text"
}
],
"nextRequestCursor": "text",
"numberOfItems": 1
}Basic Authorization header
A set of placement paths
Source path honeypot files
Updated honeypot configuration
Request validation failed
PUT /settings/honeypot HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 47
{
"placementPaths": [
"text"
],
"sourcePath": "text"
}{
"sourcePath": "text",
"placementPaths": [
"text"
]
}Basic Authorization header
Current honeypot configuration
GET /settings/honeypot HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current honeypot configuration
{
"sourcePath": "text",
"placementPaths": [
"text"
]
}Basic Authorization header
A set of placement paths
An updated honeypot configuration with the new placement path
Request validation failed
POST /settings/honeypot HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 24
{
"placementPath": "text"
}{
"sourcePath": "text",
"placementPaths": [
"text"
]
}Basic Authorization header
Placement path
An updated honeypot configuration without the selected placement path
Request validation failed
DELETE /settings/honeypot HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"sourcePath": "text",
"placementPaths": [
"text"
]
}Basic Authorization header
Incident identifier
Maximum number of entries to be returned
Cursor to filter out already returned entries
A list of affected files connected to an incident with a given identifier
Request validation failed
An incident with provided identifier was not found
GET /security-incidents/{incidentId}/files HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
[
{
"originalPath": "text",
"mostRecentPath": "text",
"firstModificationTime": "2025-12-07T02:40:54.556Z",
"modification": {
"id": 1,
"name": "text"
}
}
]Basic Authorization header
Incident identifier
A collection of events connected to an incident with a given identifier
Request validation failed
An incident with provided identifier was not found
GET /security-incidents/{id}/events HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"events": [
{
"filename": "text",
"oldFilename": "text",
"occurrenceTimeStamp": "2025-12-07T02:40:54.556Z",
"insertionTimeStamp": "2025-12-07T02:40:54.556Z",
"type": {
"id": 1,
"name": "text"
},
"username": "text",
"pid": 1,
"networkUsername": "text"
}
],
"nextRequestCursor": "text",
"numberOfItems": 1
}Basic Authorization header
User name. Only includes the incidents which were created for a specific user
A list of all detected security incidents
GET /security-incidents HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
A list of all detected security incidents
[
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"user": "text",
"start": "2025-12-07T02:40:54.556Z",
"end": "2025-12-07T02:40:54.556Z"
}
]Basic Authorization header
A list of all possible values of affected file modification types
GET /security-incidents/modification-types HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
A list of all possible values of affected file modification types
[
{
"id": 1,
"name": "text"
}
]Basic Authorization header
A request that registers an agent with a management server
Agent instance identifier
The Guard Mode management server address/host
API key identifier
API key secret
Registration response with an extra data about the node
Request validation failed
Agent is already registered with a server instance
POST /registrations HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 150
{
"instance_id": "123e4567-e89b-12d3-a456-426614174000",
"server_address": "text",
"key_id": "123e4567-e89b-12d3-a456-426614174000",
"api_key_secret": "text"
}{
"fqdn": "text",
"operatingSystem": "text"
}Basic Authorization header
Registration is removed
DELETE /registrations HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Registration is removed
No content
Basic Authorization header
Current block list data
GET /settings/block-list HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current block list data
{
"lastUpdated": "2025-12-07T02:40:54.556Z",
"fileGroupCount": 1
}Basic Authorization header
The timestamp which will be set as the 'last update time' for the block list
Collection of path filters
["*.exe"]Block list patterns were updated
Block list was not modified because it is already up to date
Request validation failed
PUT /settings/block-list HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 62
{
"lastUpdated": "2025-12-07T02:40:54.556Z",
"filters": [
"*.exe"
]
}No content
Basic Authorization header
Current skip list
GET /settings/block-list/skip HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current skip list
{
"filters": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"createdDate": "2025-12-07T02:40:54.556Z",
"pattern": "text"
}
]
}Basic Authorization header
Collection of path filters
["*.exe"]Skip list patterns updated
Request validation failed
PUT /settings/block-list/skip HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 21
{
"filters": [
"*.exe"
]
}No content
Basic Authorization header
File path pattern
Skip pattern added
Request validation failed
Pattern already exists in the skip list
POST /settings/block-list/skip HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 18
{
"pattern": "text"
}No content
Basic Authorization header
Skip list pattern identifier
Skip pattern was removed
Request validation failed
DELETE /settings/block-list/skip/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
Maximum number of entries to be returned
Cursor to filter out already returned entries
Returns a list of all scans, both ended and ongoing
Bad Request
GET /scans HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
[
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"startedAt": "2025-12-07T02:40:54.556Z",
"endedAt": "2025-12-07T02:40:54.556Z",
"lastScannedPath": "text",
"scannedFilesCount": 1,
"suspiciousFilesCount": 1,
"state": {
"id": 1,
"name": "text"
},
"pathsToScan": [
{
"value": "text",
"errorMessage": "text"
}
]
}
]Basic Authorization header
Scan creation request
Paths that will be recursively scanned
Indicates if file names found during scan should be analyzed to find files with names often used by ransomware
Indicates if files should be scanned using YARA rules
If true, Agent will raise alert on suspicious file found
If present, causes exclusions to work as if filesystem root was at each of provided paths
Returns a newly created scan
No content
Accepted
Bad request was sent
POST /scans HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 115
{
"paths": [
"text"
],
"checkBlockListPatterns": true,
"checkYaraRules": true,
"sendAlerts": true,
"rootMountPoints": [
"text"
]
}No content
Basic Authorization header
Returns a scan with provided ID
There is no scan with a given ID
GET /scans/{id} HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"startedAt": "2025-12-07T02:40:54.556Z",
"endedAt": "2025-12-07T02:40:54.556Z",
"lastScannedPath": "text",
"scannedFilesCount": 1,
"suspiciousFilesCount": 1,
"state": {
"id": 1,
"name": "text"
},
"pathsToScan": [
{
"value": "text",
"errorMessage": "text"
}
]
}Basic Authorization header
Maximum number of entries to be returned
Cursor to filter out already returned entries
Returns a list of suspicious files found by this scan
Bad Request
There is no scan with a given ID
GET /scans/{id}/suspicious-files HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"startedAt": "2025-12-07T02:40:54.556Z",
"endedAt": "2025-12-07T02:40:54.556Z",
"lastScannedPath": "text",
"scannedFilesCount": 1,
"suspiciousFilesCount": 1,
"state": {
"id": 1,
"name": "text"
},
"pathsToScan": [
{
"value": "text",
"errorMessage": "text"
}
]
}Basic Authorization header
Scan was successfully stopped
No content
Scan has already finished
Scan with provided ID doesn't exist
Scan with provided ID cannot be stopped
POST /scans/{id}/stop HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
No content
Basic Authorization header
Current SMB monitoring configuration
GET /settings/smb HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current SMB monitoring configuration
{
"enabled": true,
"message": {
"template": "text"
},
"listener": {
"port": 1,
"endMarker": "text"
}
}Basic Authorization header
Updated SMB monitoring configuration
Request validation failed
PUT /settings/smb HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 87
{
"enabled": true,
"message": {
"template": "text"
},
"listener": {
"port": 1,
"endMarker": "text"
}
}{
"enabled": true,
"message": {
"template": "text"
},
"listener": {
"port": 1,
"endMarker": "text"
}
}Basic Authorization header
Number of threshold buckets
Limit of data points to analyze
Updated threshold configuration
Request validation failed
PUT /settings/threshold HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 264
{
"entropyCheck": {
"enabled": true,
"maxCheckAttempts": 1
},
"magicNumberCheck": {
"enabled": true,
"filesChecked": 1
},
"yaraCheck": {
"enabled": true
},
"numberOfBuckets": 1,
"pointsLimit": 1,
"writesPerSecond": {
"high": 1,
"medium": 1,
"low": 1
},
"riskWeights": {
"high": 1,
"medium": 1,
"low": 1
}
}{
"entropyCheck": {
"enabled": true,
"maxCheckAttempts": 1
},
"magicNumberCheck": {
"enabled": true,
"filesChecked": 1
},
"yaraCheck": {
"isEnabled": true
},
"numberOfBuckets": 1,
"pointsLimit": 1,
"writesPerSecond": {
"high": 1,
"medium": 1,
"low": 1
},
"riskWeights": {
"high": 1,
"medium": 1,
"low": 1
}
}Basic Authorization header
Current threshold configuration
GET /settings/threshold HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current threshold configuration
{
"entropyCheck": {
"enabled": true,
"maxCheckAttempts": 1
},
"magicNumberCheck": {
"enabled": true,
"filesChecked": 1
},
"yaraCheck": {
"isEnabled": true
},
"numberOfBuckets": 1,
"pointsLimit": 1,
"writesPerSecond": {
"high": 1,
"medium": 1,
"low": 1
},
"riskWeights": {
"high": 1,
"medium": 1,
"low": 1
}
}Basic Authorization header
Updated configuration
Bad request was sent
PUT /settings/yara HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 225
{
"scans": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"threshold": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"fileIntegrity": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"incidents": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
}
}{
"scans": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"threshold": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"fileIntegrity": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"incidents": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
}
}Basic Authorization header
Current configuration
GET /settings/yara HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current configuration
{
"scans": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"threshold": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"fileIntegrity": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
},
"incidents": {
"rulesPath": "text",
"maxFileSizeInBytes": 1
}
}Basic Authorization header
OK
List of all known timezones
GET /settings/available-timezones HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
[
{
"id": "text",
"offset": "text"
}
]Basic Authorization header
Timezone configuration update request
ID of a timezone that will be set
Configuration was successfully updated
Bad request was sent
PUT /settings/timezone HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 19
{
"timeZone": "text"
}No content
Basic Authorization header
Current timezone configuration
GET /settings/timezone HTTP/1.1
Host:
Authorization: Basic username:password
api-version: text
Accept: */*
Current timezone configuration
{
"timeZone": {
"id": "text",
"offset": "text"
}
}Last updated