For the complete documentation index, see llms.txt. This page is also available as Markdown.

Modify Data

Table of Contents

Jira

#
API
Description

1

POST /api/jira/add

Adds a Jira project to the integration or updates bi-directional sync settings for an existing one. Supports both Jira Cloud (v3 API) and Data Center (v2 API).

2

POST /api/jira/delete

Removes a Jira project from the integration.

3

POST /api/jira/savePriorityFieldMapping

Saves the mapping from Akto severity levels to Jira field values for a project.

4

POST /api/createJiraIssue

Creates a Jira issue linked to an Akto testing run issue and stores the resulting Jira ticket URL.

5

POST /api/bulkCreateJiraTickets

Bulk creates Jira issues for multiple Akto testing run issues in a single request.

6

POST /api/attachFileToIssue

Attaches original and test HTTP request/response samples as a file to an existing Jira issue.

7

POST /api/createGeneralJiraTicket

Creates a general-purpose Jira ticket not tied to a specific testing run issue.

POST request for endpoint /api/jira/add

post
Body
baseUrlstringRequiredExample: https://example-org.atlassian.net
userEmailstringRequiredExample: admin@example.com
apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]
jiraTypestring · enumRequiredExample: CLOUDPossible values:
Responses
200

Jira project added/updated successfully

application/json
post/api/jira/add
POST /api/jira/add HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 227

{
  "baseUrl": "https://example-org.atlassian.net",
  "userEmail": "admin@example.com",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "jiraType": "CLOUD",
  "projectMappings": {
    "SCRUM": {
      "biDirectionalSyncSettings": {
        "enabled": false
      },
      "statuses": []
    }
  }
}
{
  "jiraIntegration": {
    "baseUrl": "https://example-org.atlassian.net",
    "userEmail": "admin@example.com",
    "projectIdsMap": {
      "SCRUM": [
        {
          "issueId": "10001",
          "issueType": "Bug"
        },
        {
          "issueId": "10002",
          "issueType": "Story"
        }
      ]
    },
    "projectMappings": {
      "SCRUM": {
        "biDirectionalSyncSettings": {
          "enabled": false
        },
        "statuses": []
      }
    },
    "createdTs": 1766398064,
    "updatedTs": 1766398064
  }
}

POST request for endpoint /api/jira/delete

post
Body
projIdstringRequired

Jira project key to remove

Example: SCRUM
Responses
200

Project removed successfully

application/json
objectOptional
post/api/jira/delete
POST /api/jira/delete HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 18

{
  "projId": "SCRUM"
}
{}

POST request for endpoint /api/jira/savePriorityFieldMapping

post
Body
projIdstringRequiredExample: SCRUM
fieldIdstringRequiredExample: priority
fieldValuesMapobjectRequired

Map of Akto severity → Jira field value ID

Example: {"HIGH":"1","MEDIUM":"3","LOW":"5"}
Responses
200

Priority mapping saved

application/json
objectOptional
post/api/jira/savePriorityFieldMapping
POST /api/jira/savePriorityFieldMapping HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 92

{
  "projId": "SCRUM",
  "fieldId": "priority",
  "fieldValuesMap": {
    "HIGH": "1",
    "MEDIUM": "3",
    "LOW": "5"
  }
}
{}

POST request for endpoint /api/createJiraIssue

post
Body
Responses
200

Jira issue created

application/json
jiraTicketKeystringOptionalExample: SCRUM-42
jiraTicketUrlstringOptionalExample: https://example-org.atlassian.net/browse/SCRUM-42
post/api/createJiraIssue
POST /api/createJiraIssue HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 197

{
  "jiraMetaData": {
    "testingIssueId": {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/users",
        "method": "GET"
      },
      "testSubCategory": "BOLA"
    },
    "projId": "SCRUM",
    "issueType": "Bug"
  }
}
{
  "jiraTicketKey": "SCRUM-42",
  "jiraTicketUrl": "https://example-org.atlassian.net/browse/SCRUM-42"
}

POST request for endpoint /api/bulkCreateJiraTickets

post
Body
Responses
200

Bulk Jira tickets created

application/json
objectOptional
post/api/bulkCreateJiraTickets
POST /api/bulkCreateJiraTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 203

{
  "testingRunIssueIds": [
    {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/users",
        "method": "GET"
      },
      "testSubCategory": "BOLA"
    }
  ],
  "jiraMetaData": {
    "projId": "SCRUM",
    "issueType": "Bug"
  }
}
{}

POST request for endpoint /api/attachFileToIssue

post
Body
origReqstringOptional

Raw HTTP request/response sample (original traffic)

Example: [RAW_HTTP_SAMPLE]
testReqstringOptional

Raw HTTP request/response sample (test attempt)

Example: [RAW_HTTP_TEST_SAMPLE]
issueIdstringRequired

Jira issue key

Example: SCRUM-42
Responses
200

File attached to issue

application/json
objectOptional
post/api/attachFileToIssue
POST /api/attachFileToIssue HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "origReq": "[RAW_HTTP_SAMPLE]",
  "testReq": "[RAW_HTTP_TEST_SAMPLE]",
  "issueId": "SCRUM-42"
}
{}

POST request for endpoint /api/createGeneralJiraTicket

post
Body
projIdstringRequiredExample: SCRUM
issueTypestringRequiredExample: Bug
titlestringRequiredExample: Potential BOLA vulnerability on /api/v1/users endpoint
descriptionstringOptionalExample: Unauthorized access to other users' data was detected.
labelsstringOptionalExample: security,akto
threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd
actionItemTypestringOptionalExample: THREAT
Responses
200

Jira ticket created

application/json
jiraTicketUrlstringOptionalExample: https://example-org.atlassian.net/browse/SCRUM-43
post/api/createGeneralJiraTicket
POST /api/createGeneralJiraTicket HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 278

{
  "projId": "SCRUM",
  "issueType": "Bug",
  "title": "Potential BOLA vulnerability on /api/v1/users endpoint",
  "description": "Unauthorized access to other users' data was detected.",
  "labels": "security,akto",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "actionItemType": "THREAT"
}
{
  "jiraTicketUrl": "https://example-org.atlassian.net/browse/SCRUM-43"
}

Azure Boards

#
API
Description

1

POST /api/addAzureBoardsIntegration

Adds or updates the Azure Boards integration configuration.

2

POST /api/removeAzureBoardsIntegration

Removes the Azure Boards integration configuration.

3

POST /api/createAzureBoardsWorkItem

Creates an Azure Boards work item linked to an Akto testing run issue.

4

POST /api/bulkCreateAzureWorkItems

Bulk creates Azure Boards work items for multiple Akto testing run issues in a single request.

5

POST /api/createGeneralAzureBoardsWorkItem

Creates a general-purpose Azure Boards work item not tied to a specific testing run issue.

POST request for endpoint /api/addAzureBoardsIntegration

post
Body
azureBoardsBaseUrlstringRequiredExample: https://dev.azure.com
organizationstringRequiredExample: example-corp
projectListstring[]RequiredExample: ["AktoSecurity","InfraTeam"]
personalAuthTokenstringRequiredExample: [REDACTED_AZURE_PAT]
Responses
200

Integration saved

application/json
objectOptional
post/api/addAzureBoardsIntegration
POST /api/addAzureBoardsIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 162

{
  "azureBoardsBaseUrl": "https://dev.azure.com",
  "organization": "example-corp",
  "projectList": [
    "AktoSecurity",
    "InfraTeam"
  ],
  "personalAuthToken": "[REDACTED_AZURE_PAT]"
}
{}

POST request for endpoint /api/removeAzureBoardsIntegration

post
Body
objectOptional
Responses
200

Integration removed

application/json
objectOptional
post/api/removeAzureBoardsIntegration
POST /api/removeAzureBoardsIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/createAzureBoardsWorkItem

post
Body
workItemTypestringRequiredExample: Bug
projectNamestringRequiredExample: AktoSecurity
aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com
threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd
titlestringOptionalExample: BOLA vulnerability on /api/v1/users
descriptionstringOptionalExample: Unauthorized data access detected.
Responses
200

Work item created

application/json
azureBoardsWorkItemUrlstringOptionalExample: https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/42
post/api/createAzureBoardsWorkItem
POST /api/createAzureBoardsWorkItem HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 403

{
  "workItemType": "Bug",
  "projectName": "AktoSecurity",
  "testingIssuesId": {
    "apiInfoKey": {
      "apiCollectionId": 1748293710,
      "url": "https://api.example.com/v1/users",
      "method": "GET"
    },
    "testSubCategory": "BOLA"
  },
  "aktoDashboardHostName": "https://app.akto.example.com",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "title": "BOLA vulnerability on /api/v1/users",
  "description": "Unauthorized data access detected."
}
{
  "azureBoardsWorkItemUrl": "https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/42"
}

POST request for endpoint /api/bulkCreateAzureWorkItems

post
Body
testingIssuesIdListobject[]Required

Array of TestingIssuesId objects

projectNamestringRequiredExample: AktoSecurity
workItemTypestringRequiredExample: Bug
aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com
Responses
200

Work items created

application/json
objectOptional
post/api/bulkCreateAzureWorkItems
POST /api/bulkCreateAzureWorkItems HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 133

{
  "testingIssuesIdList": [
    {}
  ],
  "projectName": "AktoSecurity",
  "workItemType": "Bug",
  "aktoDashboardHostName": "https://app.akto.example.com"
}
{}

POST request for endpoint /api/createGeneralAzureBoardsWorkItem

post
Body
workItemTypestringRequiredExample: Bug
projectNamestringRequiredExample: AktoSecurity
titlestringRequiredExample: Threat detected on /api/v1/chat endpoint
descriptionstringOptionalExample: Prompt injection attempt detected at 2024-01-15 14:32 UTC
threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd
templateIdstringOptionalExample: filter-template-uuid-001
endpointstringOptionalExample: /api/v1/chat
originalMessagestringOptionalExample: [RAW_HTTP_SAMPLE]
Responses
200

Work item created

application/json
azureBoardsWorkItemUrlstringOptionalExample: https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/43
post/api/createGeneralAzureBoardsWorkItem
POST /api/createGeneralAzureBoardsWorkItem HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 335

{
  "workItemType": "Bug",
  "projectName": "AktoSecurity",
  "title": "Threat detected on /api/v1/chat endpoint",
  "description": "Prompt injection attempt detected at 2024-01-15 14:32 UTC",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "templateId": "filter-template-uuid-001",
  "endpoint": "/api/v1/chat",
  "originalMessage": "[RAW_HTTP_SAMPLE]"
}
{
  "azureBoardsWorkItemUrl": "https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/43"
}

Datadog

#
API
Description

1

POST /api/saveDataDogConfigs

Saves Datadog configuration settings for the integration.

2

POST /api/addDatadogIntegration

Adds or updates the Datadog integration configuration.

3

POST /api/deleteDatadogIntegration

Removes the Datadog integration configuration.

4

POST /api/testDatadogIntegration

Tests the Datadog integration by sending a test event to verify connectivity.

POST request for endpoint /api/saveDataDogConfigs

post
Body
datadogApiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]
datadogAppKeystringRequiredExample: [REDACTED_DATADOG_APP_KEY]
datadogSitestringRequiredExample: datadoghq.com
serviceNamesstring[]OptionalExample: ["payment-service","auth-service","api-gateway"]
Responses
200

Datadog config saved; hourly traffic collection job scheduled

application/json
objectOptional
post/api/saveDataDogConfigs
POST /api/saveDataDogConfigs HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 185

{
  "datadogApiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogAppKey": "[REDACTED_DATADOG_APP_KEY]",
  "datadogSite": "datadoghq.com",
  "serviceNames": [
    "payment-service",
    "auth-service",
    "api-gateway"
  ]
}
{}

POST request for endpoint /api/addDatadogIntegration

post
Body
apiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]
datadogSitestringRequiredExample: datadoghq.com
enabledbooleanOptionalExample: true
Responses
200

Datadog integration saved

application/json
objectOptional
post/api/addDatadogIntegration
POST /api/addDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 84

{
  "apiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogSite": "datadoghq.com",
  "enabled": true
}
{}

POST request for endpoint /api/deleteDatadogIntegration

post
Body
objectOptional
Responses
200

Datadog integration deleted

application/json
objectOptional
post/api/deleteDatadogIntegration
POST /api/deleteDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/testDatadogIntegration

post
Body
apiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]
datadogSitestringRequiredExample: datadoghq.com
Responses
200

Test event sent successfully

application/json
objectOptional
post/api/testDatadogIntegration
POST /api/testDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 69

{
  "apiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogSite": "datadoghq.com"
}
{}

Splunk

#
API
Description

1

POST /api/addSplunkIntegration

Adds or updates the Splunk SIEM integration configuration.

POST request for endpoint /api/addSplunkIntegration

post
Body
splunkUrlstringRequiredExample: http://splunk.example.com:8088/services/collector
splunkTokenstringRequiredExample: [REDACTED_SPLUNK_TOKEN]
Responses
200

Splunk integration saved

application/json
objectOptional
post/api/addSplunkIntegration
POST /api/addSplunkIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 105

{
  "splunkUrl": "http://splunk.example.com:8088/services/collector",
  "splunkToken": "[REDACTED_SPLUNK_TOKEN]"
}
{}

Azure Data Explorer (ADX)

#
API
Description

1

POST /api/addAdxIntegration

Adds or updates the Azure Data Explorer integration configuration.

2

POST /api/removeAdxIntegration

Removes the Azure Data Explorer integration configuration.

POST request for endpoint /api/addAdxIntegration

post
Body
clusterEndpointstringRequiredExample: https://akto-cluster.eastus.kusto.windows.net
databaseNamestringRequiredExample: AktoThreatDB
tenantIdstringRequiredExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890
applicationClientIdstringRequiredExample: b2c3d4e5-f6a7-8901-bcde-f12345678901
applicationKeystringOptional

Azure AD application client secret. Required on first save; can be omitted on subsequent updates to keep the stored value.

Example: [REDACTED_ADX_APP_KEY]
Responses
200

ADX integration saved

application/json
objectOptional
post/api/addAdxIntegration
POST /api/addAdxIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 250

{
  "clusterEndpoint": "https://akto-cluster.eastus.kusto.windows.net",
  "databaseName": "AktoThreatDB",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "applicationClientId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "applicationKey": "[REDACTED_ADX_APP_KEY]"
}
{}

POST request for endpoint /api/removeAdxIntegration

post
Body
objectOptional
Responses
200

ADX integration removed

application/json
objectOptional
post/api/removeAdxIntegration
POST /api/removeAdxIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

DevRev

#
API
Description

1

POST /api/addDevRevIntegration

Adds or updates the DevRev integration configuration.

2

POST /api/removeDevRevIntegration

Removes the DevRev integration configuration.

3

POST /api/createDevRevTickets

Creates DevRev tickets linked to Akto testing run issues.

POST request for endpoint /api/addDevRevIntegration

post
Body
orgUrlstringRequiredExample: https://app.devrev.ai/example-org
personalAccessTokenstringRequiredExample: [REDACTED_DEVREV_PAT]
Responses
200

DevRev integration saved

application/json
objectOptional
post/api/addDevRevIntegration
POST /api/addDevRevIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 92

{
  "orgUrl": "https://app.devrev.ai/example-org",
  "personalAccessToken": "[REDACTED_DEVREV_PAT]"
}
{}

POST request for endpoint /api/removeDevRevIntegration

post
Body
objectOptional
Responses
200

DevRev integration removed

application/json
objectOptional
post/api/removeDevRevIntegration
POST /api/removeDevRevIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/createDevRevTickets

post
Body
testingIssuesIdListobject[]Required

Array of TestingIssuesId objects

partIdstringRequiredExample: PROD-001
workItemTypestringRequiredExample: issue
aktoDashboardHoststringOptionalExample: https://app.akto.example.com
Responses
200

DevRev tickets created

application/json
objectOptional
post/api/createDevRevTickets
POST /api/createDevRevTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 122

{
  "testingIssuesIdList": [
    {}
  ],
  "partId": "PROD-001",
  "workItemType": "issue",
  "aktoDashboardHost": "https://app.akto.example.com"
}
{}

ServiceNow

#
API
Description

1

POST /api/addServiceNowIntegration

Adds or updates the ServiceNow integration configuration.

2

POST /api/removeServiceNowIntegration

Removes the ServiceNow integration configuration.

3

POST /api/createServiceNowTicket

Creates a ServiceNow ticket linked to an Akto testing run issue.

4

POST /api/bulkCreateServiceNowTickets

Bulk creates ServiceNow tickets for multiple Akto testing run issues in a single request.

POST request for endpoint /api/addServiceNowIntegration

post
Body
instanceUrlstringRequiredExample: https://example.service-now.com
clientIdstringRequiredExample: c3d4e5f6a7b8c9d0
clientSecretstringRequiredExample: [REDACTED_SNOW_CLIENT_SECRET]
tableNamesstring[]RequiredExample: ["incident","problem"]
Responses
200

ServiceNow integration saved

application/json
objectOptional
post/api/addServiceNowIntegration
POST /api/addServiceNowIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 162

{
  "instanceUrl": "https://example.service-now.com",
  "clientId": "c3d4e5f6a7b8c9d0",
  "clientSecret": "[REDACTED_SNOW_CLIENT_SECRET]",
  "tableNames": [
    "incident",
    "problem"
  ]
}
{}

POST request for endpoint /api/removeServiceNowIntegration

post
Body
objectOptional
Responses
200

ServiceNow integration removed

application/json
objectOptional
post/api/removeServiceNowIntegration
POST /api/removeServiceNowIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/createServiceNowTicket

post
Body
tableNamestringRequiredExample: incident
aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com
Responses
200

ServiceNow ticket created

application/json
serviceNowTicketUrlstringOptionalExample: https://example.service-now.com/nav_to.do?uri=incident.do?sys_id=abc123
serviceNowTicketNumberstringOptionalExample: INC0012345
post/api/createServiceNowTicket
POST /api/createServiceNowTicket HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 224

{
  "testingIssuesId": {
    "apiInfoKey": {
      "apiCollectionId": 1748293710,
      "url": "https://api.example.com/v1/users",
      "method": "GET"
    },
    "testSubCategory": "BOLA"
  },
  "tableName": "incident",
  "aktoDashboardHostName": "https://app.akto.example.com"
}
{
  "serviceNowTicketUrl": "https://example.service-now.com/nav_to.do?uri=incident.do?sys_id=abc123",
  "serviceNowTicketNumber": "INC0012345"
}

POST request for endpoint /api/bulkCreateServiceNowTickets

post
Body
testingIssuesIdListobject[]Required
tableNamestringRequiredExample: incident
aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com
Responses
200

ServiceNow tickets created

application/json
objectOptional
post/api/bulkCreateServiceNowTickets
POST /api/bulkCreateServiceNowTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 106

{
  "testingIssuesIdList": [
    {}
  ],
  "tableName": "incident",
  "aktoDashboardHostName": "https://app.akto.example.com"
}
{}

Microsoft Defender

#
API
Description

1

POST /api/addMicrosoftDefenderIntegration

Adds or updates the Microsoft Defender for Endpoint integration configuration.

2

POST /api/removeMicrosoftDefenderIntegration

Removes the Microsoft Defender for Endpoint integration configuration.

3

POST /api/uploadDefenderScript

Uploads a script to the Microsoft Defender Live Response library.

4

POST /api/runDefenderKqlQuery

Executes a KQL (Kusto Query Language) query against Microsoft Defender data.

5

POST /api/runDefenderLiveResponse

Runs a Live Response session or script on a device via Microsoft Defender.

6

POST /api/ingestDefenderKqlResults

Ingests and processes KQL query results from Microsoft Defender into Akto.

POST request for endpoint /api/addMicrosoftDefenderIntegration

post
Body
tenantIdstringRequiredExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890
clientIdstringRequiredExample: d4e5f6a7-b8c9-0123-def0-123456789012
clientSecretstringRequiredExample: [REDACTED_DEFENDER_SECRET]
dataIngestionUrlstringRequiredExample: https://akto-ingestion.example.com
recurringIntervalSecondsintegerOptional

Polling interval for Advanced Hunting jobs (default: 3600)

Example: 3600
Responses
200

Integration saved; recurring job created or updated

application/json
objectOptional
post/api/addMicrosoftDefenderIntegration
POST /api/addMicrosoftDefenderIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 233

{
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "clientId": "d4e5f6a7-b8c9-0123-def0-123456789012",
  "clientSecret": "[REDACTED_DEFENDER_SECRET]",
  "dataIngestionUrl": "https://akto-ingestion.example.com",
  "recurringIntervalSeconds": 3600
}
{}

POST request for endpoint /api/removeMicrosoftDefenderIntegration

post
Body
objectOptional
Responses
200

Integration removed

application/json
objectOptional
post/api/removeMicrosoftDefenderIntegration
POST /api/removeMicrosoftDefenderIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/uploadDefenderScript

post
Body
scriptContentstringRequired

Script content (PowerShell or Bash)

Example: #!/bin/bash echo 'Akto guardrail check'
scriptNamestringRequiredExample: akto-guardrail-check.sh
Responses
200

Script uploaded to Defender library

application/json
objectOptional
post/api/uploadDefenderScript
POST /api/uploadDefenderScript HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 101

{
  "scriptContent": "#!/bin/bash\necho 'Akto guardrail check'\n",
  "scriptName": "akto-guardrail-check.sh"
}
{}

POST request for endpoint /api/runDefenderKqlQuery

post
Body
kqlQuerystringRequiredExample: DeviceNetworkEvents | where RemoteIP == '192.0.2.48' | limit 10
agentNamestringOptionalExample: prod-api-server-01
Responses
200

KQL query results returned

application/json
kqlResultsobject[]Optional

Query result rows; column names vary by query

Example: [{"DeviceName":"prod-api-server-01","RemoteIP":"192.0.2.48","RemotePort":443,"Timestamp":"2024-01-15T14:30:00Z"}]
post/api/runDefenderKqlQuery
POST /api/runDefenderKqlQuery HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 111

{
  "kqlQuery": "DeviceNetworkEvents | where RemoteIP == '192.0.2.48' | limit 10",
  "agentName": "prod-api-server-01"
}
{
  "kqlResults": [
    {
      "DeviceName": "prod-api-server-01",
      "RemoteIP": "192.0.2.48",
      "RemotePort": 443,
      "Timestamp": "2024-01-15T14:30:00Z"
    }
  ]
}

POST request for endpoint /api/runDefenderLiveResponse

post
Body
deviceIdsstring[]RequiredExample: ["a1b2c3d4e5f6789012345678901234567890abcd"]
scriptNamestringRequired

Script name in the Defender library

Example: akto-guardrail-check.sh
scriptParametersstringOptional

Input parameters passed to the script

Example: AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com
Responses
200

Live response completed

application/json
post/api/runDefenderLiveResponse
POST /api/runDefenderLiveResponse HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 177

{
  "deviceIds": [
    "a1b2c3d4e5f6789012345678901234567890abcd"
  ],
  "scriptName": "akto-guardrail-check.sh",
  "scriptParameters": "AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com"
}
{
  "liveResponseResults": [
    {
      "deviceId": "a1b2c3d4e5f6789012345678901234567890abcd",
      "status": "Succeeded",
      "output": "Guardrail installed successfully."
    }
  ]
}

POST request for endpoint /api/ingestDefenderKqlResults

post
Body
kqlResultsobject[]Required

Array of KQL result row objects to ingest

agentNamestringRequiredExample: prod-api-server-01
Responses
200

KQL results ingested

application/json
objectOptional
post/api/ingestDefenderKqlResults
POST /api/ingestDefenderKqlResults HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 52

{
  "kqlResults": [
    {}
  ],
  "agentName": "prod-api-server-01"
}
{}

SentinelOne

#
API
Description

1

POST /api/addSentinelOneIntegration

Adds or updates the SentinelOne integration configuration.

2

POST /api/removeSentinelOneIntegration

Removes the SentinelOne integration configuration.

3

POST /api/executeSentinelOneRemoteScript

Executes a remote script on a SentinelOne-enrolled endpoint.

POST request for endpoint /api/addSentinelOneIntegration

post
Body
consoleUrlstringRequiredExample: https://example.sentinelone.net
dataIngestionUrlstringRequiredExample: https://akto-ingestion.example.com
apiTokenstringOptional

SentinelOne API token. Required on first save; omit to keep the existing token.

Example: [REDACTED_S1_API_TOKEN]
recurringIntervalSecondsintegerOptional

Agent data collection interval (default: 3600)

Example: 3600
Responses
200

Integration saved; recurring job created/updated

application/json
objectOptional
post/api/addSentinelOneIntegration
POST /api/addSentinelOneIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 173

{
  "consoleUrl": "https://example.sentinelone.net",
  "dataIngestionUrl": "https://akto-ingestion.example.com",
  "apiToken": "[REDACTED_S1_API_TOKEN]",
  "recurringIntervalSeconds": 3600
}
{}

POST request for endpoint /api/removeSentinelOneIntegration

post
Body
objectOptional
Responses
200

Integration removed

application/json
objectOptional
post/api/removeSentinelOneIntegration
POST /api/removeSentinelOneIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{}

POST request for endpoint /api/executeSentinelOneRemoteScript

post
Body
scriptIdstringRequired

Script ID from the SentinelOne script library

Example: script-library-id-001
executeAgentIdsstring[]RequiredExample: ["1234567890123456789","9876543210987654321"]
executeTaskDescriptionstringOptionalExample: Akto guardrail installation
executeInputParamsstringOptional

Space-separated key=value environment variable pairs

Example: AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com
Responses
200

Script execution initiated

application/json
parentTaskIdstringOptional

Use with getSentinelOneScriptTaskStatus to poll for completion

Example: task-uuid-abc123def456
post/api/executeSentinelOneRemoteScript
POST /api/executeSentinelOneRemoteScript HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 237

{
  "scriptId": "script-library-id-001",
  "executeAgentIds": [
    "1234567890123456789",
    "9876543210987654321"
  ],
  "executeTaskDescription": "Akto guardrail installation",
  "executeInputParams": "AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com"
}
{
  "parentTaskId": "task-uuid-abc123def456"
}

Generic Integrations

#
API
Description

1

POST /api/testIntegration

Tests a configured integration by sending a test payload to verify connectivity.

2

POST /api/addIntegration

Adds or updates a generic integration configuration by type.

3

POST /api/markConnectionAsSkipped

Marks an integration connection as skipped during setup or onboarding.

POST request for endpoint /api/testIntegration

post
Body
baseUrlstringRequiredExample: https://example-org.atlassian.net
projIdstringRequired

Comma-separated project keys

Example: SCRUM,API
userEmailstringRequiredExample: admin@example.com
apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]
jiraTypestring · enumRequiredExample: CLOUDPossible values:
Responses
200

Credentials valid; issue types resolved

application/json
projectAndIssueMapobjectOptional

Map of project key to resolved issue type list

Example: {"SCRUM":[{"issueId":"10001","issueType":"Bug"},{"issueId":"10002","issueType":"Story"}]}
post/api/testIntegration
POST /api/testIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 158

{
  "baseUrl": "https://example-org.atlassian.net",
  "projId": "SCRUM,API",
  "userEmail": "admin@example.com",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "jiraType": "CLOUD"
}
{
  "projectAndIssueMap": {
    "SCRUM": [
      {
        "issueId": "10001",
        "issueType": "Bug"
      },
      {
        "issueId": "10002",
        "issueType": "Story"
      }
    ]
  }
}

POST request for endpoint /api/addIntegration

post
Body
baseUrlstringRequiredExample: https://example-org.atlassian.net
projIdstringRequiredExample: SCRUM
userEmailstringRequiredExample: admin@example.com
apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]
issueTypestringOptionalExample: Bug
jiraTypestring · enumRequiredExample: CLOUDPossible values:
projectAndIssueMapobjectOptional

Map of project key to issue type list (from testIntegration response)

projectMappingsobjectOptional

Map of project key to mapping settings

Responses
200

Jira integration saved

application/json
objectOptional
post/api/addIntegration
POST /api/addIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 217

{
  "baseUrl": "https://example-org.atlassian.net",
  "projId": "SCRUM",
  "userEmail": "admin@example.com",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "issueType": "Bug",
  "jiraType": "CLOUD",
  "projectAndIssueMap": {},
  "projectMappings": {}
}
{}

POST request for endpoint /api/markConnectionAsSkipped

post
Body
connectionSkippedstring · enumRequired

Connection type to mark as skipped

Example: SLACK_ALERTSPossible values:
Responses
200

Connection marked as skipped

application/json
objectOptional
post/api/markConnectionAsSkipped
POST /api/markConnectionAsSkipped HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "connectionSkipped": "SLACK_ALERTS"
}
{}

Slack Webhooks

#
API
Description

1

POST /api/addSlackWebhook

Adds a new Slack webhook integration for alert and notification delivery.

2

POST /api/deleteSlackWebhook

Removes a configured Slack webhook integration.

POST request for endpoint /api/addSlackWebhook

post
Body
webhookUrlstringRequiredExample: https://hooks.slack.com/services/[REDACTED_SLACK_WEBHOOK_PATH]
webhookNamestringRequiredExample: security-alerts
dashboardUrlstringOptionalExample: https://app.akto.example.com
frequencyInSecondsintegerOptionalExample: 3600
Responses
200

Slack webhook added

application/json
objectOptional
post/api/addSlackWebhook
POST /api/addSlackWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 183

{
  "webhookUrl": "https://hooks.slack.com/services/[REDACTED_SLACK_WEBHOOK_PATH]",
  "webhookName": "security-alerts",
  "dashboardUrl": "https://app.akto.example.com",
  "frequencyInSeconds": 3600
}
{}

POST request for endpoint /api/deleteSlackWebhook

post
Body
webhookNamestringRequiredExample: security-alerts
Responses
200

Slack webhook deleted

application/json
objectOptional
post/api/deleteSlackWebhook
POST /api/deleteSlackWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "webhookName": "security-alerts"
}
{}

Custom Webhooks

#
API
Description

1

POST /api/addCustomWebhook

Adds a new custom webhook integration for event notifications.

2

POST /api/checkWebhook

Tests a custom webhook by sending a test request to verify connectivity and response.

3

POST /api/updateCustomWebhook

Updates an existing custom webhook integration configuration.

POST request for endpoint /api/addCustomWebhook

post
Body
webhookNamestringRequiredExample: new-endpoint-notifier
urlstringRequiredExample: https://hooks.example.com/akto-events
methodstring · enumRequiredExample: POSTPossible values:
headerStringstringOptional

JSON string of headers to include

Example: {"Authorization": "Bearer [REDACTED_WEBHOOK_TOKEN]", "Content-Type": "application/json"}
queryParamsstringOptional
bodystringOptional

JSON template for the webhook payload

Example: {"event": "NEW_ENDPOINT", "url": "{{url}}", "collection": "{{collection}}"}
frequencyInSecondsintegerOptionalExample: 3600
activeStatusstring · enumOptionalExample: ACTIVEPossible values:
selectedWebhookOptionsstring[]OptionalExample: ["NEW_ENDPOINT","NEW_SENSITIVE_ENDPOINT"]
newEndpointCollectionsstring[]Optional
newSensitiveEndpointCollectionsstring[]Optional
batchSizeintegerOptionalExample: 100
sendInstantlybooleanOptionalExample: false
webhookTypestringOptionalExample: GENERAL
Responses
200

Custom webhook created

application/json
objectOptional
post/api/addCustomWebhook
POST /api/addCustomWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 573

{
  "webhookName": "new-endpoint-notifier",
  "url": "https://hooks.example.com/akto-events",
  "method": "POST",
  "headerString": "{\"Authorization\": \"Bearer [REDACTED_WEBHOOK_TOKEN]\", \"Content-Type\": \"application/json\"}",
  "queryParams": "",
  "body": "{\"event\": \"NEW_ENDPOINT\", \"url\": \"{{url}}\", \"collection\": \"{{collection}}\"}",
  "frequencyInSeconds": 3600,
  "activeStatus": "ACTIVE",
  "selectedWebhookOptions": [
    "NEW_ENDPOINT",
    "NEW_SENSITIVE_ENDPOINT"
  ],
  "newEndpointCollections": [],
  "newSensitiveEndpointCollections": [],
  "batchSize": 100,
  "sendInstantly": false,
  "webhookType": "GENERAL"
}
{}

POST request for endpoint /api/checkWebhook

post
Body
webhookNamestringRequiredExample: new-endpoint-notifier
Responses
200

Existence check result

application/json
webhookPresentbooleanOptionalExample: true
post/api/checkWebhook
POST /api/checkWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 39

{
  "webhookName": "new-endpoint-notifier"
}
{
  "webhookPresent": true
}

POST request for endpoint /api/updateCustomWebhook

post
Body
idintegerRequired

Existing custom webhook ID

Example: 7
webhookNamestringRequiredExample: new-endpoint-notifier
urlstringRequiredExample: https://hooks.example.com/akto-events
methodstring · enumRequiredExample: POSTPossible values:
headerStringstringOptionalExample: {"Authorization": "Bearer [REDACTED_WEBHOOK_TOKEN]"}
queryParamsstringOptional
bodystringOptionalExample: {"event": "NEW_ENDPOINT", "url": "{{url}}"}
frequencyInSecondsintegerOptionalExample: 1800
activeStatusstring · enumOptionalExample: ACTIVEPossible values:
selectedWebhookOptionsstring[]OptionalExample: ["NEW_ENDPOINT"]
Responses
200

Webhook updated

application/json
objectOptional
post/api/updateCustomWebhook
POST /api/updateCustomWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 352

{
  "id": 7,
  "webhookName": "new-endpoint-notifier",
  "url": "https://hooks.example.com/akto-events",
  "method": "POST",
  "headerString": "{\"Authorization\": \"Bearer [REDACTED_WEBHOOK_TOKEN]\"}",
  "queryParams": "",
  "body": "{\"event\": \"NEW_ENDPOINT\", \"url\": \"{{url}}\"}",
  "frequencyInSeconds": 1800,
  "activeStatus": "ACTIVE",
  "selectedWebhookOptions": [
    "NEW_ENDPOINT"
  ]
}
{}

Last updated