Modify Data

Table of Contents

• Jira

• Azure Boards

• Datadog

• Splunk

• Azure Data Explorer (ADX)

• DevRev

• ServiceNow

• Microsoft Defender

• SentinelOne

• Generic Integrations

• Slack Webhooks

• Custom Webhooks

Jira

#	API	Description
1	POST /api/jira/add	Adds a Jira project to the integration or updates bi-directional sync settings for an existing one. Supports both Jira Cloud (v3 API) and Data Center (v2 API).
2	POST /api/jira/delete	Removes a Jira project from the integration.
3	POST /api/jira/savePriorityFieldMapping	Saves the mapping from Akto severity levels to Jira field values for a project.
4	POST /api/createJiraIssue	Creates a Jira issue linked to an Akto testing run issue and stores the resulting Jira ticket URL.
5	POST /api/bulkCreateJiraTickets	Bulk creates Jira issues for multiple Akto testing run issues in a single request.
6	POST /api/attachFileToIssue	Attaches original and test HTTP request/response samples as a file to an existing Jira issue.
7	POST /api/createGeneralJiraTicket	Creates a general-purpose Jira ticket not tied to a specific testing run issue.

POST request for endpoint /api/jira/add

post

Body

baseUrlstringRequiredExample: https://example-org.atlassian.net

userEmailstringRequiredExample: [e-mail]

apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]

jiraTypestring · enumRequiredExample: CLOUDPossible values:

Responses

200

Jira project added/updated successfully

application/json

403

Forbidden — caller lacks INTEGRATIONS / READ_WRITE permission

422

Unprocessable — project mappings empty or project metadata fetch failed

application/json

post/api/jira/add

POST /api/jira/add HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 227

{
  "baseUrl": "https://example-org.atlassian.net",
  "userEmail": "[e-mail]",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "jiraType": "CLOUD",
  "projectMappings": {
    "SCRUM": {
      "biDirectionalSyncSettings": {
        "enabled": false
      },
      "statuses": []
    }
  }
}

{
  "jiraIntegration": {
    "baseUrl": "https://example-org.atlassian.net",
    "userEmail": "[e-mail]",
    "projectIdsMap": {
      "SCRUM": [
        {
          "issueId": "10001",
          "issueType": "Bug"
        },
        {
          "issueId": "10002",
          "issueType": "Story"
        }
      ]
    },
    "projectMappings": {
      "SCRUM": {
        "biDirectionalSyncSettings": {
          "enabled": false
        },
        "statuses": []
      }
    },
    "createdTs": 1766398064,
    "updatedTs": 1766398064
  }
}

POST request for endpoint /api/jira/delete

post

Body

projIdstringRequired

Jira project key to remove

Example: SCRUM

Responses

200

Project removed successfully

application/json

objectOptional

403

Forbidden

422

Unprocessable — projId null or integration not found

application/json

post/api/jira/delete

POST /api/jira/delete HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 18

{
  "projId": "SCRUM"
}

{}

POST request for endpoint /api/jira/savePriorityFieldMapping

post

Body

projIdstringRequiredExample: SCRUM

fieldIdstringRequiredExample: priority

fieldValuesMapobjectRequired

Map of Akto severity → Jira field value ID

Example: {"HIGH":"1","MEDIUM":"3","LOW":"5"}

Responses

200

Priority mapping saved

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/jira/savePriorityFieldMapping

POST /api/jira/savePriorityFieldMapping HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 92

{
  "projId": "SCRUM",
  "fieldId": "priority",
  "fieldValuesMap": {
    "HIGH": "1",
    "MEDIUM": "3",
    "LOW": "5"
  }
}

{}

POST request for endpoint /api/createJiraIssue

post

Body

Responses

200

Jira issue created

application/json

jiraTicketKeystringOptionalExample: SCRUM-42

jiraTicketUrlstringOptionalExample: https://example-org.atlassian.net/browse/SCRUM-42

403

Forbidden

422

Unprocessable — Jira not integrated or Jira API error

post/api/createJiraIssue

POST /api/createJiraIssue HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 197

{
  "jiraMetaData": {
    "testingIssueId": {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/users",
        "method": "GET"
      },
      "testSubCategory": "BOLA"
    },
    "projId": "SCRUM",
    "issueType": "Bug"
  }
}

{
  "jiraTicketKey": "SCRUM-42",
  "jiraTicketUrl": "https://example-org.atlassian.net/browse/SCRUM-42"
}

POST request for endpoint /api/bulkCreateJiraTickets

post

Body

Responses

200

Bulk Jira tickets created

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/bulkCreateJiraTickets

POST /api/bulkCreateJiraTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 203

{
  "testingRunIssueIds": [
    {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/users",
        "method": "GET"
      },
      "testSubCategory": "BOLA"
    }
  ],
  "jiraMetaData": {
    "projId": "SCRUM",
    "issueType": "Bug"
  }
}

{}

POST request for endpoint /api/attachFileToIssue

post

Body

origReqstringOptional

Raw HTTP request/response sample (original traffic)

Example: [RAW_HTTP_SAMPLE]

testReqstringOptional

Raw HTTP request/response sample (test attempt)

Example: [RAW_HTTP_TEST_SAMPLE]

issueIdstringRequired

Jira issue key

Example: SCRUM-42

Responses

200

File attached to issue

application/json

objectOptional

403

Forbidden

422

Unprocessable — Jira not integrated or attachment failed

post/api/attachFileToIssue

POST /api/attachFileToIssue HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "origReq": "[RAW_HTTP_SAMPLE]",
  "testReq": "[RAW_HTTP_TEST_SAMPLE]",
  "issueId": "SCRUM-42"
}

{}

POST request for endpoint /api/createGeneralJiraTicket

post

Body

projIdstringRequiredExample: SCRUM

issueTypestringRequiredExample: Bug

titlestringRequiredExample: Potential BOLA vulnerability on /api/v1/users endpoint

descriptionstringOptionalExample: Unauthorized access to other users' data was detected.

labelsstringOptionalExample: security,akto

threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd

actionItemTypestringOptionalExample: THREAT

Responses

200

Jira ticket created

application/json

jiraTicketUrlstringOptionalExample: https://example-org.atlassian.net/browse/SCRUM-43

403

Forbidden

422

Unprocessable — Jira not integrated

post/api/createGeneralJiraTicket

POST /api/createGeneralJiraTicket HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 278

{
  "projId": "SCRUM",
  "issueType": "Bug",
  "title": "Potential BOLA vulnerability on /api/v1/users endpoint",
  "description": "Unauthorized access to other users' data was detected.",
  "labels": "security,akto",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "actionItemType": "THREAT"
}

{
  "jiraTicketUrl": "https://example-org.atlassian.net/browse/SCRUM-43"
}

Azure Boards

#	API	Description
1	POST /api/addAzureBoardsIntegration	Adds or updates the Azure Boards integration configuration.
2	POST /api/removeAzureBoardsIntegration	Removes the Azure Boards integration configuration.
3	POST /api/createAzureBoardsWorkItem	Creates an Azure Boards work item linked to an Akto testing run issue.
4	POST /api/bulkCreateAzureWorkItems	Bulk creates Azure Boards work items for multiple Akto testing run issues in a single request.
5	POST /api/createGeneralAzureBoardsWorkItem	Creates a general-purpose Azure Boards work item not tied to a specific testing run issue.

POST request for endpoint /api/addAzureBoardsIntegration

post

Body

azureBoardsBaseUrlstringRequiredExample: https://dev.azure.com

organizationstringRequiredExample: example-corp

projectListstring[]RequiredExample: ["AktoSecurity","InfraTeam"]

personalAuthTokenstringRequiredExample: [REDACTED_AZURE_PAT]

Responses

200

Integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable — invalid credentials or project not found

post/api/addAzureBoardsIntegration

POST /api/addAzureBoardsIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 162

{
  "azureBoardsBaseUrl": "https://dev.azure.com",
  "organization": "example-corp",
  "projectList": [
    "AktoSecurity",
    "InfraTeam"
  ],
  "personalAuthToken": "[REDACTED_AZURE_PAT]"
}

{}

POST request for endpoint /api/removeAzureBoardsIntegration

post

Body

objectOptional

Responses

200

Integration removed

application/json

objectOptional

403

Forbidden

post/api/removeAzureBoardsIntegration

POST /api/removeAzureBoardsIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/createAzureBoardsWorkItem

post

Body

workItemTypestringRequiredExample: Bug

projectNamestringRequiredExample: AktoSecurity

aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com

threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd

titlestringOptionalExample: BOLA vulnerability on /api/v1/users

descriptionstringOptionalExample: Unauthorized data access detected.

Responses

200

Work item created

application/json

azureBoardsWorkItemUrlstringOptionalExample: https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/42

403

Forbidden

422

Unprocessable — integration not configured

post/api/createAzureBoardsWorkItem

POST /api/createAzureBoardsWorkItem HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 403

{
  "workItemType": "Bug",
  "projectName": "AktoSecurity",
  "testingIssuesId": {
    "apiInfoKey": {
      "apiCollectionId": 1748293710,
      "url": "https://api.example.com/v1/users",
      "method": "GET"
    },
    "testSubCategory": "BOLA"
  },
  "aktoDashboardHostName": "https://app.akto.example.com",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "title": "BOLA vulnerability on /api/v1/users",
  "description": "Unauthorized data access detected."
}

{
  "azureBoardsWorkItemUrl": "https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/42"
}

POST request for endpoint /api/bulkCreateAzureWorkItems

post

Body

testingIssuesIdListobject[]Required

Array of TestingIssuesId objects

projectNamestringRequiredExample: AktoSecurity

workItemTypestringRequiredExample: Bug

aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com

Responses

200

Work items created

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/bulkCreateAzureWorkItems

POST /api/bulkCreateAzureWorkItems HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 133

{
  "testingIssuesIdList": [
    {}
  ],
  "projectName": "AktoSecurity",
  "workItemType": "Bug",
  "aktoDashboardHostName": "https://app.akto.example.com"
}

{}

POST request for endpoint /api/createGeneralAzureBoardsWorkItem

post

Body

workItemTypestringRequiredExample: Bug

projectNamestringRequiredExample: AktoSecurity

titlestringRequiredExample: Threat detected on /api/v1/chat endpoint

descriptionstringOptionalExample: Prompt injection attempt detected at 2024-01-15 14:32 UTC

threatEventIdstringOptionalExample: 4a3502a0-ab5f-4255-9628-aae3b0ef33bd

templateIdstringOptionalExample: filter-template-uuid-001

endpointstringOptionalExample: /api/v1/chat

originalMessagestringOptionalExample: [RAW_HTTP_SAMPLE]

Responses

200

Work item created

application/json

azureBoardsWorkItemUrlstringOptionalExample: https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/43

403

Forbidden

422

Unprocessable — integration not configured

post/api/createGeneralAzureBoardsWorkItem

POST /api/createGeneralAzureBoardsWorkItem HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 335

{
  "workItemType": "Bug",
  "projectName": "AktoSecurity",
  "title": "Threat detected on /api/v1/chat endpoint",
  "description": "Prompt injection attempt detected at 2024-01-15 14:32 UTC",
  "threatEventId": "4a3502a0-ab5f-4255-9628-aae3b0ef33bd",
  "templateId": "filter-template-uuid-001",
  "endpoint": "/api/v1/chat",
  "originalMessage": "[RAW_HTTP_SAMPLE]"
}

{
  "azureBoardsWorkItemUrl": "https://dev.azure.com/example-corp/AktoSecurity/_workitems/edit/43"
}

Datadog

#	API	Description
1	POST /api/saveDataDogConfigs	Saves Datadog configuration settings for the integration.
2	POST /api/addDatadogIntegration	Adds or updates the Datadog integration configuration.
3	POST /api/deleteDatadogIntegration	Removes the Datadog integration configuration.
4	POST /api/testDatadogIntegration	Tests the Datadog integration by sending a test event to verify connectivity.

POST request for endpoint /api/saveDataDogConfigs

post

Body

datadogApiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]

datadogAppKeystringRequiredExample: [REDACTED_DATADOG_APP_KEY]

datadogSitestringRequiredExample: datadoghq.com

serviceNamesstring[]OptionalExample: ["payment-service","auth-service","api-gateway"]

Responses

200

Datadog config saved; hourly traffic collection job scheduled

application/json

objectOptional

403

Forbidden

422

Unprocessable — missing API key, app key, or site

application/json

post/api/saveDataDogConfigs

POST /api/saveDataDogConfigs HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 185

{
  "datadogApiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogAppKey": "[REDACTED_DATADOG_APP_KEY]",
  "datadogSite": "datadoghq.com",
  "serviceNames": [
    "payment-service",
    "auth-service",
    "api-gateway"
  ]
}

{}

POST request for endpoint /api/addDatadogIntegration

post

Body

apiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]

datadogSitestringRequiredExample: datadoghq.com

enabledbooleanOptionalExample: true

Responses

200

Datadog integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/addDatadogIntegration

POST /api/addDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 84

{
  "apiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogSite": "datadoghq.com",
  "enabled": true
}

{}

POST request for endpoint /api/deleteDatadogIntegration

post

Body

objectOptional

Responses

200

Datadog integration deleted

application/json

objectOptional

403

Forbidden

post/api/deleteDatadogIntegration

POST /api/deleteDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/testDatadogIntegration

post

Body

apiKeystringRequiredExample: [REDACTED_DATADOG_API_KEY]

datadogSitestringRequiredExample: datadoghq.com

Responses

200

Test event sent successfully

application/json

objectOptional

403

Forbidden

422

Unprocessable — connection test failed

post/api/testDatadogIntegration

POST /api/testDatadogIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 69

{
  "apiKey": "[REDACTED_DATADOG_API_KEY]",
  "datadogSite": "datadoghq.com"
}

{}

Splunk

#	API	Description
1	POST /api/addSplunkIntegration	Adds or updates the Splunk SIEM integration configuration.

POST request for endpoint /api/addSplunkIntegration

post

Body

splunkUrlstringRequiredExample: http://splunk.example.com:8088/services/collector

splunkTokenstringRequiredExample: [REDACTED_SPLUNK_TOKEN]

Responses

200

Splunk integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/addSplunkIntegration

POST /api/addSplunkIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 105

{
  "splunkUrl": "http://splunk.example.com:8088/services/collector",
  "splunkToken": "[REDACTED_SPLUNK_TOKEN]"
}

{}

Azure Data Explorer (ADX)

#	API	Description
1	POST /api/addAdxIntegration	Adds or updates the Azure Data Explorer integration configuration.
2	POST /api/removeAdxIntegration	Removes the Azure Data Explorer integration configuration.

POST request for endpoint /api/addAdxIntegration

post

Body

clusterEndpointstringRequiredExample: https://akto-cluster.eastus.kusto.windows.net

databaseNamestringRequiredExample: AktoThreatDB

tenantIdstringRequiredExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890

applicationClientIdstringRequiredExample: b2c3d4e5-f6a7-8901-bcde-f12345678901

applicationKeystringOptional

Azure AD application client secret. Required on first save; can be omitted on subsequent updates to keep the stored value.

Example: [REDACTED_ADX_APP_KEY]

Responses

200

ADX integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable — missing required fields

application/json

post/api/addAdxIntegration

POST /api/addAdxIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 250

{
  "clusterEndpoint": "https://akto-cluster.eastus.kusto.windows.net",
  "databaseName": "AktoThreatDB",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "applicationClientId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "applicationKey": "[REDACTED_ADX_APP_KEY]"
}

{}

POST request for endpoint /api/removeAdxIntegration

post

Body

objectOptional

Responses

200

ADX integration removed

application/json

objectOptional

403

Forbidden

post/api/removeAdxIntegration

POST /api/removeAdxIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

DevRev

#	API	Description
1	POST /api/addDevRevIntegration	Adds or updates the DevRev integration configuration.
2	POST /api/removeDevRevIntegration	Removes the DevRev integration configuration.
3	POST /api/createDevRevTickets	Creates DevRev tickets linked to Akto testing run issues.

POST request for endpoint /api/addDevRevIntegration

post

Body

orgUrlstringRequiredExample: https://app.devrev.ai/example-org

personalAccessTokenstringRequiredExample: [REDACTED_DEVREV_PAT]

Responses

200

DevRev integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/addDevRevIntegration

POST /api/addDevRevIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 92

{
  "orgUrl": "https://app.devrev.ai/example-org",
  "personalAccessToken": "[REDACTED_DEVREV_PAT]"
}

{}

POST request for endpoint /api/removeDevRevIntegration

post

Body

objectOptional

Responses

200

DevRev integration removed

application/json

objectOptional

403

Forbidden

post/api/removeDevRevIntegration

POST /api/removeDevRevIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/createDevRevTickets

post

Body

testingIssuesIdListobject[]Required

Array of TestingIssuesId objects

partIdstringRequiredExample: PROD-001

workItemTypestringRequiredExample: issue

aktoDashboardHoststringOptionalExample: https://app.akto.example.com

Responses

200

DevRev tickets created

application/json

objectOptional

403

Forbidden

422

Unprocessable — integration not configured

post/api/createDevRevTickets

POST /api/createDevRevTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 122

{
  "testingIssuesIdList": [
    {}
  ],
  "partId": "PROD-001",
  "workItemType": "issue",
  "aktoDashboardHost": "https://app.akto.example.com"
}

{}

ServiceNow

#	API	Description
1	POST /api/addServiceNowIntegration	Adds or updates the ServiceNow integration configuration.
2	POST /api/removeServiceNowIntegration	Removes the ServiceNow integration configuration.
3	POST /api/createServiceNowTicket	Creates a ServiceNow ticket linked to an Akto testing run issue.
4	POST /api/bulkCreateServiceNowTickets	Bulk creates ServiceNow tickets for multiple Akto testing run issues in a single request.

POST request for endpoint /api/addServiceNowIntegration

post

Body

instanceUrlstringRequiredExample: https://example.service-now.com

clientIdstringRequiredExample: c3d4e5f6a7b8c9d0

clientSecretstringRequiredExample: [REDACTED_SNOW_CLIENT_SECRET]

tableNamesstring[]RequiredExample: ["incident","problem"]

Responses

200

ServiceNow integration saved

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/addServiceNowIntegration

POST /api/addServiceNowIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 162

{
  "instanceUrl": "https://example.service-now.com",
  "clientId": "c3d4e5f6a7b8c9d0",
  "clientSecret": "[REDACTED_SNOW_CLIENT_SECRET]",
  "tableNames": [
    "incident",
    "problem"
  ]
}

{}

POST request for endpoint /api/removeServiceNowIntegration

post

Body

objectOptional

Responses

200

ServiceNow integration removed

application/json

objectOptional

403

Forbidden

post/api/removeServiceNowIntegration

POST /api/removeServiceNowIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/createServiceNowTicket

post

Body

tableNamestringRequiredExample: incident

aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com

Responses

200

ServiceNow ticket created

application/json

serviceNowTicketUrlstringOptionalExample: https://example.service-now.com/nav_to.do?uri=incident.do?sys_id=abc123

serviceNowTicketNumberstringOptionalExample: INC0012345

403

Forbidden

422

Unprocessable — integration not configured or API error

post/api/createServiceNowTicket

POST /api/createServiceNowTicket HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 224

{
  "testingIssuesId": {
    "apiInfoKey": {
      "apiCollectionId": 1748293710,
      "url": "https://api.example.com/v1/users",
      "method": "GET"
    },
    "testSubCategory": "BOLA"
  },
  "tableName": "incident",
  "aktoDashboardHostName": "https://app.akto.example.com"
}

{
  "serviceNowTicketUrl": "https://example.service-now.com/nav_to.do?uri=incident.do?sys_id=abc123",
  "serviceNowTicketNumber": "INC0012345"
}

POST request for endpoint /api/bulkCreateServiceNowTickets

post

Body

testingIssuesIdListobject[]Required

tableNamestringRequiredExample: incident

aktoDashboardHostNamestringOptionalExample: https://app.akto.example.com

Responses

200

ServiceNow tickets created

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/bulkCreateServiceNowTickets

POST /api/bulkCreateServiceNowTickets HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 106

{
  "testingIssuesIdList": [
    {}
  ],
  "tableName": "incident",
  "aktoDashboardHostName": "https://app.akto.example.com"
}

{}

Microsoft Defender

#	API	Description
1	POST /api/addMicrosoftDefenderIntegration	Adds or updates the Microsoft Defender for Endpoint integration configuration.
2	POST /api/removeMicrosoftDefenderIntegration	Removes the Microsoft Defender for Endpoint integration configuration.
3	POST /api/uploadDefenderScript	Uploads a script to the Microsoft Defender Live Response library.
4	POST /api/runDefenderKqlQuery	Executes a KQL (Kusto Query Language) query against Microsoft Defender data.
5	POST /api/runDefenderLiveResponse	Runs a Live Response session or script on a device via Microsoft Defender.
6	POST /api/ingestDefenderKqlResults	Ingests and processes KQL query results from Microsoft Defender into Akto.

POST request for endpoint /api/addMicrosoftDefenderIntegration

post

Body

tenantIdstringRequiredExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890

clientIdstringRequiredExample: d4e5f6a7-b8c9-0123-def0-123456789012

clientSecretstringRequiredExample: [REDACTED_DEFENDER_SECRET]

dataIngestionUrlstringRequiredExample: https://akto-ingestion.example.com

recurringIntervalSecondsintegerOptional

Polling interval for Advanced Hunting jobs (default: 3600)

Example: 3600

Responses

200

Integration saved; recurring job created or updated

application/json

objectOptional

403

Forbidden

422

Unprocessable — missing required fields

post/api/addMicrosoftDefenderIntegration

POST /api/addMicrosoftDefenderIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 233

{
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "clientId": "d4e5f6a7-b8c9-0123-def0-123456789012",
  "clientSecret": "[REDACTED_DEFENDER_SECRET]",
  "dataIngestionUrl": "https://akto-ingestion.example.com",
  "recurringIntervalSeconds": 3600
}

{}

POST request for endpoint /api/removeMicrosoftDefenderIntegration

post

Body

objectOptional

Responses

200

Integration removed

application/json

objectOptional

403

Forbidden

post/api/removeMicrosoftDefenderIntegration

POST /api/removeMicrosoftDefenderIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/uploadDefenderScript

post

Body

scriptContentstringRequired

Script content (PowerShell or Bash)

Example: #!/bin/bash echo 'Akto guardrail check'

scriptNamestringRequiredExample: akto-guardrail-check.sh

Responses

200

Script uploaded to Defender library

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/uploadDefenderScript

POST /api/uploadDefenderScript HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 101

{
  "scriptContent": "#!/bin/bash\necho 'Akto guardrail check'\n",
  "scriptName": "akto-guardrail-check.sh"
}

{}

POST request for endpoint /api/runDefenderKqlQuery

post

Body

kqlQuerystringRequiredExample: DeviceNetworkEvents | where RemoteIP == '192.0.2.48' | limit 10

agentNamestringOptionalExample: prod-api-server-01

Responses

200

KQL query results returned

application/json

kqlResultsobject[]Optional

Query result rows; column names vary by query

Example: [{"DeviceName":"prod-api-server-01","RemoteIP":"192.0.2.48","RemotePort":443,"Timestamp":"2024-01-15T14:30:00Z"}]

403

Forbidden

422

Unprocessable — integration not configured or KQL error

post/api/runDefenderKqlQuery

POST /api/runDefenderKqlQuery HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 111

{
  "kqlQuery": "DeviceNetworkEvents | where RemoteIP == '192.0.2.48' | limit 10",
  "agentName": "prod-api-server-01"
}

{
  "kqlResults": [
    {
      "DeviceName": "prod-api-server-01",
      "RemoteIP": "192.0.2.48",
      "RemotePort": 443,
      "Timestamp": "2024-01-15T14:30:00Z"
    }
  ]
}

POST request for endpoint /api/runDefenderLiveResponse

post

Body

deviceIdsstring[]RequiredExample: ["a1b2c3d4e5f6789012345678901234567890abcd"]

scriptNamestringRequired

Script name in the Defender library

Example: akto-guardrail-check.sh

scriptParametersstringOptional

Input parameters passed to the script

Example: AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com

Responses

200

Live response completed

application/json

403

Forbidden

422

Unprocessable

post/api/runDefenderLiveResponse

POST /api/runDefenderLiveResponse HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 177

{
  "deviceIds": [
    "a1b2c3d4e5f6789012345678901234567890abcd"
  ],
  "scriptName": "akto-guardrail-check.sh",
  "scriptParameters": "AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com"
}

{
  "liveResponseResults": [
    {
      "deviceId": "a1b2c3d4e5f6789012345678901234567890abcd",
      "status": "Succeeded",
      "output": "Guardrail installed successfully."
    }
  ]
}

POST request for endpoint /api/ingestDefenderKqlResults

post

Body

kqlResultsobject[]Required

Array of KQL result row objects to ingest

agentNamestringRequiredExample: prod-api-server-01

Responses

200

KQL results ingested

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/ingestDefenderKqlResults

POST /api/ingestDefenderKqlResults HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 52

{
  "kqlResults": [
    {}
  ],
  "agentName": "prod-api-server-01"
}

{}

SentinelOne

#	API	Description
1	POST /api/addSentinelOneIntegration	Adds or updates the SentinelOne integration configuration.
2	POST /api/removeSentinelOneIntegration	Removes the SentinelOne integration configuration.
3	POST /api/executeSentinelOneRemoteScript	Executes a remote script on a SentinelOne-enrolled endpoint.

POST request for endpoint /api/addSentinelOneIntegration

post

Body

consoleUrlstringRequiredExample: https://example.sentinelone.net

dataIngestionUrlstringRequiredExample: https://akto-ingestion.example.com

apiTokenstringOptional

SentinelOne API token. Required on first save; omit to keep the existing token.

Example: [REDACTED_S1_API_TOKEN]

recurringIntervalSecondsintegerOptional

Agent data collection interval (default: 3600)

Example: 3600

Responses

200

Integration saved; recurring job created/updated

application/json

objectOptional

403

Forbidden

422

Unprocessable — missing required fields

application/json

post/api/addSentinelOneIntegration

POST /api/addSentinelOneIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 173

{
  "consoleUrl": "https://example.sentinelone.net",
  "dataIngestionUrl": "https://akto-ingestion.example.com",
  "apiToken": "[REDACTED_S1_API_TOKEN]",
  "recurringIntervalSeconds": 3600
}

{}

POST request for endpoint /api/removeSentinelOneIntegration

post

Body

objectOptional

Responses

200

Integration removed

application/json

objectOptional

403

Forbidden

post/api/removeSentinelOneIntegration

POST /api/removeSentinelOneIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/executeSentinelOneRemoteScript

post

Body

scriptIdstringRequired

Script ID from the SentinelOne script library

Example: script-library-id-001

executeAgentIdsstring[]RequiredExample: ["1234567890123456789","9876543210987654321"]

executeTaskDescriptionstringOptionalExample: Akto guardrail installation

executeInputParamsstringOptional

Space-separated key=value environment variable pairs

Example: AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com

Responses

200

Script execution initiated

application/json

parentTaskIdstringOptional

Use with getSentinelOneScriptTaskStatus to poll for completion

Example: task-uuid-abc123def456

403

Forbidden

422

Unprocessable — scriptId or agentIds missing

application/json

post/api/executeSentinelOneRemoteScript

POST /api/executeSentinelOneRemoteScript HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 237

{
  "scriptId": "script-library-id-001",
  "executeAgentIds": [
    "1234567890123456789",
    "9876543210987654321"
  ],
  "executeTaskDescription": "Akto guardrail installation",
  "executeInputParams": "AKTO_DATA_INGESTION_URL=https://akto-ingestion.example.com"
}

{
  "parentTaskId": "task-uuid-abc123def456"
}

Generic Integrations

#	API	Description
1	POST /api/testIntegration	Tests a configured integration by sending a test payload to verify connectivity.
2	POST /api/addIntegration	Adds or updates a generic integration configuration by type.
3	POST /api/markConnectionAsSkipped	Marks an integration connection as skipped during setup or onboarding.

POST request for endpoint /api/testIntegration

post

Body

baseUrlstringRequiredExample: https://example-org.atlassian.net

projIdstringRequired

Comma-separated project keys

Example: SCRUM,API

userEmailstringRequiredExample: [e-mail]

apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]

jiraTypestring · enumRequiredExample: CLOUDPossible values:

Responses

200

Credentials valid; issue types resolved

application/json

projectAndIssueMapobjectOptional

Map of project key to resolved issue type list

Example: {"SCRUM":[{"issueId":"10001","issueType":"Bug"},{"issueId":"10002","issueType":"Story"}]}

403

Forbidden

422

Unprocessable — invalid credentials or project not found

post/api/testIntegration

POST /api/testIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 158

{
  "baseUrl": "https://example-org.atlassian.net",
  "projId": "SCRUM,API",
  "userEmail": "[e-mail]",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "jiraType": "CLOUD"
}

{
  "projectAndIssueMap": {
    "SCRUM": [
      {
        "issueId": "10001",
        "issueType": "Bug"
      },
      {
        "issueId": "10002",
        "issueType": "Story"
      }
    ]
  }
}

POST request for endpoint /api/addIntegration

post

Body

baseUrlstringRequiredExample: https://example-org.atlassian.net

projIdstringRequiredExample: SCRUM

userEmailstringRequiredExample: [e-mail]

apiTokenstringRequiredExample: [REDACTED_JIRA_API_TOKEN]

issueTypestringOptionalExample: Bug

jiraTypestring · enumRequiredExample: CLOUDPossible values:

projectAndIssueMapobjectOptional

Map of project key to issue type list (from testIntegration response)

projectMappingsobjectOptional

Map of project key to mapping settings

Responses

200

Jira integration saved

application/json

objectOptional

403

Forbidden

post/api/addIntegration

POST /api/addIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 217

{
  "baseUrl": "https://example-org.atlassian.net",
  "projId": "SCRUM",
  "userEmail": "[e-mail]",
  "apiToken": "[REDACTED_JIRA_API_TOKEN]",
  "issueType": "Bug",
  "jiraType": "CLOUD",
  "projectAndIssueMap": {},
  "projectMappings": {}
}

{}

POST request for endpoint /api/markConnectionAsSkipped

post

Body

connectionSkippedstring · enumRequired

Connection type to mark as skipped

Example: SLACK_ALERTSPossible values:

Responses

200

Connection marked as skipped

application/json

objectOptional

403

Forbidden

422

Unprocessable — connectionSkipped is null

post/api/markConnectionAsSkipped

POST /api/markConnectionAsSkipped HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "connectionSkipped": "SLACK_ALERTS"
}

{}

Slack Webhooks

#	API	Description
1	POST /api/addSlackWebhook	Adds a new Slack webhook integration for alert and notification delivery.
2	POST /api/deleteSlackWebhook	Removes a configured Slack webhook integration.

POST request for endpoint /api/addSlackWebhook

post

Body

webhookUrlstringRequiredExample: https://hooks.slack.com/services/[REDACTED_SLACK_WEBHOOK_PATH]

webhookNamestringRequiredExample: security-alerts

dashboardUrlstringOptionalExample: https://app.akto.example.com

frequencyInSecondsintegerOptionalExample: 3600

Responses

200

Slack webhook added

application/json

objectOptional

403

Forbidden

422

Unprocessable

post/api/addSlackWebhook

POST /api/addSlackWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 183

{
  "webhookUrl": "https://hooks.slack.com/services/[REDACTED_SLACK_WEBHOOK_PATH]",
  "webhookName": "security-alerts",
  "dashboardUrl": "https://app.akto.example.com",
  "frequencyInSeconds": 3600
}

{}

POST request for endpoint /api/deleteSlackWebhook

post

Body

webhookNamestringRequiredExample: security-alerts

Responses

200

Slack webhook deleted

application/json

objectOptional

403

Forbidden

post/api/deleteSlackWebhook

POST /api/deleteSlackWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "webhookName": "security-alerts"
}

{}

Custom Webhooks

#	API	Description
1	POST /api/addCustomWebhook	Adds a new custom webhook integration for event notifications.
2	POST /api/checkWebhook	Tests a custom webhook by sending a test request to verify connectivity and response.
3	POST /api/updateCustomWebhook	Updates an existing custom webhook integration configuration.

POST request for endpoint /api/addCustomWebhook

post

Body

webhookNamestringRequiredExample: new-endpoint-notifier

urlstringRequiredExample: https://hooks.example.com/akto-events

methodstring · enumRequiredExample: POSTPossible values:

headerStringstringOptional

JSON string of headers to include

Example: {"Authorization": "Bearer [REDACTED_WEBHOOK_TOKEN]", "Content-Type": "application/json"}

queryParamsstringOptional

bodystringOptional

JSON template for the webhook payload

Example: {"event": "NEW_ENDPOINT", "url": "{{url}}", "collection": "{{collection}}"}

frequencyInSecondsintegerOptionalExample: 3600

activeStatusstring · enumOptionalExample: ACTIVEPossible values:

selectedWebhookOptionsstring[]OptionalExample: ["NEW_ENDPOINT","NEW_SENSITIVE_ENDPOINT"]

newEndpointCollectionsstring[]Optional

newSensitiveEndpointCollectionsstring[]Optional

batchSizeintegerOptionalExample: 100

sendInstantlybooleanOptionalExample: false

webhookTypestringOptionalExample: GENERAL

Responses

200

Custom webhook created

application/json

objectOptional

403

Forbidden

422

Unprocessable — validation failed (invalid URL, method, etc.)

post/api/addCustomWebhook

POST /api/addCustomWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 573

{
  "webhookName": "new-endpoint-notifier",
  "url": "https://hooks.example.com/akto-events",
  "method": "POST",
  "headerString": "{\"Authorization\": \"Bearer [REDACTED_WEBHOOK_TOKEN]\", \"Content-Type\": \"application/json\"}",
  "queryParams": "",
  "body": "{\"event\": \"NEW_ENDPOINT\", \"url\": \"{{url}}\", \"collection\": \"{{collection}}\"}",
  "frequencyInSeconds": 3600,
  "activeStatus": "ACTIVE",
  "selectedWebhookOptions": [
    "NEW_ENDPOINT",
    "NEW_SENSITIVE_ENDPOINT"
  ],
  "newEndpointCollections": [],
  "newSensitiveEndpointCollections": [],
  "batchSize": 100,
  "sendInstantly": false,
  "webhookType": "GENERAL"
}

{}

POST request for endpoint /api/checkWebhook

post

Body

webhookNamestringRequiredExample: new-endpoint-notifier

Responses

200

Existence check result

application/json

webhookPresentbooleanOptionalExample: true

403

Forbidden

post/api/checkWebhook

POST /api/checkWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 39

{
  "webhookName": "new-endpoint-notifier"
}

{
  "webhookPresent": true
}

POST request for endpoint /api/updateCustomWebhook

post

Body

idintegerRequired

Existing custom webhook ID

Example: 7

webhookNamestringRequiredExample: new-endpoint-notifier

urlstringRequiredExample: https://hooks.example.com/akto-events

methodstring · enumRequiredExample: POSTPossible values:

headerStringstringOptionalExample: {"Authorization": "Bearer [REDACTED_WEBHOOK_TOKEN]"}

queryParamsstringOptional

bodystringOptionalExample: {"event": "NEW_ENDPOINT", "url": "{{url}}"}

frequencyInSecondsintegerOptionalExample: 1800

activeStatusstring · enumOptionalExample: ACTIVEPossible values:

selectedWebhookOptionsstring[]OptionalExample: ["NEW_ENDPOINT"]

Responses

200

Webhook updated

application/json

objectOptional

403

Forbidden

422

Unprocessable — validation failed

post/api/updateCustomWebhook

POST /api/updateCustomWebhook HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 352

{
  "id": 7,
  "webhookName": "new-endpoint-notifier",
  "url": "https://hooks.example.com/akto-events",
  "method": "POST",
  "headerString": "{\"Authorization\": \"Bearer [REDACTED_WEBHOOK_TOKEN]\"}",
  "queryParams": "",
  "body": "{\"event\": \"NEW_ENDPOINT\", \"url\": \"{{url}}\"}",
  "frequencyInSeconds": 1800,
  "activeStatus": "ACTIVE",
  "selectedWebhookOptions": [
    "NEW_ENDPOINT"
  ]
}

{}