# Welcome Thanks for joining us on this adventure. We’re working hard to add clarity and understanding to activity in your SaaS environment. As you get started, there’s a few orientation items to cover. We are still actively developing this documentation, so if you see something missing, please let us know! ## Integrating With Your SaaS Environment The first thing you’ll want to do is get some logs flowing from your SaaS products into Turngate. Once you've logged in, click the `Data Sources` link in the navbar on the left, then click “Install” on a data source you’d like to integrate. Many of our integrations leverage OAuth so as long as you’ve got permissions on the SaaS product side, the installation is basically one button press. For those that don’t support OAuth, there are instructions on how to onboard the logs into our platform. If you run into any issues or have ideas on other integrations you’d like to see, just [ping us](mailto:support@turngate.io). ## Looking at Your Data Once your log data is flowing into Turngate, you’ll be able to interact with it on the primary [dashboard](https://app.turngate.io/). There are currently two ways of looking at your data; a heatmap which allows you to visually analyze the data at a high level and a table view that lets you easily see the specifics of your audit records. We’re not going to walk through all the parts of the UI but we will at least give you the broad brush strokes as it were. Again, this is all a work in progress as we build out our tool and continue to refine how to get you answers to your SaaS log questions as quickly as possible. If you’ve got feedback, [we’re all ears](mailto:support@turngate.io). ## Continuing to Help You If you still have questions, please search our knowledge base as we’re continuing to grow the information we’ve got here. Also, if you’ve got feedback for us, please reach out either in the app or via [email](mailto:support@turngate.io). We’re constantly working to make Turngate better and help you understand your enterprise better. Let us know how we can help and we’ll do what we can to make it happen. ### Jump right in
Getting StartedAdd your first Data Source/pages/DSQqnsAqJPnIRyPgQJ1S
TerminologyLearn the Termgate /pages/fMZWJJDCXZErIBGkygK7
Add your TeamShare the power/pages/5IwOoZSaJH0wQEEsJV4l
# How Turngate Thinks About Logs We think about logs differently. We think you should too. “Make logs easier to understand” is a driving principle at Turngate. We want to make sure that users from all backgrounds can get value from using our tools. We’ve invested a lot of time and energy into making our UI easy to use and simple to navigate. We’ve also spent a lot of time thinking about logs in general. In order to fully utilize our products, it’s useful to know how we think about logs; how they’re structured, the content in them, what makes them the same, and what makes them different. This article contains information on our data ontology. “Ontology” is a fancy word for “how we structure our data.” Well, at least that’s a rough definition. We can get into the semantics and syntactics of ontologies, taxonomies, and hierarchies, but there’s a word limit to the size of these articles, so we’re going with “how we structure our data.” ## Terminology ### Categories At the top level, we’ve got a handful of categories that we associate with every log entry. These categories are the primary mechanism analysts use to dig into their log data. These top level buckets allow you to quickly find the information you’re looking for, but it’s important to understand what each category contains. ### Actors Actors are the “who” of an audit log. You may note we didn’t say identity. If you did, contact us and we’ll send you some stickers. The use of the term “Actor” is very purposeful; an actor is the entity that caused the log to happen. Actors can have multiple identities associated with them. For instance, one system may use an email as the identifier (such as ), another may use just the username (jimsmith), and another may allow people to use any identifier they want (superduperaccountant). When investigating activity, tracking all the different identities associated with a person can be complicated, so we try to roll everything together under one actor to simplify things. ### Data Sources Data Sources answer the question “who sent this log?” It’s basically the SaaS provider that sent over your logs. Okta, Google Workspace, Github, and Box are all examples of data sources you can onboard at Turngate (there’s more, we’re just listing a few as examples). If you’re only interested in Google Workspace, you can select just that data source. Easy. ### Locations Where was the Actor when they did the action? That’s a Location. Locations are IP addresses and can be sorted and searched against. As we grow we plan on allowing groups of IP’s to represent a more abstract concept of Location. For instance, you will be able to group a bunch of IP’s into a “Corporate Office” location. But we’re not there quite yet. NOTE: Ontologies are useful for not just who you are but who you want to be. By talking about Locations instead of IP addresses early in our development, we don’t have to change our ontology as we grow. Cool, eh? ### Application Now we’re getting to the unique part of Turngate. An application is the generic type of application that the audit log pertains to. Rather than force you to know the details of all the logs (or specific product names) from a given SaaS provider, we categorize them into generic applications so you can easily understand at a high level the nature of the events you’re looking at. Further, these buckets are really generic so if you want to search for all file access from a given IP address regardless if the users were using Box, Dropbox, Google Drive, or Microsoft OneDrive, you can just filter on FileStorage and see it all in once place. Cool, eh If you want to find all file accesses a particular user made, you don’t want to have to dig through Google Drive logs, Box logs, OneDrive logs, and Dropbox logs. With Turngate you can just select “File” as an application and see all file related activity. Calendar, Login, Conferencing, and Chat are other examples of generic applications you can filter by. ### Context Activities are also categorized as to whether they were performed in a user, system, or administrative context. We pre-sort all activities to make it easy to find all the administrative actions someone took without having to know all the administrative activities possible. ### Access Finally, we categorize actions based on the type of access the user performed. Reads, writes, and deletes are common access categories tho there are other more specialized ones. ### Wrapping up Every audit record sent to Turngate is assigned values to each of the above categories. These categories serve as the core of how you filter, sort, and dig through all your data to find the information that’s useful to you. If this is confusing or you have ideas on how can we approve, mash the contact link below and let us know. Thanks! # Quickstart
Beautiful documentation starts with the content you create — and GitBook makes it easy to get started with any pre-existing content. {% hint style="info" %} Want to learn about writing content from scratch? Head to the [Basics](/setup/editor) section to learn more. {% endhint %} ### Import GitBook supports importing content from many popular writing tools and formats. If your content already exists, you can upload a file or group of files to be imported.
### Sync a repository GitBook also allows you to set up a bi-directional sync with an existing repository on GitHub or GitLab. Setting up Git Sync allows you and your team to write content in GitBook or in code, and never have to worry about your content becoming out of sync. # Adding Users To add a user, first, you'll need to be an Organization Administrator. If your account has Organization Administrator permissions, after logging in, click the `Users` icon on the Navbar on the left. From there, enter the user's email and assign the Role you'd like their account to have, then click `Send Invite`. The user will have 72 hours to accept the invitation before it expires. # Permissions ## Organization Administrator The top-level user for a Turngate organization, the Organization Administrator has all permissions. They can add new data sources, change the account type, add new users and set the user roles. ## Integration Administrator A mid-level user for Turngate, Integration Administrators can add data sources to the organization setup. However, they cannot invite new users or make changes to the account type. ## Analyst An analyst is the base user-type for Turngate. They have the least required permissions - able to conduct queries on the data and read heat maps and tables. However, they cannot invite new users, add data sources or make changes to the account type # Publish your docs Once you’ve finished writing, editing, or importing your content, you can publish your work to the web as a docs site. Once published, your site will be accessible online only to your selected audience. You can publish your site and find related settings from your docs site's homepage.
# Integrations Integrations are a connected system or service - such as Google Workspace, Okta, or GitHub that generates activity logs that can be ingested by Turngate. You can have multiples of the same Integration, each known as a Data Source, which can be given a unique name to differentiate them. So if you space has three different Google Workspaces, you can name them Google Workspace 1, 2, and 3. In order to set up an integration your account must be an Integration Administrator or higher role, and you must have permissions on the integration side to connect it to 3rd party software. ## Integrating With Your SaaS Environment The first thing you’ll want to do is get some logs flowing from your SaaS products into Turngate. Once you've logged in, click the `Data Sources` link in the navbar on the left, then click “Install” on a data source you’d like to integrate. Many of our integrations leverage OAuth so as long as you’ve got permissions on the SaaS product side, the installation is basically one button press. For those that don’t support OAuth, there are instructions on how to onboard the logs into our platform. If you run into any issues or have ideas on other integrations you’d like to see, just [ping us](mailto:support@turngate.io). ## Something missing? Turngate connects to the SaaS tools listed below. Yes, we do plan to add more, if you use one that's not on the list please let us know you'd like to see it added. ### Integrations
Cover image
BoxFile Sharing/pages/z76855CkJbOrTXGxComz/files/CC4pleiXU4CV4BgunPxY
ClaudeArtificial Intelligence/pages/dOEM31vXYXr5hwrfIwQt/files/yAfAvnCK7tvkRBxObOVB
ConfluenceKnowledge Management/pages/JVdVcabS3aTQak4PKco4/files/01TifL70Z7bVsSGKNCK5
DropboxFile Sharing/pages/FrY9xPP7M2TXtfV6bSNq/files/hG5GpbtFxgT1BV5mYCnj
GitHubSource Control/pages/Y2rjwMiLSzaKcBoBDiU3/files/lTNoalz74UgTIMxoktmA
Google WorkspaceCollaboration/pages/tQ7vQIgfDqrDWdHVizcN/files/1BsbmfD4FzFyJZGsKQdi
JiraTask Management/pages/XawrZIPRo9JU9lssnBXT/files/p6x8UwhbIuIPJlEgIDKd
SalesforceCustomer Relationship Management/pages/sJBzN4z3Z1DwSlMPEVL3/files/gWV2FulJDh3zBkCvoL5J
Microsoft 365Collaboration/pages/TUW2AcSF6yCYWFZ1bWiu/files/wxgeqtOSsUA0lsfdAfrR
OktaAuthentication and Identity/pages/EZ4o33liO6geSieH1fwf/files/VYwZAft3uTTyBQP9hZ3A
CloudflareNetwork Security/pages/toM2V3VqWnb5k3D6rGvC/files/xT9dmUrjYVOgc2Jdu0NM
OpenAIArtificial Intelligence/pages/GK4uZTNO2AhXWdxOzNdy/files/zfBJBkm0J7xxDkq3fly7
1PasswordAuthentication/pages/a47648770381d80940221d778d3f200efbd5b72c/files/ZhIFIAQF7VSnOJOhLV3r
# Box ## Setting Up ### Preparing your Box Account to Allow the Turngate App To set up the Box integration you need to be a Box Administrator. If you meet the above requirements, log in to your Box account and click on the `Admin Console` link at the bottom left.

This is usually in the bottom left of the nav panel after logging into box

Once you're in the Admin panel, look for the `Integrations` section on the left:
Then, on the main content panel, select the `Platform Apps Manager` Once there, click the `+` sign to Add a Platform App
You will need to enter the Turngate Client ID here. The Client ID is: ``` ub4l9jgeo9ivbzd8gqjul6vhcsgx0687 ``` You should see a confirmation page saying you are authorizing the Turngate App, showing the scopes it is requesting, and allowing you to review before you click Authorize. Click **`Authorize`** **You will need to get your Enterprise ID before you head back to the Turngate App!** ## Enterprise ID Before you head back to the Turngate App, click the `Account & Billing` tab in the Box Admin Console. Under the Account Information look for "Enterprise ID" which is a 10 digit number you will need in the setup of the Turngate Integration. ## Setting up the Box Data Source in the Turngate App Once you have the App authorized in the Box Admin Console and have your Enterprise ID you will be ready to head back to the Turngate App to set up your Box Data Source. Once you have logged into the Turngate App, click on "Data Sources" in the navigation bar on the left, select Box, and follow the prompts. You will need to give this Data Source a name for you to reference it, and provide the Enterprise ID and click `Install`. ### Other Resources Event Types — [Box Developer Guide](https://developer.box.com/guides/events/user-events/for-user/#event-types) ## Scopes Requested * Manage groups * Manage app users * Manage enterprise properties * Manage users # Claude Code and Cowork Auditing of Claude Code and Cowork activity can be performed by the native Claude OpenTelemetry interface as well as Turngate's custom client side hook. ## OTel Configuration ### Account Requirements OTel data is sent from the client to an OTel collector via environment variables. As of March 2026, there are no specific account requirements to configure this collection. However, only Teams and Enterprise accounts can supply configuration from a central location using [Server-Managed Settings](https://code.claude.com/docs/en/server-managed-settings). If you are using Server-Managed Settings, the end user cannot modify the OTel configuration. ## Setting up the Claude Code Data Source in the Turngate App OTel access is controlled via an OTel ingest token. During the onboarding process you will be assigned a token for your org. To get started, go to the [Integrations Page](https://app.turngate.dev/integrations) and start the Claude OTel integration wizard. Walk through the initial steps and then you will be presented with the token and endpoint information.
Copy the token value and store it securely. Then, set up Claude Code with the following environment: 
{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/json",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://collector.turngate.io",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer tg_otel_<YOUR TOKEN HERE>",
    "OTEL_METRIC_EXPORT_INTERVAL": "100000",
    "OTEL_LOGS_EXPORT_INTERVAL": "30000",
    "OTEL_LOG_USER_PROMPTS": "1",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}
These environment variables can either be added manually locally or via the Claude Management interface if you have the appropriate Claude license. Once the integration has been saved within Turngate and environment variables have been appropriately updated, OTel data should be flowing immediately. GIven the nature of OTel, there will be no historic ingestion of logs. ### Setting up Cowork Take the bearer token and endpoint information and put it in the "Monitoring" section of the Cowork settings in the Claude native app.
### Other Resources Claude [Server-Managed Settings](https://code.claude.com/docs/en/server-managed-settings) Claude [Monitoring Usage](https://code.claude.com/docs/en/monitoring-usage) (OTel Config) # Confluence ### Setting Up Atlassian products like Confluence and Jira use OAuth 2.0 for authentication. You must have the appropriate permissions within your Atlassian account to grant access to our App to begin. From there, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. {% hint style="info" %} It helps to already be logged in to your Atlassian account before starting the Integration setup process. {% endhint %} ### Scopes Requested * Manage * confluence-configuration * Manage global settings. View * confluence-groups, confluence-user, Audit log records * Permits retrieval of user groups. * View user information in Confluence that you have access to, including usernames, email adresses and profile pictures. * View and export audit records for Confluence events. ### Other Resources Event Types — [Audit Log Events in Confluence](https://confluence.atlassian.com/doc/audit-log-events-in-confluence-1005333793.html) # Dropbox ### Setting Up Dropbox setup uses OAuth 2.0 for authentication. You must have the appropriate permissions within your Dropbox account to grant access to our App to begin. From there, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. {% hint style="info" %} It helps to already be logged in to your Dropbox account before starting the Integration setup process. {% endhint %} ### Scopes Requested * Individual Permissions * View members' Dropbox sharing settings and collaborators * View basic information about members' Dropbox account such as your username, email, and country * Team Permissions * View and edit governance data of your team's files and folders * View your team membership * View your team's activity log * View structure of your team's and members' folders * View basic information about your team including names, user count, and team settings ### Other Resources Event Types * [v2 Get Events API Migration guide](https://www.dropbox.com/developers/reference/events-migration-guide) * [Audit Log Event API documentation](https://www.dropbox.com/developers/documentation/http/teams#team_log-get_events) # GitHub ### Setting Up Github uses OAuth 2.0 for authentication. You must have the appropriate permissions within your Github account to grant access to our App to begin. From there, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. ### Other Resources Event Types — [Audit Log Events for your Enterprise](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise) # Google Workspace ### Setting Up For Turngate to access the audit logs, you must authorize us to query the Audit API using Google's Admin SDK. You must do this with a user account that has authorization to grant these permissions on your Google Workspaces account. If you’re not an admin for your Google instance, invite your admin on the [User Administration](https://app.turngate.io/users-admin) page. You can review or revoke this access at any time within your [Google Account Security & Privacy Settings](https://myaccount.google.com/connections?continue=https%3A%2F%2Fmyaccount.google.com%2Fdata-and-privacy) **License required** One of the following is required * Cloud Identity * Cloud Identity Premium * Any Google Workspace Licenses #### Setting up the Google Data Source in the Turngate App Google setup uses OAuth 2.0 for authentication. To set up, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. It is important to check the box for "Select All" when Google prompts you to select what Turngate can access. ### Scopes Requested * See your profile info * See your primary Google Account email address * See your personal info, including any personal info you've made publicly available * See info about users on your domain * See profile info about your domain users, such as their: * Names * Email * Addresses * Phone numbers * Metadata, including user's role, manager info, and last login time * View usage reports for your G Suite domain * View reports of how users are using Google apps within your G Suite domain (e.g., number of users and quantity of emails sent by each user) * View audit reports for your G Suite domain * View audit reports of admin and user activity in your G Suite domain (e.g., password change events and document view events) * View delegated admin roles for your domain * View delegated admin roles that are currently defined for your domain ### Other Resources Event Types — [Activity Audit Events](https://developers.google.com/workspace/admin/reports/v1/appendix/activity/access-transparency) # Google Workspace Admin Alert Center Description and Setup of Google Workspace Admin Alert Center The **Google Workspace Alert Center** is a centralized hub where administrators can view and manage important security- and policy-related alerts across their Google Workspace environment. It provides real-time visibility into activities that may impact the security, privacy, or compliance posture of your organization. Typical alerts include: * **Account security events** – suspicious logins, password leaks, or compromised accounts. * **Application activity** – unusual OAuth activity or risky third-party app access. * **Compliance and policy alerts** – issues such as phishing, malware, or violations of configured rules. * **Configuration and system notifications** – critical changes in Workspace services or settings. These alerts give admins actionable insights into potential threats and operational issues, allowing them to quickly investigate and respond. ### Setting Up Access to the **Google Workspace Admin Alert Center API** is granted through **domain-wide delegation (DWD)**. This mechanism allows a service account to impersonate Workspace administrators and securely access alerts on behalf of your domain. For Turngate to access the Alert API, you must authorize our Client to query the Alert Center API. This must be done with a user account that has authorization to grant these permissions on your Google Workspaces account. If you’re not an admin for your Google instance, invite your admin on the [User Administration](https://app.turngate.io/users-admin) page. You can review or revoke this access at any time within your [Google Account Domain-Wide Delegation Settings](https://admin.google.com/u/0/ac/owl/domainwidedelegation) 1. Using a Google Workspace Admin account, navigate to the Admin Console's API Controls > Domain-wide Delegation Settings ([direct link](https://admin.google.com/u/0/ac/owl/domainwidedelegation)) 2. Add a new API Client by clicking "Add new" 3. Enter the following:
1. Client ID: 113318611157249789508 2. OAuth scopes:
4. Click "Authorize" 5. Double check for errors by ensuring the "Name" says "Turngate" in the list 6. Return to the Turngate App, click the "Data Sources" icon in the navbar to configure datasources 7. Click "Install" on the "Google Workspace Alert Center" selection 8. Provide the email address of the admin user that has Alert Center API access privileges ### Other Resources {% embed url="" %} Turn Alerts On or Off {% endembed %} {% embed url="" %} Types of Alerts and Details {% endembed %} # Jira ### Setting Up Atlassian products like Confluence and Jira use OAuth 2.0 for authentication. You must have the appropriate permissions within your Atlassian account to grant access to our App to begin. From there, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. {% hint style="info" %} It helps to already be logged in to your Atlassian account before starting the Integration setup process. {% endhint %} ### Scopes Requested * Manage * jira-configuration * View * jira-user, jira-work, Organisation membership informations ### Other Resources Event Types — [Audit Log Events in Jira](https://confluence.atlassian.com/adminjiraserver/audit-log-events-in-jira-998879036.html) # Microsoft 365 ## Microsoft 365: Turning on Audit Logs Learn how to turn on M365 Audit Logs—they’re not on by default! Before you can onboard Microsoft 365 as a data source in Turngate, you must first enable audit logging (per the [instructions on Microsoft’s Support site](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable)). Audit logging is a special type of customization and by default M365 tenants can’t change this setting without doing some other work first. {% hint style="info" %} If you are getting the error: "Microsoft.Exchange.Configuration.Tasks.InvalidOperation|nDehydratedContextException The command you tried to run isn't currently allowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization" its likely because you are trying to access Audit Logs and haven't yet completed these steps. {% endhint %} The fancy term for what’s required is “Enabling Organization Customization.” Or more specifically, you need to run `Enable-OrganizationCustomization` via PowerShell in your M365 Tenant. First, see if your tenant has customization enabled. In PowerShell, run the following command: ```powershell Get-OrganizationConfig | FL isDehydrated ``` If the result is “True” then customization is not enabled. If the result is “False” then you’re good to go and can stop reading here. If you need to enable customization, run the following command in PowerShell: ```powershell Enable-OrganizationCustomization ``` Then, to verify Customization is enabled, re-run: ```powershell Get-OrganizationConfig | FL isDehydrated ``` {% hint style="info" %} NOTE: it may take up to 30 minutes for this change to take effect. So, maybe step out for a coffee or patch some systems and then check again to see if the change took. {% endhint %} Now you can turn on audit logs. Be aware that turning on the logs can also have a delay, and logs are only captured from the time you turn them on; there are no logs available prior to flipping the log switch. ## Microsoft 365: App Permissions Set the correct permissions on your App Registration. Setting the correct permissions to ensure Turngate can access both your user accounts (to link activities to Actors) as well as the Activity records themselves. The API Permissions in the App Registration should look like the below image:
### Other Resources Event Types — [Audit Log Activities](https://learn.microsoft.com/en-us/purview/audit-log-activities) # Okta ### Setting Up You must have the admin authorization within your Okta account to grant access to our App. If you’re not an admin for your Okta instance, invite your admin on the [User Administration](https://app.turngate.io/users-admin) page. To set up an Okta integration, you will need your sign-in URL and an API token. **Where do I find my Sign-In URL?** This is the URL you use to sign in to Okta and should look like this: > [https://my-company-name.okta.com](https://my-company-name.okta.com/) Enter the whole URL in the *Okta URL* field. Okta has a guide to help you find the sign-in URL if you don't already know it: > [Quickly Find Your Company's Okta Sign In](https://support.okta.com/help/s/okta-sign-in?language=en_US) #### Creating an Okta API token 1. Sign in to your Okta Account. [Need help finding the link?](https://support.okta.com/help/s/okta-sign-in?language=en_US) 2. Navigate from the Admin Console to **Security** > **API** 3. Go to the Tokens tab on the API page 4. Click "Create Token" 5. Name the token and click "*Create Token*" 6. Copy your token value. It will not be saved in your account 7. Return to Turngate App and enter the token value in the *Okta API token* field ### Other Resources Event Types — [Event Types](https://developer.okta.com/docs/reference/api/event-types/) # Salesforce ### Setting Up Salesforce setup uses OAuth 2.0 for authentication. You must have the appropriate permissions within your Salesforce account to grant access to our App to begin. From there, you'll only need to click install from within the Turngate app and proceed through the Authorization prompts to authorize Turngate to access your audit logs. {% hint style="info" %} It helps to already be logged in to your Salesforce account before starting the Integration setup process. {% endhint %} ### Turning on Logging By default, logging is not turned on in SalesForce. Navigate to Security -> Event Monitoring -> Event Monitoring Settings and turn on “Generate Event Logs." That will start the logging process but it make take a while (hours to a full day) for logs to start showing up. You can verify logs are being created by checking the Turngate interface or looking for log files that can be downloaded from SalesForce. ### License Considerations The types of logs available depend on the license level and add-ons you have. Basic user logging is included Classic and Lightning Experience licenses. This captures high level user and system events (logins, configuration changes, etc) but not much else. If you want detailed audit logs about user and system activity on the platform, that requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions for Enterprise, Performance, and Unlimited editions. There may be seprate configuration options depending on your license and desired level of logging. ### Other Resources SalesForce Event Types — [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm) Managing Realtime Monitoring - [Manage Real-Time Event Monitoring Events](https://help.salesforce.com/s/articleView?id=xcloud.event_monitoring_monitor_events_with_event_manager.htm\&type=5) # Cloudflare Turngate ingests audit logs from your Cloudflare account so you can investigate account- and zone-level activity alongside the rest of your SaaS audit data. ## Setting Up ### Preparing your Cloudflare Account To set up the Cloudflare integration you need to be a Super Administrator on the Cloudflare account you want to connect. Audit logs are pulled at the account level, so a single Data Source will cover every zone in that account. {% stepper %} {% step %} ## Log in to Cloudflare Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select the account you want to connect. {% endstep %} {% step %} ## Open API Tokens From the account home, open **Manage Account → API Tokens**. {% endstep %} {% step %} ## Create a custom token Click **Create Token** and choose **Create Custom Token**. {% endstep %} {% step %} ## Configure token permissions Give the token a descriptive name (e.g. `Turngate Audit Log Reader`) and grant the following permissions: * **Account → Account Settings → Read** * **Account → Audit Logs → Read** * **Account → Access: Organizations, Identity Providers, and Groups → Read** (only required if you use Cloudflare Access and want those events included) {% endstep %} {% step %} ## Scope the token to your account Under **Account Resources**, scope the token to the specific account you want Turngate to monitor. {% endstep %} {% step %} ## Set token restrictions Leave **Client IP Address Filtering** blank and set a **TTL** that matches your internal token-rotation policy. {% endstep %} {% step %} ## Create and copy the token Click **Continue to summary**, then **Create Token**, and copy the token value. You will not be able to view it again. {% endstep %} {% endstepper %} You will also need your **Account ID**, which is shown on the right-hand sidebar of any zone's Overview page in the Cloudflare dashboard. {% hint style="info" %} We recommend creating the token under a service account or shared admin identity rather than a personal login so that audit collection isn't interrupted if an individual leaves your organization. {% endhint %} ### Setting up the Cloudflare Data Source in the Turngate App Once you have your API token and Account ID, head back to the Turngate App. {% stepper %} {% step %} ## Open Data Sources Click **Data Sources** in the navigation bar on the left. {% endstep %} {% step %} ## Install Cloudflare Click **Install** on the **Cloudflare** selection. {% endstep %} {% step %} ## Name the Data Source Give the Data Source a name for your own reference. {% endstep %} {% step %} ## Add credentials Paste in the **Account ID** and **API Token** you generated above. {% endstep %} {% step %} ## Install the Data Source Click **Install**. {% endstep %} {% endstepper %} Turngate will validate the credentials and begin pulling audit logs. Up to 30 days of historical logs will be backfilled where available. ## Scopes Requested * Account Settings — Read * Audit Logs — Read * Access: Organizations, Identity Providers, and Groups — Read (optional, only if Cloudflare Access events are desired) ## Other Resources * [Cloudflare Audit Logs documentation](https://developers.cloudflare.com/fundamentals/account/account-security/review-audit-logs/) * [Creating API tokens](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) * [Audit log event reference](https://developers.cloudflare.com/logs/reference/audit-logs/) # OpenAI Turngate ingests audit logs from your OpenAI organization so you can monitor administrative actions across your ChatGPT Enterprise, ChatGPT Team, or API-only OpenAI organization. ## Setting Up ### Preparing your OpenAI Organization To set up the OpenAI integration you must be an **Owner** of the OpenAI organization you want to connect. Audit log access is scoped at the organization level, so a single Data Source will cover all projects in that organization. {% hint style="info" %} The Audit Logs API is available on ChatGPT Enterprise, ChatGPT Team, and OpenAI API organizations that have an admin plan. If you do not see the **Admin keys** section described below, your organization may not have access enabled — contact OpenAI support. {% endhint %} 1. Log in to the [OpenAI platform dashboard](https://platform.openai.com/) and switch to the organization you want to connect using the org switcher in the top-left. 2. Open **Settings → Organization → Admin keys**. 3. Click **Create new admin key**. 4. Give the key a descriptive name (e.g. `Turngate Audit Log Reader`). 5. Click **Create key** and copy the value immediately. OpenAI will not show it again. You will also need your **Organization ID**, which is shown on **Settings → Organization → General** (it begins with `org-`). ### Setting up the OpenAI Data Source in the Turngate App Once you have your admin key and Organization ID, head back to the Turngate App. 1. Click **Data Sources** in the navigation bar on the left. 2. Click **Install** on the **OpenAI** selection. 3. Give the Data Source a name for your own reference. 4. Paste in the **Organization ID** and **Admin Key** you generated above. 5. Click **Install**. Turngate will validate the credentials and begin pulling audit logs. OpenAI retains audit logs for the past 30 days, and Turngate will backfill whatever is available at install time. ## What Gets Ingested The OpenAI Audit Logs API exposes administrative events such as: * User invitations, additions, removals, and role changes * Project creation, updates, archival, and membership changes * API key creation and deletion (both user and service account keys) * Service account creation and deletion * SSO and SCIM configuration changes * Login events for users in the organization Turngate does **not** ingest the content of prompts or completions — only administrative audit events. ## Other Resources * [OpenAI Audit Logs API documentation](https://platform.openai.com/docs/api-reference/audit-logs) * [Managing admin keys](https://platform.openai.com/docs/guides/production-best-practices/api-keys) * [Audit log event types reference](https://platform.openai.com/docs/api-reference/audit-logs/object) # 1Password Turngate ingests audit events, sign-in attempts, and item usage events from your 1Password Business account so you can investigate vault access and administrative activity. ## Setting Up ### Preparing your 1Password Account To set up the 1Password integration you need to be an **Owner** or member of the **Team Members Manager** group on a **1Password Business** account. The Events API used by this integration is not available on 1Password Families, Individual, or Teams plans. {% stepper %} {% step %} ## Sign in to your 1Password account Sign in to your 1Password account at `https://.1password.com`. {% endstep %} {% step %} ## Open Integrations Click **Integrations** in the sidebar. {% endstep %} {% step %} ## Add an integration under Events Reporting Under **Events Reporting**, click **Other** (or the **Add Integration** button if you have existing integrations). {% endstep %} {% step %} ## Name the integration Give the integration a descriptive name (e.g. `Turngate`) and click **Add Integration**. {% endstep %} {% step %} ## Choose the event types On the next screen, choose which event types you want Turngate to be able to read. We recommend enabling all three: * **Sign-in attempts** * **Item usage** * **Audit events** {% endstep %} {% step %} ## Set the expiration Set an **Expires** value that matches your internal token-rotation policy (the maximum is currently set by 1Password). {% endstep %} {% step %} ## Issue the token Click **Issue Token** and copy the token value. You will not be able to view it again. {% endstep %} {% endstepper %} You will also need your **1Password account sign-in URL** (e.g. `https://acme.1password.com`) — Turngate uses this to determine the correct regional Events API endpoint. ### Setting up the 1Password Data Source in the Turngate App Once you have your bearer token and account URL, head back to the Turngate App. {% stepper %} {% step %} ## Open Data Sources Click **Data Sources** in the navigation bar on the left. {% endstep %} {% step %} ## Install 1Password Click **Install** on the **1Password** selection. {% endstep %} {% step %} ## Name the Data Source Give the Data Source a name for your own reference. {% endstep %} {% step %} ## Add your credentials Paste in your **1Password account URL** and the **Bearer Token** you generated above. {% endstep %} {% step %} ## Install Click **Install**. {% endstep %} {% endstepper %} Turngate will validate the credentials and begin pulling events. The Events API supports historical lookback up to the retention window of your 1Password plan; Turngate will backfill what is available at install time. ## What Gets Ingested * **Sign-in attempts** — successful and failed sign-ins, including client type, IP address, and country * **Item usage** — which user accessed which item in which vault, and from what client * **Audit events** — administrative actions such as user provisioning, group membership changes, vault permission changes, and policy updates Turngate does **not** receive any vault item contents (passwords, secure notes, etc.) — only metadata about access and administration. ## Other Resources * [1Password Events Reporting overview](https://support.1password.com/events-reporting/) * [Events API reference](https://developer.1password.com/docs/events-api/) * [Get started with Events Reporting](https://support.1password.com/events-reporting-other/) # Editor GitBook has a powerful block-based editor that allows you to seamlessly create, update, and enhance your content.
### Writing content GitBook offers a range of block types for you to add to your content inline — from simple text and tables, to code blocks and more. These elements will make your pages more useful to readers, and offer extra information and context. Either start typing below, or press `/` to see a list of the blocks you can insert into your page. ### Add a new block {% stepper %} {% step %} ### Open the insert block menu Press `/` on your keyboard to open the insert block menu. {% endstep %} {% step %} ### Search for the block you need Try searching for “Stepper”, for exampe, to insert the stepper block. {% endstep %} {% step %} ### Insert and edit your block Click or press Enter to insert your block. From here, you’ll be able to edit it as needed. {% endstep %} {% endstepper %} # Markdown GitBook supports many different types of content, and is backed by Markdown — meaning you can copy and paste any existing Markdown files directly into the editor!
Feel free to test it out and copy the Markdown below by hovering over the code block in the upper right, and pasting into a new line underneath. ```markdown # Heading This is some paragraph text, with a [link](https://docs.gitbook.com) to our docs. ## Heading 2 - Point 1 - Point 2 - Point 3 ``` {% hint style="info" %} If you have multiple files, GitBook makes it easy to import full repositories too — allowing you to keep your GitBook content in sync. {% endhint %} # Images & media GitBook allows you to add images and media easily to your docs. Simply drag a file into the editor, or use the file manager in the upper right corner to upload multiple images at once.

Add alt text and captions to your images

{% hint style="info" %} You can also add images simply by copying and pasting them directly into the editor — and GitBook will automatically add it to your file manager. {% endhint %} # Interactive blocks In addition to the default Markdown you can write, GitBook has a number of out-of-the-box interactive blocks you can use. You can find interactive blocks by pressing `/` from within the editor.
### Tabs {% tabs %} {% tab title="First tab" %} Each tab is like a mini page — it can contain multiple other blocks, of any type. So you can add code blocks, images, integration blocks and more to individual tabs in the same tab block. {% endtab %} {% tab title="Second tab" %} Add images, embedded content, code blocks, and more. ```javascript const handleFetchEvent = async (request, context) => { return new Response({message: "Hello World"}); }; ``` {% endtab %} {% endtabs %} ### Expandable sections
Click me to expand Expandable blocks are helpful in condensing what could otherwise be a lengthy paragraph. They are also great in step-by-step guides and FAQs.
### Drawings ### Embedded content {% embed url="" %} {% hint style="info" %} GitBook supports thousands of embedded websites out-of-the-box, simply by pasting their links. Feel free to check out which ones[ are supported natively](https://iframely.com). {% endhint %} # Enterprise IdP / SSO We believe in best practices, so we try to ensure we support them everywhere we can, that includes providing flexible Identity options to users, without charging extra. **If you would like to leverage one (or more) of the following Authentication Providers, please contact support before setting up an account so we can provision the account with the selected provider(s) as your authentication provider.** ### **We currently support the following Enterprise Login Providers:** HYPR [](/advanced-setup/enterprise-idp-sso/okta-sso-setup) ### **We currently support the following Social Login Providers:** {% hint style="info" %} If using a Social Login provider, the user management will still be performed in the Turngate app. With Enterprise Login Providers, the Group Management can be done within your IdP and an account is created on the fly when a valid Login Token is provided by your IdP {% endhint %} # Google Social Login Setup We can enable Google Social Login for your Organization, # Copy of Google Social Login Setup ### Creating a Google OAuth Internal App Go to the Google API Console (console.developers.google.com) and login using your Google account. If this is the first time that you're visiting this site, you will be asked to agree to the Terms of Service. In the upper left hand corner of the screen click Select a project and then CREATE PROJECT as shown in the screen below:
Enter a Project name and then click the CREATE button as shown in the screen below:
Next, from the APIs & Services Section, click on the OAuth consent screen from the left-hand menu. You may need to click "Get started" Then select either Internal or External to define your target user scope. Once selected, click the CREATE button.
Click "Get started"
Walk through the form providing a name, contact email, etc. You will be making an **Internal** App so only your internal users can log in. Now within APIs & Services, click Credentials, then + Create Credentials from the menu at the top, and select + Create Client, as shown below:
When creating the OAuth Client you will need to use the following value: Authorized JavaScript origins: `https://login.turngate.io` Authorized redirect URIs: `https://login.turngate.io/provider/continue`
Click Create, which will return you to the Clients list page where you can select the client and get to the detailed view of the Client you just created.
You will need to provide us with the Client ID and Client Secret in order to configure this for login. Reach out to to get the form to securely submit this data. # Okta SSO Setup Creating a new Okta App is a quick and easy process. First, log in to your Okta Admin Console. Under Applications, select Create App Integration
You will want to create an OIDC Web Application
The New Web App Integration form will appear after you click Next
The important part here is the Sign-In redirect URI, which is: `https://login.turngate.io/provider/continue`
Under Assignments, Controlled Access, you will want to select either "Limit Access to Selected Groups" and assign group membership now, or "Skip group assignment for now" and come back to this later. Users will not be able to authenticate to our service if they are not assigned to the Application in Okta. User permissions can be set by an Administrator once they are provisioned in the Application. Once you click "Save" you will come back to the Application view where your Client ID and Client Secrets are. You will need to provide us with these in order to set up Okta as your SSO. Reach out to to get the form to securely submit this data. # Query Builder # The Heatmap Heatmaps are a useful way to visualize data based on frequency. If you’ve seen GitHub commit heatmaps, this is basically the same idea but with blue circles instead of green squares. You can manipulate the heatmap using the filters at the top to select only data of interest and the bollards at the bottom to change the time period of the search. Once you apply the filter, the heatmap will provide you a graphical representation of frequency of activities. The larger the circle, the more activity. In the example below you can see Bruce was doing a LOT of calendar work on Nov 5th and worked with a bunch of files on the 6th.
You can click on a dot to bring out a drawer with the raw information associated with that activity. From there, you can sort and further filter your view as you find the information you want. ## Wait, What Are All These Applications? You may notice in the heatmap screnshot that we breakdown activities based on the type of application that generated the event. Rather than force you to know the details of all the logs from a given SaaS provider, we categorize them into generic applications so you can easily understand at a high level the nature of the events you’re looking at. Further, these buckets are really generic so if you want to search for all file access from a given IP address regardless if the users were using Box, Dropbox, Google Drive, or Microsoft OneDrive, you can just filter on FileStorage and see it all in once place. Cool, eh? If you’re interested in learning more about how we think about logs and these categories, see [link](https://turngate.helpkit.so/1387e436e25f80ad98aae26a11b6b75b) # Heat map Drawer If you are interested in all the events that make up a single blip in the heat map, you can click the dot to see information such as the time period it encloses and the number of events that make it up. When you click Expand, you will open the heat map drawer, which breaks out each event into a table.
A screenshot of the Turngate heat map with a tooltip over a single dot that shows the actor name, the time period covered by the dot, number of activities and an Expand button.

How to access the Heat map drawer

You can download the activity as a CSV, and run further searches and filter on the data inside the drawer.
An image of a tall table filled with headings like time stamp, identity, IP address and more.
Hover and click on the text to learn more info or to add and exclude items in the query builder.
A cropped screenshot of the data table. There are plus and minus icons next to one of the IP addresses and includes a system tooltip that reads "Include in query" for the highlighted plus icon.

Certain data fields can be added or removed from the query, such as this IP address

# Table View Once you’ve identified the timeperiod and specific data you’re interested in, it’s often useful to switch to Table View. This is the standard table listing of events you may see in other tools. It allows you to search, sort, and get information on each activity of interest.
A screenshot of a table view featuring Bruce Potter and event types that include keyword "calendar"

Here, we’ve drilled into Bruce’s calendar events to see what all that activity is.

# Raw Log Viewer In either the table view or heat map drawer, you can access the Raw Log Data by clicking on the \[Eye] icon in the Actions column. Here, you can find the JSON data related to the event to gain further insights into the who/what/why of an event.
You can also copy to clipboard in order to share in a report or parse outside of Turngate. Some logs will have more information, some will have less depending on what the data source gives us. # Account Management ## How do I change my profile settings? Clicking on “Profile” in the navbar in the bottom left brings up a modal, from there you can click `Profile & Settings` where you can adjust your profile settings. However, you’ve still got one more button to press to `Manage Your Account`. We use a third party ([Strivacity](https://www.strivacity.com/)) to wrangle your identity and user account. We’re security folks, and we know that rolling your own Authentication and Authorization platform is A Bad Idea (tm). We leverage Strivacity to do all that seamlessly. When you log-in to Turngate, you’re actually logging in to Strivacity and we get the handoff from them once you’ve satisfied your authentication requirements. {% hint style="info" %} Turngate supports SSO for your organization, but we don’t have it wired up to self serve yet. If you’re interested in turning on SSO, [let us know](mailto:support@turngate.io) and we’ll get you setup. {% endhint %} ## How do I delete my account? Done with Turngate? Want us to delete your account or your whole organization’s tenant? No problem. We haven’t wired up the ability to self serve that yet, but you can [ping us](mailto:support@turngate.io) and we’ll take care of it for you. # Managing Subscriptions ## How do I upgrade my current plan? ## How do I cancel my subscription? ## What payment methods are available?
# Accounts ## GET /accounts/analysts/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Analyst":{"required":["user","organization"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"user":{"$ref":"#/components/schemas/User"},"organization":{"title":"Organization","type":"integer"},"name":{"title":"Name","type":"string","readOnly":true}}},"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/analysts/":{"get":{"operationId":"accounts_analysts_list","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Analyst"}}}}}}}},"tags":["accounts"]}}}} ``` ## GET /accounts/analysts/current/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CurrentUser":{"required":["user_progress"],"type":"object","properties":{"consent_given":{"title":"Consent given","type":"boolean"},"user_progress":{"$ref":"#/components/schemas/UserProgress"},"user_uuid":{"title":"User uuid","type":"string","format":"uuid","readOnly":true}}},"UserProgress":{"type":"object","properties":{"integrations":{"type":"array","items":{"type":"string","minLength":1}},"filters":{"type":"array","items":{"type":"string","minLength":1}},"onboarding":{"type":"array","items":{"type":"string","minLength":1}}}}}},"paths":{"/accounts/analysts/current/":{"get":{"operationId":"accounts_analysts_current_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUser"}}}}},"tags":["accounts"]}}}} ``` ## PATCH /accounts/analysts/current/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CurrentUser":{"required":["user_progress"],"type":"object","properties":{"consent_given":{"title":"Consent given","type":"boolean"},"user_progress":{"$ref":"#/components/schemas/UserProgress"},"user_uuid":{"title":"User uuid","type":"string","format":"uuid","readOnly":true}}},"UserProgress":{"type":"object","properties":{"integrations":{"type":"array","items":{"type":"string","minLength":1}},"filters":{"type":"array","items":{"type":"string","minLength":1}},"onboarding":{"type":"array","items":{"type":"string","minLength":1}}}},"CurrentUserPatch":{"type":"object","properties":{"consent_given":{"title":"Consent given","type":"boolean"},"user_progress":{"$ref":"#/components/schemas/UserProgress"},"user_uuid":{"title":"User uuid","type":"string","format":"uuid","readOnly":true}}}}},"paths":{"/accounts/analysts/current/":{"patch":{"operationId":"accounts_analysts_current_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUser"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CurrentUserPatch"}}},"required":true}}}}} ``` ## GET /accounts/groups/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Group":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"name":{"title":"Name","type":"string","maxLength":150,"minLength":1}}}}},"paths":{"/accounts/groups/":{"get":{"operationId":"accounts_groups_list","description":"","parameters":[{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Group"}}}}}}}},"tags":["accounts"]}}}} ``` ## List invitations > List the invitations for the organizaton. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"OrganizationInvitation":{"required":["invitee_identifier"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"invitee_identifier":{"title":"Invitee identifier","type":"string","minLength":1},"role":{"title":"Role","type":"string","enum":["Analyst","IntegrationAdmin","OrganizationAdmin"]},"invited_by":{"title":"Invited by","type":"string","format":"uuid","readOnly":true},"sent_at":{"title":"Sent at","type":"string","format":"date-time","readOnly":true},"valid_until":{"title":"Valid until","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/accounts/invite/":{"get":{"operationId":"accounts_invite_list","summary":"List invitations","description":"List the invitations for the organizaton.","parameters":[{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/OrganizationInvitation"}}}}}}}},"tags":["accounts"]}}}} ``` ## Create an invitation for a user to join an organization. > Create an invitation for a user to join an organization. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"OrganizationInvitation":{"required":["invitee_identifier"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"invitee_identifier":{"title":"Invitee identifier","type":"string","minLength":1},"role":{"title":"Role","type":"string","enum":["Analyst","IntegrationAdmin","OrganizationAdmin"]},"invited_by":{"title":"Invited by","type":"string","format":"uuid","readOnly":true},"sent_at":{"title":"Sent at","type":"string","format":"date-time","readOnly":true},"valid_until":{"title":"Valid until","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/accounts/invite/":{"post":{"operationId":"accounts_invite_create","summary":"Create an invitation for a user to join an organization.","description":"Create an invitation for a user to join an organization.","responses":{"201":{"description":"Invitation created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationInvitation"}}}},"303":{"description":"Invite aready exists, try resending invitation.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"redirrect_url":{"type":"string"},"method":{"type":"string"}}}}}},"400":{"description":"Bad request"},"403":{"description":"You do not have permission to perform this action."}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationInvitation"}}},"required":true}}}}} ``` ## GET /accounts/invite/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"OrganizationInvitation":{"required":["invitee_identifier"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"invitee_identifier":{"title":"Invitee identifier","type":"string","minLength":1},"role":{"title":"Role","type":"string","enum":["Analyst","IntegrationAdmin","OrganizationAdmin"]},"invited_by":{"title":"Invited by","type":"string","format":"uuid","readOnly":true},"sent_at":{"title":"Sent at","type":"string","format":"date-time","readOnly":true},"valid_until":{"title":"Valid until","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/accounts/invite/{uuid}/":{"get":{"operationId":"accounts_invite_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/OrganizationInvitation"}}}}}},"tags":["accounts"]}}}} ``` ## Resend invitation to a user to join an organization. > Resend an invitation to a user to join an organization. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"OrganizationInvitation":{"required":["invitee_identifier"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"invitee_identifier":{"title":"Invitee identifier","type":"string","minLength":1},"role":{"title":"Role","type":"string","enum":["Analyst","IntegrationAdmin","OrganizationAdmin"]},"invited_by":{"title":"Invited by","type":"string","format":"uuid","readOnly":true},"sent_at":{"title":"Sent at","type":"string","format":"date-time","readOnly":true},"valid_until":{"title":"Valid until","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/accounts/invite/{uuid}/":{"post":{"operationId":"accounts_invite_resend","summary":"Resend invitation to a user to join an organization.","description":"Resend an invitation to a user to join an organization.","responses":{"200":{"description":"Invitation resent successfully","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/OrganizationInvitation"}}}}},"400":{"description":"Bad request"},"403":{"description":"You do not have permission to perform this action."},"404":{"description":"Invitation not found"},"409":{"description":"Failed to resend invite via external identity provider."}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/OrganizationInvitation"}}}},"required":true}}}}} ``` ## Revoke invitation to a user to join an organization. > Revoke an invitation to a user to join an organization. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/accounts/invite/{uuid}/":{"delete":{"operationId":"accounts_invite_destroy","summary":"Revoke invitation to a user to join an organization.","description":"Revoke an invitation to a user to join an organization.","responses":{"204":{"description":"Invitation revoked successfully"},"400":{"description":"Bad request"},"403":{"description":"You do not have permission to perform this action."},"409":{"description":"Failed to revoke invite via external identity provider."}},"tags":["accounts"]}}}} ``` On POST attempt to generate and return login params containing the login hint url\ and the account identifier (email). ----------------------------------- > The following cases are handled:\ > \- If an email address does not pass the serializer EmailField validation, return an error.\ > \- If a there are multiple users associated with the same email address. Return a route indicating\ > manual entry is required.\ > \- If a valid email is provided, fetch the Org's striviactiy metdata and use that to build a login hint and return the\ > correct value. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Email":{"required":["email"],"type":"object","properties":{"email":{"title":"Email","type":"string","format":"email","minLength":1}}}}},"paths":{"/accounts/login_url/":{"post":{"operationId":"accounts_login_url_create","summary":"On POST attempt to generate and return login params containing the login hint url\nand the account identifier (email).","description":"The following cases are handled:\n- If an email address does not pass the serializer EmailField validation, return an error.\n- If a there are multiple users associated with the same email address. Return a route indicating\nmanual entry is required.\n- If a valid email is provided, fetch the Org's striviactiy metdata and use that to build a login hint and return the\ncorrect value.","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"params":{"type":"string"}}}}}},"400":{"description":"Invalid Input"}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Email"}}},"required":true}}}}} ``` ## GET /accounts/organizations/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/":{"get":{"operationId":"accounts_organizations_list","description":"","parameters":[{"name":"id","in":"query","description":"id","required":false,"type":"string"},{"name":"uuid","in":"query","description":"uuid","required":false,"type":"string"},{"name":"name","in":"query","description":"name","required":false,"type":"string"},{"name":"slug","in":"query","description":"slug","required":false,"type":"string"},{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Organization"}}}}}}}},"tags":["accounts"]}}}} ``` ## POST /accounts/organizations/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/":{"post":{"operationId":"accounts_organizations_create","description":"","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}},"required":true}}}}} ``` ## GET /accounts/organizations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/{uuid}/":{"get":{"operationId":"accounts_organizations_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}}}},"tags":["accounts"]}}}} ``` ## PUT /accounts/organizations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/{uuid}/":{"put":{"operationId":"accounts_organizations_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}},"required":true}}}}} ``` ## DELETE /accounts/organizations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/accounts/organizations/{uuid}/":{"delete":{"operationId":"accounts_organizations_delete","description":"","responses":{"204":{"description":""}},"tags":["accounts"]}}}} ``` ## PATCH /accounts/organizations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/{uuid}/":{"patch":{"operationId":"accounts_organizations_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organization"}}},"required":true}}}}} ``` ## POST /accounts/organizations/{uuid}/increment/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/accounts/organizations/{uuid}/increment/":{"post":{"operationId":"accounts_organizations_increment_create","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RateLimit"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"usage":{"type":"integer"}}}}},"required":true}}}}} ``` ## GET /accounts/portal/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/accounts/portal/":{"get":{"operationId":"accounts_portal_list","description":"","responses":{"200":{"description":""}},"tags":["accounts"]}}}} ``` ## GET /accounts/users/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/users/":{"get":{"operationId":"accounts_users_list","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/User"}}}}}}}},"tags":["accounts"]}}}} ``` ## POST /accounts/users/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/users/":{"post":{"operationId":"accounts_users_create","description":"","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}},"required":true}}}}} ``` ## GET /accounts/users/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/users/{uuid}/":{"get":{"operationId":"accounts_users_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}}},"tags":["accounts"]}}}} ``` ## PUT /accounts/users/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/users/{uuid}/":{"put":{"operationId":"accounts_users_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}},"required":true}}}}} ``` ## DELETE /accounts/users/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/accounts/users/{uuid}/":{"delete":{"operationId":"accounts_users_delete","description":"","responses":{"204":{"description":""}},"tags":["accounts"]}}}} ``` ## PATCH /accounts/users/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}},"paths":{"/accounts/users/{uuid}/":{"patch":{"operationId":"accounts_users_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}}},"tags":["accounts"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}},"required":true}}}}} ``` # Api ## GET /api/datasource/ > Internal only view for listing datasources. Used by ETL/Airflow. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSourceList":{"required":["name","organization"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"type__history_hours":{"title":"Type history hours","type":"integer","readOnly":true},"type__slug":{"title":"Type slug","type":"string","readOnly":true,"minLength":1},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"enabled":{"title":"Enabled","type":"boolean"},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"organization":{"$ref":"#/components/schemas/Organization"}}},"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}},"paths":{"/api/datasource/":{"get":{"operationId":"api_datasource_list","description":"Internal only view for listing datasources. Used by ETL/Airflow.","parameters":[{"name":"type__slug","in":"query","description":"type__slug","required":false,"type":"string"},{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/DataSourceList"}}}}}}}},"tags":["api"]}}}} ``` ## GET /api/eventtype-count/ > View for providing statistics on global # of activities by event\_type ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityCountByEventType":{"required":["event_type","slug","count"],"type":"object","properties":{"event_type":{"title":"Event type","type":"string","format":"uuid"},"slug":{"title":"Slug","type":"string","minLength":1},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/api/eventtype-count/":{"get":{"operationId":"api_eventtype-count_list","description":"View for providing statistics on global # of activities by event_type","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCountByEventType"}}}}}}}},"tags":["api"]}}}} ``` ## POST /api/sync\_labels/ > Upload a Labelmaker CSV file for asynchronous processing. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/api/sync_labels/":{"post":{"operationId":"api_sync_labels_create","description":"Upload a Labelmaker CSV file for asynchronous processing.","responses":{"202":{"description":"CSV is being processed asynchronously, and the task ID is returned.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"string"},"task_id":{"type":"string"}}}}}},"400":{"description":"No file provided"},"500":{"description":"Server error"}},"tags":["api"],"requestBody":{"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","properties":{"file":{"type":"file","description":"CSV file to upload"}},"required":["file"]}}}}}}}} ``` ## GET /api/tagged-eventtype/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TaggedItem":{"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type_slug":{"title":"Integration type slug","type":"string","readOnly":true},"eventtype_slug":{"title":"Eventtype slug","type":"string","readOnly":true},"tag_slug":{"title":"Tag slug","type":"string","readOnly":true}}}}},"paths":{"/api/tagged-eventtype/":{"get":{"operationId":"api_tagged-eventtype_list","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/TaggedItem"}}}}}}}},"tags":["api"]}}}} ``` ## POST /api/tagged-eventtype/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TaggedItemCreate":{"required":["integration_type_slug","eventtype_slug","tag_slug","uuid"],"type":"object","properties":{"integration_type_slug":{"title":"Integration type slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","minLength":1},"eventtype_slug":{"title":"Eventtype slug","type":"string","minLength":1},"tag_slug":{"title":"Tag slug","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid"}}}}},"paths":{"/api/tagged-eventtype/":{"post":{"operationId":"api_tagged-eventtype_create","description":"","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaggedItemCreate"}}}}},"tags":["api"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaggedItemCreate"}}},"required":true}}}}} ``` ## GET /api/tags-by-integration/ > View viewing tags grouped by integration type ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TagsByIntegration":{"required":["Access","Context","Application"],"type":"object","properties":{"Access":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}},"Context":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}},"Application":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}}}},"TagsDatasource":{"required":["label","uuid","dataSources"],"type":"object","properties":{"label":{"title":"Label","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid"},"dataSources":{"type":"array","items":{"type":"string","format":"uuid"}}}}}},"paths":{"/api/tags-by-integration/":{"get":{"operationId":"api_tags-by-integration_list","description":"View viewing tags grouped by integration type","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagsByIntegration"}}}}},"tags":["api"]}}}} ``` ## GET /api/tags/ > View to list and create tags. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}},"paths":{"/api/tags/":{"get":{"operationId":"api_tags_list","description":"View to list and create tags.","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Tag"}}}}}}}},"tags":["api"]}}}} ``` ## POST /api/tags/ > View to list and create tags. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"TagCreate":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","minLength":1},"scope":{"title":"Scope","type":"string"}}}}},"paths":{"/api/tags/":{"post":{"operationId":"api_tags_create","description":"View to list and create tags.","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagCreate"}}}}},"tags":["api"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagCreate"}}},"required":true}}}}} ``` ## GET /api/tags/{uuid}/ > View to get tag by id. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}},"paths":{"/api/tags/{uuid}/":{"get":{"operationId":"api_tags_read","description":"View to get tag by id.","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Tag"}}}}},"tags":["api"]}}}} ``` ## DELETE /api/tags/{uuid}/ > View to get tag by id. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/api/tags/{uuid}/":{"delete":{"operationId":"api_tags_delete","description":"View to get tag by id.","responses":{"204":{"description":""}},"tags":["api"]}}}} ``` # Core ## GET /core/activity/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Activity":{"required":["timestamp","identity","data_source","event_type","integration_unique"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"identity":{"title":"Identity","type":"string","format":"uuid"},"location":{"title":"Location","type":"string","format":"uuid"},"data_source":{"title":"Data source","type":"string","format":"uuid"},"event_type":{"title":"Event type","type":"string","format":"uuid"},"integration_unique":{"title":"Integration unique","type":"string","maxLength":255,"minLength":1}}}}},"paths":{"/core/activity/":{"get":{"operationId":"core_activity_list","description":"","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"identity","in":"query","description":"identity","required":false,"type":"string"},{"name":"data_source","in":"query","description":"data_source","required":false,"type":"string"},{"name":"actor","in":"query","description":"actor","required":false,"type":"string"},{"name":"location","in":"query","description":"location","required":false,"type":"string"},{"name":"labels","in":"query","description":"labels","required":false,"type":"string"},{"name":"cursor","in":"query","description":"The pagination cursor value.","required":false,"type":"string"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"filter_uuid","in":"query","description":"UUID of filter to apply to results.","type":"string"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["results"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Activity"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/first\_last/ > View to return first and last activity timestamps. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityFirstLastTimestamp":{"required":["first","last"],"type":"object","properties":{"first":{"$ref":"#/components/schemas/Timestamp"},"last":{"$ref":"#/components/schemas/Timestamp"}}},"Timestamp":{"required":["timestamp"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"}}}}},"paths":{"/core/activity/first_last/":{"get":{"operationId":"core_activity_first_last_read","description":"View to return first and last activity timestamps.","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActivityFirstLastTimestamp"}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/statistics/actor/ > Provides a view returning a list of actors with activity count intervals\ > corresponding to the time range and interval count requested. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityStatsActor":{"required":["actor","counts"],"type":"object","properties":{"actor":{"title":"Actor","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/CombinedActivity"}}}},"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/core/activity/statistics/actor/":{"get":{"operationId":"core_activity_statistics_actor_list","description":"Provides a view returning a list of actors with activity count intervals\ncorresponding to the time range and interval count requested.","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"interval_count","in":"query","description":"interval_count","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"filter_uuid","in":"query","description":"UUID of filter to apply to results.","type":"string"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"links":{"required":["next","previous"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"}}},"interval_duration":{"type":"number"},"results":{"type":"array","items":{"$ref":"#/components/schemas/ActivityStatsActor"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/statistics/combined/ > Provides a view returning overall activity stats for an organization or datasource. Used primarily\ > for populated brush timeline data. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/core/activity/statistics/combined/":{"get":{"operationId":"core_activity_statistics_combined_list","description":"Provides a view returning overall activity stats for an organization or datasource. Used primarily\nfor populated brush timeline data.","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"interval_count","in":"query","description":"interval_count","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"links":{"required":["next","previous"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"}}},"interval_duration":{"type":"number"},"results":{"type":"array","items":{"$ref":"#/components/schemas/CombinedActivity"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/statistics/datasource/ > Provides a view of activity statistics aggreagted by datasource. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityStatsDataSource":{"required":["data_source","counts"],"type":"object","properties":{"data_source":{"title":"Data source","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCount"}}}},"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/core/activity/statistics/datasource/":{"get":{"operationId":"core_activity_statistics_datasource_list","description":"Provides a view of activity statistics aggreagted by datasource.","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"interval_count","in":"query","description":"interval_count","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"links":{"required":["next","previous"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"}}},"interval_duration":{"type":"number"},"results":{"type":"array","items":{"$ref":"#/components/schemas/ActivityStatsDataSource"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/statistics/label/ > View for returning activity counts by label, bucketed by\ > data source. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityStatsLabel":{"required":["labels","data_source"],"type":"object","properties":{"labels":{"type":"array","items":{"$ref":"#/components/schemas/ActivityLabel"}},"data_source":{"title":"Data source","type":"string","format":"uuid"}}},"ActivityLabel":{"required":["label","counts","total_count"],"type":"object","properties":{"label":{"title":"Label","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCount"}},"total_count":{"title":"Total count","type":"integer"}}},"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/core/activity/statistics/label/":{"get":{"operationId":"core_activity_statistics_label_list","description":"View for returning activity counts by label, bucketed by\ndata source.","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"data_source","in":"query","description":"data_source","required":false,"type":"string"},{"name":"interval_count","in":"query","description":"interval_count","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"filter_uuid","in":"query","description":"UUID of filter to apply to results.","type":"string"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"links":{"required":["next","previous"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"}}},"interval_duration":{"type":"number"},"results":{"type":"array","items":{"$ref":"#/components/schemas/ActivityStatsLabel"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/statistics/location/ > Provides a view returning a list of locations with activity count intervals\ > corresponding to the time range and interval count requested. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"ActivityStatsLocation":{"required":["location","counts"],"type":"object","properties":{"location":{"title":"Location","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/CombinedActivity"}}}},"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}},"paths":{"/core/activity/statistics/location/":{"get":{"operationId":"core_activity_statistics_location_list","description":"Provides a view returning a list of locations with activity count intervals\ncorresponding to the time range and interval count requested.","parameters":[{"name":"timestamp__lte","in":"query","description":"timestamp__lte","required":false,"type":"string"},{"name":"timestamp__gte","in":"query","description":"timestamp__gte","required":false,"type":"string"},{"name":"interval_count","in":"query","description":"interval_count","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"links":{"required":["next","previous"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"}}},"interval_duration":{"type":"number"},"results":{"type":"array","items":{"$ref":"#/components/schemas/ActivityStatsLocation"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/{uuid}/raw/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"RawActivity":{"required":["activity_uuid","json_data"],"type":"object","properties":{"activity_uuid":{"title":"Activity uuid","type":"string","format":"uuid"},"json_data":{"title":"Json data","type":"object","additionalProperties":true}}}}},"paths":{"/core/activity/{uuid}/raw/":{"get":{"operationId":"core_activity_raw_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RawActivity"}}}}},"tags":["core"]}}}} ``` ## GET /core/activity/{uuid}/raw/details/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"RawActivityDetails":{"required":["details"],"type":"object","properties":{"details":{"type":"array","items":{"$ref":"#/components/schemas/RawActivityDetailsField"}}}},"RawActivityDetailsField":{"required":["field_name","value"],"type":"object","properties":{"field_name":{"title":"Field name","type":"string","maxLength":255,"minLength":1},"value":{"title":"Value","type":"string","maxLength":255,"minLength":1}}}}},"paths":{"/core/activity/{uuid}/raw/details/":{"get":{"operationId":"core_activity_raw_details_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RawActivityDetails"}}}}},"tags":["core"]}}}} ``` ## GET /core/actors/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Actor":{"required":["organization"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"organization":{"title":"Organization","type":"string","format":"uuid"},"identities":{"type":"array","items":{"type":"string","format":"uuid"},"readOnly":true}}}}},"paths":{"/core/actors/":{"get":{"operationId":"core_actors_list","description":"","parameters":[{"name":"ordering","in":"query","description":"Which field to use when ordering the results.","required":false,"type":"string"},{"name":"cursor","in":"query","description":"The pagination cursor value.","required":false,"type":"string"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"search","in":"query","description":"Search string","type":"string"},{"name":"identities","in":"query","description":"Filter by identity UUIDs (comma-separated)","type":"string"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["results"],"type":"object","properties":{"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Actor"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/actors/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Actor":{"required":["organization"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"organization":{"title":"Organization","type":"string","format":"uuid"},"identities":{"type":"array","items":{"type":"string","format":"uuid"},"readOnly":true}}}}},"paths":{"/core/actors/{uuid}/":{"get":{"operationId":"core_actors_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Actor"}}}}},"tags":["core"]}}}} ``` ## GET /core/event-type/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventType":{"required":["integration_type","name","slug"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type":{"title":"Integration type","type":"string","format":"uuid"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","maxLength":255,"minLength":1},"discard":{"title":"Discard","type":"boolean"},"linked_tags":{"type":"array","items":{"$ref":"#/components/schemas/Tag"},"readOnly":true}}},"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}},"paths":{"/core/event-type/":{"get":{"operationId":"core_event-type_list","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"min_count","in":"query","description":"Return only event types with at least this many activities.","type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/EventType"}}}}}}}},"tags":["core"]}}}} ``` ## POST /core/event-type/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventType":{"required":["integration_type","name","slug"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type":{"title":"Integration type","type":"string","format":"uuid"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","maxLength":255,"minLength":1},"discard":{"title":"Discard","type":"boolean"},"linked_tags":{"type":"array","items":{"$ref":"#/components/schemas/Tag"},"readOnly":true}}},"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}},"paths":{"/core/event-type/":{"post":{"operationId":"core_event-type_create","description":"","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventType"}}}}},"tags":["core"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventType"}}},"required":true}}}}} ``` ## GET /core/event-type/descriptions/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventTypeDescription":{"required":["event_type_uuid","description"],"type":"object","properties":{"event_type_uuid":{"title":"Event type uuid","type":"string","format":"uuid"},"description":{"title":"Description","type":"string","minLength":1}}}}},"paths":{"/core/event-type/descriptions/":{"get":{"operationId":"core_event-type_descriptions_list","description":"","parameters":[{"name":"event_types","in":"query","description":"Filter by event type UUIDs (comma-separated)","type":"string"},{"name":"uuids","in":"query","description":"Filter by event type UUIDs (comma-separated, alternative to event_types)","type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/EventTypeDescription"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/event-type/{event\_type\_\_uuid}/details/ > GET Endpoint for EventTypeDetails ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventTypeDetails":{"required":["description"],"type":"object","properties":{"description":{"title":"Description","type":"string","minLength":1}}}}},"paths":{"/core/event-type/{event_type__uuid}/details/":{"get":{"operationId":"core_event-type_details_read","description":"GET Endpoint for EventTypeDetails","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventTypeDetails"}}}}},"tags":["core"]}}}} ``` ## GET /core/event-type/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"EventType":{"required":["integration_type","name","slug"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type":{"title":"Integration type","type":"string","format":"uuid"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","maxLength":255,"minLength":1},"discard":{"title":"Discard","type":"boolean"},"linked_tags":{"type":"array","items":{"$ref":"#/components/schemas/Tag"},"readOnly":true}}},"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}},"paths":{"/core/event-type/{uuid}/":{"get":{"operationId":"core_event-type_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventType"}}}}},"tags":["core"]}}}} ``` ## GET /core/filters/builtin/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"BuiltInFilter":{"required":["filter_json"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"highlight":{"type":"array","items":{"type":"string","minLength":1}},"is_template":{"title":"Is template","type":"boolean","readOnly":true,"default":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}},"paths":{"/core/filters/builtin/":{"get":{"operationId":"core_filters_builtin_list","description":"","parameters":[{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/BuiltInFilter"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/filters/builtin/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"BuiltInFilter":{"required":["filter_json"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"highlight":{"type":"array","items":{"type":"string","minLength":1}},"is_template":{"title":"Is template","type":"boolean","readOnly":true,"default":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}},"paths":{"/core/filters/builtin/{uuid}/":{"get":{"operationId":"core_filters_builtin_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BuiltInFilter"}}}}},"tags":["core"]}}}} ``` ## GET /core/filters/user/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserFilterSwagger":{"required":["uuid","user","last_user_editor","filter_json","visibility","is_temporary","created_at","updated_at"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"user":{"title":"User","type":"string","format":"uuid"},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time"},"updated_at":{"title":"Updated at","type":"string","format":"date-time"}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}},"paths":{"/core/filters/user/":{"get":{"operationId":"core_filters_user_list","description":"","parameters":[{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"},{"name":"mode","in":"query","description":"Specify what types of filters to fetch:\n- `exclude_temporary`: Fetch filters only manually saved filters\n- `only_temporary`: Fetch filters only temporary filters\n- `all`: Fetch all types of filters\n","required":false,"type":"string","enum":["exclude_temporary","only_temporary","all"],"default":"exclude_temporary"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/UserFilterSwagger"}}}}}}}},"tags":["core"]}}}} ``` ## POST /core/filters/user/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserFilterSwagger":{"required":["uuid","user","last_user_editor","filter_json","visibility","is_temporary","created_at","updated_at"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"user":{"title":"User","type":"string","format":"uuid"},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time"},"updated_at":{"title":"Updated at","type":"string","format":"date-time"}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}},"UserFilterCreate":{"required":["filter_json"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"user":{"title":"User","type":"string","format":"uuid","readOnly":true},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid","readOnly":true},"analyst":{"type":"integer","title":"Analyst"},"last_analyst_editor":{"type":"integer","title":"Last analyst editor"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"organization":{"type":"integer","title":"Organization"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"updated_at":{"title":"Updated at","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/core/filters/user/":{"post":{"operationId":"core_filters_user_create","description":"","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilterSwagger"}}}}},"tags":["core"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilterCreate"}}},"required":true}}}}} ``` ## GET /core/filters/user/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserFilterSwagger":{"required":["uuid","user","last_user_editor","filter_json","visibility","is_temporary","created_at","updated_at"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"user":{"title":"User","type":"string","format":"uuid"},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time"},"updated_at":{"title":"Updated at","type":"string","format":"date-time"}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}},"paths":{"/core/filters/user/{uuid}/":{"get":{"operationId":"core_filters_user_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilterSwagger"}}}}},"tags":["core"]}}}} ``` ## PUT /core/filters/user/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserFilter":{"required":["filter_json","visibility"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"user":{"title":"User","type":"string","format":"uuid","readOnly":true},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid","readOnly":true},"analyst":{"type":"integer","title":"Analyst"},"last_analyst_editor":{"type":"integer","title":"Last analyst editor"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"organization":{"type":"integer","title":"Organization"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"updated_at":{"title":"Updated at","type":"string","format":"date-time","readOnly":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}},"paths":{"/core/filters/user/{uuid}/":{"put":{"operationId":"core_filters_user_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilter"}}}}},"tags":["core"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilter"}}},"required":true}}}}} ``` ## DELETE /core/filters/user/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/core/filters/user/{uuid}/":{"delete":{"operationId":"core_filters_user_delete","description":"","responses":{"204":{"description":""}},"tags":["core"]}}}} ``` ## PATCH /core/filters/user/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserFilterSwagger":{"required":["uuid","user","last_user_editor","filter_json","visibility","is_temporary","created_at","updated_at"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"user":{"title":"User","type":"string","format":"uuid"},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time"},"updated_at":{"title":"Updated at","type":"string","format":"date-time"}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}},"UserFilterPatchSwagger":{"required":["filter_json"],"type":"object","properties":{"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]}}}}},"paths":{"/core/filters/user/{uuid}/":{"patch":{"operationId":"core_filters_user_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilterSwagger"}}}}},"tags":["core"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserFilterPatchSwagger"}}},"required":true}}}}} ``` ## GET /core/identity/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Identity":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"identifier":{"title":"Identifier","type":"string","format":"email","readOnly":true,"minLength":1},"data_source":{"title":"Data source","type":"integer"}}}}},"paths":{"/core/identity/":{"get":{"operationId":"core_identity_list","description":"","parameters":[{"name":"uuid","in":"query","description":"uuid","required":false,"type":"string"},{"name":"uuids","in":"query","description":"Filter by identity UUIDs (comma-separated)","type":"string"},{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Identity"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/identity/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Identity":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"identifier":{"title":"Identifier","type":"string","format":"email","readOnly":true,"minLength":1},"data_source":{"title":"Data source","type":"integer"}}}}},"paths":{"/core/identity/{uuid}/":{"get":{"operationId":"core_identity_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Identity"}}}}},"tags":["core"]}}}} ``` ## GET /core/locations/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Location":{"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"ip_address":{"title":"Ip address","type":"string","readOnly":true,"minLength":1},"city":{"title":"City","type":"string","readOnly":true,"minLength":1},"region":{"title":"Region","type":"string","readOnly":true,"minLength":1},"country":{"title":"Country","type":"string","readOnly":true,"minLength":1},"country_code":{"title":"Country code","type":"string","readOnly":true,"minLength":1},"latitude":{"title":"Latitude","type":"number","readOnly":true},"longitude":{"title":"Longitude","type":"number","readOnly":true},"category":{"title":"Category","type":"string","enum":["Unknown","Malicious","Trusted"],"readOnly":true}}}}},"paths":{"/core/locations/":{"get":{"operationId":"core_locations_list","description":"","parameters":[{"name":"uuid","in":"query","description":"uuid","required":false,"type":"string"},{"name":"uuids","in":"query","description":"Filter by location UUIDs (comma-separated)","type":"string"},{"name":"locations","in":"query","description":"Filter by location UUIDs (comma-separated, alternative to uuids param)","type":"string"},{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/Location"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/locations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Location":{"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"ip_address":{"title":"Ip address","type":"string","readOnly":true,"minLength":1},"city":{"title":"City","type":"string","readOnly":true,"minLength":1},"region":{"title":"Region","type":"string","readOnly":true,"minLength":1},"country":{"title":"Country","type":"string","readOnly":true,"minLength":1},"country_code":{"title":"Country code","type":"string","readOnly":true,"minLength":1},"latitude":{"title":"Latitude","type":"number","readOnly":true},"longitude":{"title":"Longitude","type":"number","readOnly":true},"category":{"title":"Category","type":"string","enum":["Unknown","Malicious","Trusted"],"readOnly":true}}}}},"paths":{"/core/locations/{uuid}/":{"get":{"operationId":"core_locations_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Location"}}}}},"tags":["core"]}}}} ``` ## PATCH /core/locations/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"LocationPatch":{"required":["category"],"type":"object","properties":{"category":{"title":"Category","type":"string","enum":["Unknown","Malicious","Trusted"]}}}}},"paths":{"/core/locations/{uuid}/":{"patch":{"operationId":"core_locations_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LocationPatch"}}}}},"tags":["core"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LocationPatch"}}},"required":true}}}}} ``` ## GET /core/queries/user/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"UserQuery":{"required":["filter_json"],"type":"object","properties":{"filter":{"title":"Filter","type":"string","readOnly":true},"filter_json":{"title":"Filter json","type":"object","additionalProperties":true},"is_temporary":{"title":"Is temporary","type":"boolean"},"executed_at":{"title":"Executed at","type":"string","format":"date-time","readOnly":true}}}}},"paths":{"/core/queries/user/":{"get":{"operationId":"core_queries_user_list","description":"","parameters":[{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/UserQuery"}}}}}}}},"tags":["core"]}}}} ``` ## GET /core/version/ > A view for providing the current build version. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"Version":{"required":["version"],"type":"object","properties":{"version":{"title":"Version","type":"string","minLength":1}}}}},"paths":{"/core/version/":{"get":{"operationId":"core_version_list","description":"A view for providing the current build version.","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Version"}}}}},"tags":["core"]}}}} ``` # Integrations ## GET /integrations/atlassian/confluence/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/atlassian/confluence/start/":{"get":{"operationId":"integrations_atlassian_confluence_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"confluence_oauth_state":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/atlassian/jira/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/atlassian/jira/start/":{"get":{"operationId":"integrations_atlassian_jira_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"jira_oauth_state":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/box/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/box/start/":{"get":{"operationId":"integrations_box_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"csrf_token":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/datasources/ > View for Listing and creating on /integration/datasources. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSource":{"required":["uuid","type","name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"type":{"$ref":"#/components/schemas/IntegrationType"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"}}},"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}},"paths":{"/integrations/datasources/":{"get":{"operationId":"integrations_datasources_list","description":"View for Listing and creating on /integration/datasources.","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/DataSource"}}}}}}}},"tags":["integrations"]}}}} ``` ## POST /integrations/datasources/ > View for Listing and creating on /integration/datasources. ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSourceCreate":{"required":["name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"organization":{"type":"integer","title":"Organization"},"type":{"type":"integer","title":"Type"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"token":{"title":"Token","type":"object"},"code":{"title":"Code","description":"Authorization code from OAuth2 flow","type":"string","minLength":1},"state":{"title":"State","description":"State from /start endpoint","type":"string","minLength":1}}}}},"paths":{"/integrations/datasources/":{"post":{"operationId":"integrations_datasources_create","description":"View for Listing and creating on /integration/datasources.","responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceCreate"}}}}},"tags":["integrations"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceCreate"}}},"required":true}}}}} ``` ## GET /integrations/datasources/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSourceUpdate":{"required":["uuid","name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"type":{"$ref":"#/components/schemas/IntegrationType"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"}}},"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}},"paths":{"/integrations/datasources/{uuid}/":{"get":{"operationId":"integrations_datasources_read","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceUpdate"}}}}},"tags":["integrations"]}}}} ``` ## PUT /integrations/datasources/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSourceUpdate":{"required":["uuid","name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"type":{"$ref":"#/components/schemas/IntegrationType"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"}}},"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}},"paths":{"/integrations/datasources/{uuid}/":{"put":{"operationId":"integrations_datasources_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceUpdate"}}}}},"tags":["integrations"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceUpdate"}}},"required":true}}}}} ``` ## DELETE /integrations/datasources/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/datasources/{uuid}/":{"delete":{"operationId":"integrations_datasources_delete","description":"","responses":{"204":{"description":""}},"tags":["integrations"]}}}} ``` ## PATCH /integrations/datasources/{uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DataSourceCreate":{"required":["name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"organization":{"type":"integer","title":"Organization"},"type":{"type":"integer","title":"Type"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"token":{"title":"Token","type":"object"},"code":{"title":"Code","description":"Authorization code from OAuth2 flow","type":"string","minLength":1},"state":{"title":"State","description":"State from /start endpoint","type":"string","minLength":1}}}}},"paths":{"/integrations/datasources/{uuid}/":{"patch":{"operationId":"integrations_datasources_partial_update","description":"","responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceCreate"}}}}},"tags":["integrations"],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataSourceCreate"}}},"required":true}}}}} ``` ## GET /integrations/dropbox/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/dropbox/start/":{"get":{"operationId":"integrations_dropbox_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"dropbox-auth-csrf-token":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/github/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/github/start/":{"get":{"operationId":"integrations_github_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"github_oauth_state":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/google-workspaces/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/google-workspaces/start/":{"get":{"operationId":"integrations_google-workspaces_start_list","description":"","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"oauth_state":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/integration-markdown/{integration\_uuid}/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"SetupMarkdown":{"required":["title","markdown"],"type":"object","properties":{"title":{"title":"Title","type":"string","maxLength":255,"minLength":1},"markdown":{"title":"Markdown","type":"string","minLength":1}}}}},"paths":{"/integrations/integration-markdown/{integration_uuid}/":{"get":{"operationId":"integrations_integration-markdown_read","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/SetupMarkdown"}}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/integration-types/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}},"paths":{"/integrations/integration-types/":{"get":{"operationId":"integrations_integration-types_list","description":"","parameters":[{"name":"search","in":"query","description":"A search term.","required":false,"type":"string"},{"name":"page","in":"query","description":"A page number within the paginated result set.","required":false,"type":"integer"},{"name":"page_size","in":"query","description":"Number of results to return per page.","required":false,"type":"integer"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["count","results"],"type":"object","properties":{"count":{"type":"integer"},"next":{"type":"string","format":"uri"},"previous":{"type":"string","format":"uri"},"results":{"type":"array","items":{"$ref":"#/components/schemas/IntegrationType"}}}}}}}},"tags":["integrations"]}}}} ``` ## GET /integrations/salesforce/start/ > ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"servers":[{"url":"https://api.turngate.io/"}],"security":[{"Bearer":[]}],"components":{"securitySchemes":{"Bearer":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/integrations/salesforce/start/":{"get":{"operationId":"integrations_salesforce_start_list","description":"","parameters":[{"name":"subdomain","in":"query","description":"SalesForce Subdomain","type":"string"}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"csrf_token":{"type":"string"}}}}}}},"tags":["integrations"]}}}} ``` # Models ## The User object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}}} ``` ## The Analyst object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Analyst":{"required":["user","organization"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"user":{"$ref":"#/components/schemas/User"},"organization":{"title":"Organization","type":"integer"},"name":{"title":"Name","type":"string","readOnly":true}}},"User":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"email":{"title":"Email","type":"string","format":"email","maxLength":254},"first_name":{"title":"First name","type":"string","maxLength":150},"last_name":{"title":"Last name","type":"string","maxLength":150},"groups":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"array","items":{"description":"The groups this user belongs to. A user will get all permissions granted to each of their groups.","type":"integer"},"uniqueItems":true},"is_active":{"title":"Active","description":"Designates whether this user should be treated as active. Unselect this instead of deleting accounts.","type":"boolean"}}}}}} ``` ## The UserProgress object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserProgress":{"type":"object","properties":{"integrations":{"type":"array","items":{"type":"string","minLength":1}},"filters":{"type":"array","items":{"type":"string","minLength":1}},"onboarding":{"type":"array","items":{"type":"string","minLength":1}}}}}}} ``` ## The CurrentUser object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"CurrentUser":{"required":["user_progress"],"type":"object","properties":{"consent_given":{"title":"Consent given","type":"boolean"},"user_progress":{"$ref":"#/components/schemas/UserProgress"},"user_uuid":{"title":"User uuid","type":"string","format":"uuid","readOnly":true}}},"UserProgress":{"type":"object","properties":{"integrations":{"type":"array","items":{"type":"string","minLength":1}},"filters":{"type":"array","items":{"type":"string","minLength":1}},"onboarding":{"type":"array","items":{"type":"string","minLength":1}}}}}}} ``` ## The CurrentUserPatch object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"CurrentUserPatch":{"type":"object","properties":{"consent_given":{"title":"Consent given","type":"boolean"},"user_progress":{"$ref":"#/components/schemas/UserProgress"},"user_uuid":{"title":"User uuid","type":"string","format":"uuid","readOnly":true}}},"UserProgress":{"type":"object","properties":{"integrations":{"type":"array","items":{"type":"string","minLength":1}},"filters":{"type":"array","items":{"type":"string","minLength":1}},"onboarding":{"type":"array","items":{"type":"string","minLength":1}}}}}}} ``` ## The Group object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Group":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"name":{"title":"Name","type":"string","maxLength":150,"minLength":1}}}}}} ``` ## The OrganizationInvitation object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"OrganizationInvitation":{"required":["invitee_identifier"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"invitee_identifier":{"title":"Invitee identifier","type":"string","minLength":1},"role":{"title":"Role","type":"string","enum":["Analyst","IntegrationAdmin","OrganizationAdmin"]},"invited_by":{"title":"Invited by","type":"string","format":"uuid","readOnly":true},"sent_at":{"title":"Sent at","type":"string","format":"date-time","readOnly":true},"valid_until":{"title":"Valid until","type":"string","format":"date-time","readOnly":true}}}}}} ``` ## The Email object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Email":{"required":["email"],"type":"object","properties":{"email":{"title":"Email","type":"string","format":"email","minLength":1}}}}}} ``` ## The RateLimit object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}}} ``` ## The Organization object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}}} ``` ## The DataSourceList object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"DataSourceList":{"required":["name","organization"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"type__history_hours":{"title":"Type history hours","type":"integer","readOnly":true},"type__slug":{"title":"Type slug","type":"string","readOnly":true,"minLength":1},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"enabled":{"title":"Enabled","type":"boolean"},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"organization":{"$ref":"#/components/schemas/Organization"}}},"Organization":{"required":["name","slug"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","description":"The name of the organization","type":"string","maxLength":200,"minLength":1},"slug":{"title":"Slug","description":"The name in all lowercase, suitable for URL identification","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":200,"minLength":1},"account_portal_url":{"title":"Account portal url","type":"string","readOnly":true},"rate_limit":{"$ref":"#/components/schemas/RateLimit"}}},"RateLimit":{"type":"object","properties":{"limit":{"title":"Limit","type":"integer","readOnly":true},"usage":{"title":"Usage","type":"integer","readOnly":true},"remaining":{"title":"Remaining","type":"integer","readOnly":true},"overriden":{"title":"Overriden","type":"boolean","readOnly":true}}}}}} ``` ## The ActivityCountByEventType object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityCountByEventType":{"required":["event_type","slug","count"],"type":"object","properties":{"event_type":{"title":"Event type","type":"string","format":"uuid"},"slug":{"title":"Slug","type":"string","minLength":1},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The TaggedItem object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"TaggedItem":{"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type_slug":{"title":"Integration type slug","type":"string","readOnly":true},"eventtype_slug":{"title":"Eventtype slug","type":"string","readOnly":true},"tag_slug":{"title":"Tag slug","type":"string","readOnly":true}}}}}} ``` ## The TaggedItemCreate object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"TaggedItemCreate":{"required":["integration_type_slug","eventtype_slug","tag_slug","uuid"],"type":"object","properties":{"integration_type_slug":{"title":"Integration type slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","minLength":1},"eventtype_slug":{"title":"Eventtype slug","type":"string","minLength":1},"tag_slug":{"title":"Tag slug","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid"}}}}}} ``` ## The TagsDatasource object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"TagsDatasource":{"required":["label","uuid","dataSources"],"type":"object","properties":{"label":{"title":"Label","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid"},"dataSources":{"type":"array","items":{"type":"string","format":"uuid"}}}}}}} ``` ## The TagsByIntegration object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"TagsByIntegration":{"required":["Access","Context","Application"],"type":"object","properties":{"Access":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}},"Context":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}},"Application":{"type":"array","items":{"$ref":"#/components/schemas/TagsDatasource"}}}},"TagsDatasource":{"required":["label","uuid","dataSources"],"type":"object","properties":{"label":{"title":"Label","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid"},"dataSources":{"type":"array","items":{"type":"string","format":"uuid"}}}}}}} ``` ## The Tag object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}}} ``` ## The TagCreate object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"TagCreate":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","minLength":1},"scope":{"title":"Scope","type":"string"}}}}}} ``` ## The Activity object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Activity":{"required":["timestamp","identity","data_source","event_type","integration_unique"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"identity":{"title":"Identity","type":"string","format":"uuid"},"location":{"title":"Location","type":"string","format":"uuid"},"data_source":{"title":"Data source","type":"string","format":"uuid"},"event_type":{"title":"Event type","type":"string","format":"uuid"},"integration_unique":{"title":"Integration unique","type":"string","maxLength":255,"minLength":1}}}}}} ``` ## The Timestamp object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Timestamp":{"required":["timestamp"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"}}}}}} ``` ## The ActivityFirstLastTimestamp object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityFirstLastTimestamp":{"required":["first","last"],"type":"object","properties":{"first":{"$ref":"#/components/schemas/Timestamp"},"last":{"$ref":"#/components/schemas/Timestamp"}}},"Timestamp":{"required":["timestamp"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"}}}}}} ``` ## The CombinedActivity object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityStatsActor object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityStatsActor":{"required":["actor","counts"],"type":"object","properties":{"actor":{"title":"Actor","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/CombinedActivity"}}}},"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityCount object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityStatsDataSource object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityStatsDataSource":{"required":["data_source","counts"],"type":"object","properties":{"data_source":{"title":"Data source","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCount"}}}},"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityLabel object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityLabel":{"required":["label","counts","total_count"],"type":"object","properties":{"label":{"title":"Label","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCount"}},"total_count":{"title":"Total count","type":"integer"}}},"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityStatsLabel object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityStatsLabel":{"required":["labels","data_source"],"type":"object","properties":{"labels":{"type":"array","items":{"$ref":"#/components/schemas/ActivityLabel"}},"data_source":{"title":"Data source","type":"string","format":"uuid"}}},"ActivityLabel":{"required":["label","counts","total_count"],"type":"object","properties":{"label":{"title":"Label","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/ActivityCount"}},"total_count":{"title":"Total count","type":"integer"}}},"ActivityCount":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The ActivityStatsLocation object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"ActivityStatsLocation":{"required":["location","counts"],"type":"object","properties":{"location":{"title":"Location","type":"string","format":"uuid"},"counts":{"type":"array","items":{"$ref":"#/components/schemas/CombinedActivity"}}}},"CombinedActivity":{"required":["timestamp","count"],"type":"object","properties":{"timestamp":{"title":"Timestamp","type":"string","format":"date-time"},"count":{"title":"Count","type":"integer"}}}}}} ``` ## The RawActivity object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"RawActivity":{"required":["activity_uuid","json_data"],"type":"object","properties":{"activity_uuid":{"title":"Activity uuid","type":"string","format":"uuid"},"json_data":{"title":"Json data","type":"object","additionalProperties":true}}}}}} ``` ## The RawActivityDetailsField object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"RawActivityDetailsField":{"required":["field_name","value"],"type":"object","properties":{"field_name":{"title":"Field name","type":"string","maxLength":255,"minLength":1},"value":{"title":"Value","type":"string","maxLength":255,"minLength":1}}}}}} ``` ## The RawActivityDetails object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"RawActivityDetails":{"required":["details"],"type":"object","properties":{"details":{"type":"array","items":{"$ref":"#/components/schemas/RawActivityDetailsField"}}}},"RawActivityDetailsField":{"required":["field_name","value"],"type":"object","properties":{"field_name":{"title":"Field name","type":"string","maxLength":255,"minLength":1},"value":{"title":"Value","type":"string","maxLength":255,"minLength":1}}}}}} ``` ## The Actor object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Actor":{"required":["organization"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"organization":{"title":"Organization","type":"string","format":"uuid"},"identities":{"type":"array","items":{"type":"string","format":"uuid"},"readOnly":true}}}}}} ``` ## The EventType object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"EventType":{"required":["integration_type","name","slug"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"integration_type":{"title":"Integration type","type":"string","format":"uuid"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","maxLength":255,"minLength":1},"discard":{"title":"Discard","type":"boolean"},"linked_tags":{"type":"array","items":{"$ref":"#/components/schemas/Tag"},"readOnly":true}}},"Tag":{"required":["label","scope"],"type":"object","properties":{"label":{"title":"Label","type":"string","maxLength":255,"minLength":1},"scope":{"title":"Scope","type":"string","minLength":1},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"id":{"title":"ID","type":"integer","readOnly":true}}}}}} ``` ## The EventTypeDescription object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"EventTypeDescription":{"required":["event_type_uuid","description"],"type":"object","properties":{"event_type_uuid":{"title":"Event type uuid","type":"string","format":"uuid"},"description":{"title":"Description","type":"string","minLength":1}}}}}} ``` ## The EventTypeDetails object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"EventTypeDetails":{"required":["description"],"type":"object","properties":{"description":{"title":"Description","type":"string","minLength":1}}}}}} ``` ## The FilterJsonLabel object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The FilterJson object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The BuiltInFilter object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"BuiltInFilter":{"required":["filter_json"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"highlight":{"type":"array","items":{"type":"string","minLength":1}},"is_template":{"title":"Is template","type":"boolean","readOnly":true,"default":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The UserFilterCreate object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserFilterCreate":{"required":["filter_json"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"user":{"title":"User","type":"string","format":"uuid","readOnly":true},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid","readOnly":true},"analyst":{"type":"integer","title":"Analyst"},"last_analyst_editor":{"type":"integer","title":"Last analyst editor"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"organization":{"type":"integer","title":"Organization"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"updated_at":{"title":"Updated at","type":"string","format":"date-time","readOnly":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The UserFilterSwagger object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserFilterSwagger":{"required":["uuid","user","last_user_editor","filter_json","visibility","is_temporary","created_at","updated_at"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"user":{"title":"User","type":"string","format":"uuid"},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time"},"updated_at":{"title":"Updated at","type":"string","format":"date-time"}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The UserFilter object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserFilter":{"required":["filter_json","visibility"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"user":{"title":"User","type":"string","format":"uuid","readOnly":true},"last_user_editor":{"title":"Last user editor","type":"string","format":"uuid","readOnly":true},"analyst":{"type":"integer","title":"Analyst"},"last_analyst_editor":{"type":"integer","title":"Last analyst editor"},"filter_json":{"$ref":"#/components/schemas/FilterJson"},"organization":{"type":"integer","title":"Organization"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]},"is_temporary":{"title":"Is temporary","type":"boolean"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"updated_at":{"title":"Updated at","type":"string","format":"date-time","readOnly":true}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The UserFilterPatchSwagger object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserFilterPatchSwagger":{"required":["filter_json"],"type":"object","properties":{"filter_json":{"$ref":"#/components/schemas/FilterJson"},"visibility":{"title":"Visibility","type":"string","enum":["user","organization"]}}},"FilterJson":{"type":"object","properties":{"filter_name":{"title":"Filter name","type":"string","minLength":0},"filter_icon":{"title":"Filter icon","type":"string","minLength":0},"filter_description":{"title":"Filter description","type":"string","minLength":0},"actors":{"title":"Actors","type":"object","additionalProperties":{"type":"string"}},"data_sources":{"title":"Data sources","type":"object","additionalProperties":{"type":"string"}},"event_types":{"title":"Event types","type":"object","additionalProperties":{"type":"string"}},"locations":{"title":"Locations","type":"object","additionalProperties":{"type":"string"}},"labels":{"$ref":"#/components/schemas/FilterJsonLabel"},"date_range":{"title":"Date range","type":"object","additionalProperties":{"type":"string"}}}},"FilterJsonLabel":{"type":"object","properties":{"Application":{"title":"Application","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Context":{"title":"Context","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}},"Access":{"title":"Access","type":"object","additionalProperties":{"type":"string","enum":["with","not"]}}}}}}} ``` ## The Identity object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Identity":{"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"given_name":{"title":"Given name","type":"string","maxLength":255},"family_name":{"title":"Family name","type":"string","maxLength":255},"identifier":{"title":"Identifier","type":"string","format":"email","readOnly":true,"minLength":1},"data_source":{"title":"Data source","type":"integer"}}}}}} ``` ## The Location object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Location":{"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"ip_address":{"title":"Ip address","type":"string","readOnly":true,"minLength":1},"city":{"title":"City","type":"string","readOnly":true,"minLength":1},"region":{"title":"Region","type":"string","readOnly":true,"minLength":1},"country":{"title":"Country","type":"string","readOnly":true,"minLength":1},"country_code":{"title":"Country code","type":"string","readOnly":true,"minLength":1},"latitude":{"title":"Latitude","type":"number","readOnly":true},"longitude":{"title":"Longitude","type":"number","readOnly":true},"category":{"title":"Category","type":"string","enum":["Unknown","Malicious","Trusted"],"readOnly":true}}}}}} ``` ## The LocationPatch object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"LocationPatch":{"required":["category"],"type":"object","properties":{"category":{"title":"Category","type":"string","enum":["Unknown","Malicious","Trusted"]}}}}}} ``` ## The UserQuery object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"UserQuery":{"required":["filter_json"],"type":"object","properties":{"filter":{"title":"Filter","type":"string","readOnly":true},"filter_json":{"title":"Filter json","type":"object","additionalProperties":true},"is_temporary":{"title":"Is temporary","type":"boolean"},"executed_at":{"title":"Executed at","type":"string","format":"date-time","readOnly":true}}}}}} ``` ## The Version object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"Version":{"required":["version"],"type":"object","properties":{"version":{"title":"Version","type":"string","minLength":1}}}}}} ``` ## The IntegrationType object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}}} ``` ## The DataSource object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"DataSource":{"required":["uuid","type","name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"type":{"$ref":"#/components/schemas/IntegrationType"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"}}},"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}}} ``` ## The DataSourceCreate object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"DataSourceCreate":{"required":["name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"organization":{"type":"integer","title":"Organization"},"type":{"type":"integer","title":"Type"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"token":{"title":"Token","type":"object"},"code":{"title":"Code","description":"Authorization code from OAuth2 flow","type":"string","minLength":1},"state":{"title":"State","description":"State from /start endpoint","type":"string","minLength":1}}}}}} ``` ## The DataSourceUpdate object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"DataSourceUpdate":{"required":["uuid","name"],"type":"object","properties":{"uuid":{"title":"Uuid","type":"string","format":"uuid"},"type":{"$ref":"#/components/schemas/IntegrationType"},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"expiry":{"title":"Expiry","type":"string","format":"date-time"},"created_at":{"title":"Created at","type":"string","format":"date-time","readOnly":true},"secret_name":{"title":"Secret name","type":"string","readOnly":true,"minLength":1},"enabled":{"title":"Enabled","type":"boolean"}}},"IntegrationType":{"required":["name"],"type":"object","properties":{"id":{"title":"ID","type":"integer","readOnly":true},"uuid":{"title":"Uuid","type":"string","format":"uuid","readOnly":true},"name":{"title":"Name","type":"string","maxLength":255,"minLength":1},"slug":{"title":"Slug","type":"string","format":"slug","pattern":"^[-a-zA-Z0-9_]+$","maxLength":50},"token_def":{"title":"Token def","type":"object"},"logo_data":{"title":"Logo data","type":"string"},"difficulty":{"title":"Difficulty","type":"integer","maximum":2147483647,"minimum":0},"oauth_start_url":{"title":"Oauth start url","type":"string","readOnly":true},"oauth_form":{"title":"Oauth form","type":"object","readOnly":true}}}}}} ``` ## The SetupMarkdown object ```json {"openapi":"3.1.1","info":{"title":"Turngate API","version":"v1"},"components":{"schemas":{"SetupMarkdown":{"required":["title","markdown"],"type":"object","properties":{"title":{"title":"Title","type":"string","maxLength":255,"minLength":1},"markdown":{"title":"Markdown","type":"string","minLength":1}}}}}} ``` # Threat Hunting Turns out, Turngate is a pretty great product for Threat Hunting. It's fast, easy to use, and you can pivot rapidly through data as you continually test hypothesis. That's cool and all, but what actually is "threat hunting?" ## Threat Hunting Philosophy Threat Hunting (henceforth just "hunting" b/c that's a lot of letters to type) is sort of the cousin of security investigations.
The mindset is largely the same. You (the analyst) has a hypothesis of something that may or may not be occurring and you want to see if it's true. The underlying tooling is often identical, but the initiating event is different. You may start a hunt because of a new threat that has been announced, you have an upcoming audit, you are doing a periodic review, or even just because you have some spare time. ## Threat Hunting Frameworks While randomly stumbling through your logs and alerts can be fun, it's useful to have some structure to what you're doing. There are a few publicly available frameworks that can help with that. [PEAK Framework (Splunk)](https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html) - Each PEAK hunt follows a three-stage process: Prepare, Execute, and Act. In the Prepare phase, hunters select topics, conduct research, and generally plan out their hunt. The Execute phase involves diving deep into data and analysis, while the Act phase focuses on documentation, automation, and communication. \ [TaHiTI (Targeted Hunting Integrating Threat Intelligence)](https://www.betaalvereniging.nl/en/safety/tahiti/) - This model builds on the Sqrrl model by generating new threat intelligence from hunting activities, which then feeds back into the threat intelligence feed for adversary analysis and hunting exercises \ [MITRE ATT\&CK](https://attack.mitre.org/) - While not exclusively a hunting framework, MITRE ATT\&CK incorporates hundreds of known adversarial tactics and techniques. It's foundational for hypothesis-driven hunting and many other security frameworks rely on it. These are great frameworks and regardless if you're casually threat hunting or building a formal program, they're required reading. To that end, we're not going to duplicate them here. Go read them, then come back and learn how to use Turngate to hunt in your SaaS environment. # Hunting in GitHub GitHub is the de facto center of the universe for many organization's development processes... which also makes it a primary system to monitor for security threats and strange activity. Let's do some threat hunting (and detection engineering) to get a handle on GitHub usage. {% hint style="info" %} Throughout this document, we'll list audit logs of interest you can use as part of your hunting. There's a longer list at the bottom, but the ones listed in the main part of the writeup are some of the logs we've found most useful. {% endhint %} ## Thoughts on GitHub ### What's your username? The culture of development in GitHub is a bit outside the norm for corporate SaaS products. While nearly every other B2B SaaS tool follows a very standard "Corporate identity" -> "Provision an account using that identity" path, GitHub allows corporations to let developers use whatever their existing GitHub ID is to access corp repositories. In fact, GitHub uses a username instead of an email as its primary identifier (what is this, 1998?). Some companies force employees to use new, clean ID's tied to their corporate email, but some allow employees to use their personal ID's. How your company handles GitHub identities (and authentication) will drive how you hunt in GitHub. You can even find where people are loging in from ( `user.login` )and if someone has turned off MFA ( `two_factor_authentication.disabled` a big 🚨) ## What's in GitHub GitHub is a software repository system. But there's so so much more than code in GitHub ### Workflows Workflows, webhooks, and automations are the backbone of the modern CI/CD pipeline. You may have a relatively simple repository but fantastically complicated workflows that allow your developers to create, test, and deploy code at (terrifying) speed. That's cool and all, but workflows are a window into your CI/CD pipeline. There are many examples (including this [CISA Advisory](https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction) and this [MS writeup on Shai Hulud](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)) where workflows have been subverted by attackers and bad things happened. Pay attention to new workflows ( `workflows.created` ) and webhooks ( `hook.create`, `hook.config_changed` ) and dig into unknown/new ones. ### Tokens Even if you use SSO, GitHub can still contain sensitive authentication credentials. While ideally your code doesn't have hardcoded passwords, GitHub accounts may have the ability to create Personal Access Tokens (PAT). PAT's are like API keys... they grant access to everything a user has access to without need for MFA or forced rotation. Finding when PATs are created an used can be a super useful hunt ( `personal_access_token.create`, `personal_access_token.access` )... and in fact, you should alert every time a PAT is created to make sure it's something allowed and intended. ### OAuth connections in and out OAuth enables the powerful feature of SaaS apps to connect seamlessly to each other. They're also super dangerous and hard to wrap your arms around. GitHub audit records provide some telemetry around OAuth connections and usage ( `integration_installation.create`, `org_credential_authorization.grant` ), and digging into them can help uncover malicious (or at least unwanted) activity. ### Well, and of course, code Don't underestimate the value of your software. From both an IP perspective and security perspective, your software is valuable. Looking at who has access ( `repo.add_member` ), who is downloading repos ( `repo.download_zip`, `git.fetch`, `git.clone` ), and what repositories are accessed can be a great place to start a hunt. ## How and what to look for GitHub's audit log interface is free to use if you're a GitHub Enterprise customer and available at or by going to your enterprise Settings page and clicking "Audit Log." Their interface is servicable but pretty linear.
They have their own syntax and if you really know what you're looking for, you can find it. Conversely... ### USE TURNGATE Seriously, we're way easier to you. Here's a query of all pull request activity in the last month, that I used to pivot to focus on the activity of one developer and validate all the work they did from an unknown IP address. The whole hunt took about 45 seconds.
We have a [45 day free trial](https://www.turngate.io/get-started). Go check us out. You won't be disappointed. ### GitHub audit events GitHub has [documentation on their audit logs](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization) including how to access them and what they mean. Unfortunately, even GitHub's definitions can be a bit tough to wrap your head around. You're in luck because Turngate has summaries in the application to help you make sense of the data you're seeing.
Pretty cool, huh? ### Audit events of interest Here's a longer list of audit events to get your started on your hunting journey. **OAuth & Access Token Events:** * `oauth_application.create` - New OAuth apps that could exfiltrate data * `oauth_application.transfer` - OAuth app ownership changes * `oauth_authorization.create` - Suspicious OAuth authorizations, especially from unfamiliar applications * `personal_access_token.create` - New PAT creation, especially with broad scopes * `personal_access_token.access` - PAT usage patterns (look for anomalous IPs/locations) * `user.login` - Failed login attempts or logins from unusual locations * `two_factor_authentication.disabled` - 2FA being turned off (major red flag) **SSH & Deploy Key Events:** * `public_key.create` - New SSH keys added to user accounts * `public_key.update` - Modified SSH keys * `deploy_key.create` - Deploy keys with write access to repositories ### **Data Exfiltration & Repository Tampering** **Repository Visibility & Access:** * `repo.access` - Repository access events, especially bulk downloads * `repo.create` - New repository creation (could be staging for exfiltration) * `repo.destroy` - Repository deletion (potential evidence destruction) * `repo.archived` - Archiving repositories * `repo.transferred` - Repository ownership transfers * `repo.config.disable_anonymous_git_access` - Changing anonymous access settings * `private_repository_forking.enable` - Allowing private repo forks (exfiltration risk) **Branch Protection Bypasses:** * `protected_branch.destroy` - Removing branch protections * `protected_branch.update_admin_enforced` - Disabling admin enforcement * `protected_branch.dismiss_stale_reviews` - Weakening review requirements * `protected_branch.policy_override` - Admin bypass of branch protection * `repo.remove_member` - Removing collaborators who might notice malicious activity ### **Privilege Escalation & Permission Changes** **Organization & Team Permissions:** * `org.add_member` - New members added, especially with admin roles * `org.update_member` - Permission level changes (member → admin) * `org.remove_member` - Removing security team members * `team.add_member` - Adding users to privileged teams * `team.add_repository` - Granting team access to sensitive repos * `team.create` - New team creation with elevated permissions * `org_credential_authorization.grant` - Granting SSO credential authorizations **Repository Collaborators:** * `repo.add_member` - New collaborators with write/admin access * `repo.update_member` - Collaborator permission escalation * `integration_installation.create` - Installing third-party integrations with broad permissions * `integration_installation_request.create` - Requests to install potentially malicious apps ### **Code Injection & Supply Chain Attacks** **Actions & Workflows:** * `workflows.created` - New GitHub Actions workflows (could contain malicious code) * `workflows.updated` - Modified workflows (backdoor injection) * `workflow_run.requested` - Workflow execution patterns * `repo_secret_scanning_push_protection_bypass.create` - Bypassing secret push protection * `environment.create_actions_secret` - Secrets added to environments * `environment.remove_actions_secret` - Secrets removed (potential theft) **Dependency & Package Events:** * `packages.published` - Package publications to GitHub Packages * `packages.updated` - Package updates that could introduce malicious dependencies * `repo.packages_permission_change` - Changes to package permissions ### **Webhook & Integration Abuse** **Webhook Events:** * `hook.create` - New webhooks (data exfiltration channel) * `hook.config_changed` - Webhook URL/configuration changes * `hook.destroy` - Webhook deletion (covering tracks) * `integration_installation.create` - Third-party app installations * `marketplace_agreement_signature.create` - GitHub Marketplace app agreements ### **Audit Trail Tampering** **Audit & Compliance:** * `audit_log_streaming.update` - Changes to audit log streaming configuration * `audit_log_streaming.destroy` - Disabling audit log streaming * `business.update_member_repository_creation_permission` - Changes allowing repo creation * `ip_allow_list_entry.create/destroy` - IP allowlist modifications ### **Suspicious Patterns to Detect** **Velocity-based Anomalies:** * Bulk `repo.access` events in short timeframes (mass cloning) * Multiple `repo.create` + `repo.transfer` sequences (lateral movement) * Rapid `org.add_member` + `org.update_member` (privilege escalation chain) * Sequential `protected_branch.destroy` across multiple repositories **Time-based Anomalies:** * Events occurring during off-hours or unusual timezones * `user.login` from multiple geolocations in impossible timeframes * Actions immediately after `oauth_authorization.create` (compromised OAuth) **Correlation Patterns:** * `two_factor_authentication.disabled` followed by `user.login` from new location * `protected_branch.destroy` → code push → `protected_branch.create` (covering tracks) * `secret_scanning.disable` → large commits → `secret_scanning.enable` * `repo.add_member` with admin + `repo.transfer` + `org.remove_member` (repository theft) # Hunting in Okta ## Hunting in Okta Okta is the front door to your entire SaaS kingdom. Every user, every app, every authentication event flows through it which makes it one of the most critical systems to monitor for security threats and one of the most dangerous to ignore. LAPSUS$, Scattered Spider, and a long list of other threat actors have proven that attackers know this. Let's do some threat hunting (and detection engineering) to get a handle on what's happening in your Okta environment. > Throughout this document, we'll list audit log events of interest you can use as part of your hunting. There's a longer list at the bottom, but the ones called out in the main body are the ones we've found most useful in practice. Also, props to David French ([@threatpunter](https://medium.com/threatpunter/okta-threat-hunting-tips-62dc0013d526)) whose excellent Okta hunting research forms the backbone of much of this guide — go read it. *** ### Thoughts on Okta #### Okta is the front door Okta isn't just another SaaS tool. It's the authentication layer sitting in front of most SaaS tools your organization uses. Compromise Okta and you don't just compromise one app you compromise everything behind it. That's why it's a tier-one target for attackers and why it deserves tier-one monitoring. {% hint style="info" %} Note we said "most". Many products either charge an SSO tax they you may have chosen not to pay or don't have SSO available at all. Further some products allow local AND SSO accounts. Just like a house, while Okta may be the front door, there are likely other doors (and windows) that may be in use for access. {% endhint %} Unlike GitHub (which logs who did what to which repository), Okta logs who authenticated as what, from where, to access what. The identity dimension is front and center in every event. This means your hunts are often about answering questions like: *Is this really the person they claim to be? Are they acting consistently with their normal patterns? Did someone just get elevated access they shouldn't have?* #### The signal-to-noise challenge Okta's System Log is rich. It's also enormous. A mid-sized company can generate tens of thousands of events per day just from normal authentication activity. Further, the information in the logs is dense. The `debug` section of each log can have very useful breadcrumbs when it comes to alerting and hunting; however these `debug` fields also contain a LOT of noise that isn't useful to.. well, probably anyone. The solution isn't to look at everything. It's to know which events actually matter and build your hunts around them. *** ### What's in Okta #### Authentication events Authentication is the core of what Okta does, and `user.session.start` is the most important event in the log. Every successful login produces one. Failures produce `user.authentication.auth_via_mfa` failures, lockout events, and more. When you're hunting, you're not just looking for failures, you're looking for *patterns*. Logins from unexpected geographies, at unusual hours, from anomalous user agents, or with session characteristics that don't match prior behavior. `user.session.start` is your bread and butter. Everything interesting starts here. #### MFA and factor management MFA is your primary control against credential-based attacks. When it gets disabled, suspended, or removed, that's a critical signal, especially on privileged accounts. French highlights this in his research: keep a close eye on MFA factor changes on admin and sysadmin accounts, and look at what those accounts do in the window immediately surrounding those events. {% hint style="info" %} Alert on `user.mfa.attempt_bypass` as a matter of policy — every single occurrence is worth triaging. There's essentially no legitimate reason for a bypass attempt that doesn't warrant a human looking at it. {% endhint %} #### Admin privileges and API tokens Administrative accounts in Okta are crown-jewel targets. If an attacker gets admin access, they can create API tokens (`system.api_token.create`) as a persistence mechanism — an API token provides ongoing programmatic access that doesn't require interactive MFA and doesn't expire by default. French specifically calls this out as something to alert on: every API token creation should have a documented, approved justification. Privilege escalation is equally important to watch. Look for `user.account.privilege.grant` and group membership changes (`group.user_membership.add`) that add users to admin-equivalent groups. #### OAuth and application connections Okta mediates OAuth connections between your users and third-party applications. Application assignments and integrations are a frequently overlooked attack surface. A malicious OAuth app granted access by a compromised admin can exfiltrate data indefinitely. Watch `application.lifecycle.create`, `application.user_membership.add`, and OAuth-related grant events. #### Session hijacking signals One of the more sophisticated techniques French covers is session cookie hijacking — attackers use tools like Evilginx2 to steal authenticated session cookies and replay them to bypass MFA entirely. The key hunting signal is looking for anomalies within a single session: specifically, multiple different ASN values or user agent strings associated with the same `authenticationContext.externalSessionId`. The value `securityContext.asNumber` is your friend here. Normal browser sessions don't bounce between ASNs. Hijacked sessions often do, because the attacker is replaying the cookie from a different network. *** ### How and what to look for Okta's native System Log interface at `https://yourorg.okta.com/admin/reports/system-log` is functional but designed for linear investigation. You can search with Okta's expression language, save reports, and export to a SIEM. If you're running a well-resourced SOC, you probably already have this feeding into Splunk, Elastic, or a similar platform. #### USE TURNGATE If you don't have a SIEM, or your SIEM queries feel like archaeology, Turngate gives you a much faster path to answers. Here's a hunt for all admin privilege change events in the last 30 days, pivoted to a single suspicious user, completed in under a minute: > ![](/files/pTGisvDjzhoO4YK1Z18n) We have a [45-day free trial](https://www.turngate.io/get-started). Give it a shot. Seriously. The challenge with Okta hunting isn't finding the events, it's making sense of the volume and pivoting quickly from a suspicious signal to the full story of what happened. Turngate's heatmap lets you see anomalies at a glance across all users and event types. When something looks off, you can drill down to the individual actor, see all their surrounding activity, and validate or escalate all without writing a query. Okta has its own [documentation on System Log events](https://developer.okta.com/docs/reference/api/system-log/) including detailed field descriptions. Turngate surfaces human-readable summaries of these events so you don't need to memorize what `policy.rule.update` vs `policy.evaluate_sign_on` actually means in practice. *** ### Audit events of interest Here's a practical reference list for building your hunts and detections. Organized by threat category. #### Credential attacks and initial access **Brute Force & Credential Stuffing:** * `user.session.start` — baseline for all login activity; hunt for high failure rates by source IP * `user.authentication.auth_via_mfa` — MFA challenge events; look for volumetric failures (MFA fatigue) * `security.threat.detected` — Okta ThreatInsight has flagged this as a high-confidence threat ([see French's tip on ThreatInsight](https://medium.com/threatpunter/okta-threat-hunting-tips-62dc0013d526)); alert on every occurrence * `user.account.report_suspicious_activity_by_enduser` — the user themselves is telling you something is wrong; never ignore these **VPN & Anonymization Services:** * `user.session.start` from Tor exit nodes, ProtonVPN, NordVPN, or known datacenter IP ranges — French specifically recommends ingesting IP lists for these services into your SIEM and alerting on login events from them * `user.authentication.sso` with unusual `securityContext.asOrg` values (datacenter ASNs rather than ISP/consumer ASNs) #### MFA attacks and bypass **MFA Degradation:** * `user.mfa.factor.deactivate` — MFA factor disabled on an account (🚨 for admin accounts) * `user.mfa.factor.suspend` — MFA factor suspended * `user.mfa.factor.reset_all` — all MFA factors reset on an account * `user.mfa.attempt_bypass` — explicit bypass attempt; alert on every occurrence ([French calls this out specifically](https://medium.com/threatpunter/okta-threat-hunting-tips-62dc0013d526)) **MFA Fatigue / Push Bombing:** * Spike of `user.authentication.auth_via_mfa` failures followed by a successful `user.session.start` — look for the pattern of repeated push failures resolving to a successful login, which may indicate a fatigued user finally approving a fraudulent push #### Session hijacking and token theft **Session Anomalies:** * Multiple `securityContext.asNumber` values within a single `authenticationContext.externalSessionId` — core signal for session cookie hijacking as described by French * Multiple `client.userAgent` values within the same session * `user.session.impersonation.initiate` / `user.session.impersonation.grant` — admin is impersonating a user; verify this is authorized **API Token Abuse:** * `system.api_token.create` — new API token created; every token needs a documented purpose ([French recommends alerting on all of these](https://medium.com/threatpunter/okta-threat-hunting-tips-62dc0013d526)) * `system.api_token.revoke` — token revoked (possible cleanup after use) #### Privilege escalation and persistence **Admin Account Changes:** * `user.account.privilege.grant` — privilege granted to a user account * `group.user_membership.add` — user added to a group; especially dangerous for groups tied to admin apps * `group.user_membership.remove` — user removed from a group (covering tracks or removing competitors) **Policy Weakening:** * `policy.rule.update` — a policy rule has been modified; verify with the admin team * `policy.rule.deactivate` — a policy rule has been deactivated * `policy.lifecycle.update` — sign-on or MFA policy updated * `policy.evaluate_sign_on` with `DENY` outcomes suddenly disappearing (attacker may have relaxed a policy) **Application & Integration Changes:** * `application.lifecycle.create` — new application added to Okta; review OAuth scopes and who approved it * `application.lifecycle.activate` — previously inactive application enabled * `application.user_membership.add` — user assigned to an application (especially sensitive apps) * `application.lifecycle.update` — application configuration changed #### Defense evasion **Log and Audit Tampering:** * `system.log_streaming.create` / `system.log_streaming.update` — changes to audit log streaming; verify these are authorized * Any admin activity occurring in a tight window around `user.mfa.factor.deactivate` (attacker may be working quickly to establish persistence before defenders notice) **Rate Limit Abuse:** * `system.org.rate_limit.warning` — approaching a rate limit; could indicate automated attack activity * `system.org.rate_limit.violation` — rate limit exceeded; investigate the source immediately *** ### Suspicious patterns to detect #### Velocity-based anomalies * **MFA fatigue chain**: spike of `user.authentication.auth_via_mfa` failures → short pause → successful `user.session.start` (classic push bombing pattern) * **Impossible travel**: `user.session.start` from geographically distant locations within an impossible timeframe * **Credential stuffing**: high volume of failed `user.session.start` events from a single IP or narrow IP range against multiple accounts * **Bulk admin changes**: multiple `user.account.privilege.grant` or `group.user_membership.add` events in rapid succession #### Correlation chains * `user.mfa.factor.deactivate` → `user.session.start` from new location → `system.api_token.create` (account takeover + persistence) * `policy.rule.deactivate` → `user.session.start` from VPN/Tor IP → `application.user_membership.add` (policy weakening before lateral movement) * `user.account.privilege.grant` → `system.api_token.create` → `group.user_membership.add` on other accounts (privilege escalation + persistence chain) * Multiple ASN values within same session `externalSessionId` → `system.api_token.create` (session hijack into token persistence) * `user.account.report_suspicious_activity_by_enduser` → no `user.mfa.factor.reset_all` in response window (victim reported it but remediation hasn't happened) #### Cross-source correlation French's most underrated tip: correlate Okta events with other data sources. If Okta rates a login as `MEDIUM` or `HIGH` risk *and* Google Workspace (or whatever downstream app is involved) is simultaneously logging anomalous activity for the same user, that's a much higher-confidence signal than either source alone. The sum is greater than its parts. Build cross-source correlation rules for your highest-risk users (executives, admins, finance) first. *** *This guide draws heavily on research by David French (*[*@threatpunter*](https://medium.com/threatpunter/okta-threat-hunting-tips-62dc0013d526)*). His original post is required reading for anyone building Okta detections. We've extended his hunting tips with additional context, event references, and guidance on using Turngate to operationalize them.* # Hunting in Dropbox Dropbox is one of the most widely deployed cloud storage platforms in the enterprise — which also makes it a prime target for data exfiltration, insider threats, and credential abuse. Let's do some threat hunting (and detection engineering) to get a handle on what's really happening in your team's Dropbox environment. > Throughout this document, we'll list audit log event types of interest you can use as part of your hunting. There's a longer list at the bottom, but the ones listed in the main writeup are some of the most useful signals we've found. All event types come from Dropbox's `team_log/get_events` API endpoint, available to Dropbox Business, Advanced, and Enterprise customers. *** ### Thoughts on Dropbox #### It's not just files When most people think about auditing Dropbox, they think about files — who uploaded what, who deleted what. And yes, file activity matters. But Dropbox is also a sharing platform, an integration hub, and for many organizations, a de facto collaboration layer. That means the threat surface is much broader than it first appears. Shared links are public URLs. Third-party app integrations can read everything a user can read. Team folder structures can expose the org chart and project portfolio to anyone with access. The goal of hunting in Dropbox is to understand the full picture: who has access, what they're doing with it, and what's leaving the building. #### Plan tiers affect what you can see This catches security teams off guard more than almost anything else. File-level activity events — `file_add`, `file_delete`, `file_download` — are only available on **Dropbox Business Advanced and Enterprise** plans. On Standard plans, you'll primarily see member management, sharing, and login events. Know what plan you're on before you start hunting, because it determines what you're blind to. Dropbox's audit logs are accessible from the Admin console under **Activity**, or programmatically via the Business API by POSTing to `https://api.dropboxapi.com/2/team_log/get_events` with a scoped token carrying `events.read` permissions. *** ### What's in Dropbox (and why attackers care) #### Shared links: The unlocked door Dropbox's shared link feature is one of its most useful — and most dangerous — capabilities. A `shared_link_create` event means someone just created a link that, depending on settings, could be publicly accessible to anyone on the internet with the URL. These links don't always require authentication. They don't expire by default. And once created, they're hard to revoke at scale. Watch for `shared_link_create` across sensitive folders, especially when the access level is `public`. Watch equally hard for `shared_link_settings_change_access_level` — a link quietly upgraded from team-only to public is a significant change worth investigating. The [Dropbox developer blog's CEF integration guide](https://dropbox.tech/developers/converting-the-dropbox-activity-log-into-common-event-framework-) calls sharing events out as "high security impact and severity," and they're not wrong. #### App integrations: OAuth all the way down Dropbox supports OAuth-connected third-party applications. The event `app_link_user` fires when a user links a personal app to their account — a PDF converter, an e-signature tool, a backup utility. Annoying but manageable. `app_link_team` is the far more dangerous variant: a team-linked app gets access across the entire team namespace. One compromised OAuth app with a `app_link_team` grant is a complete data exfiltration vector. Hunting for new and unusual `app_link_team` events — particularly from application names you don't recognize — should be a standing detection rule in every environment. #### Member management: The provisioning/deprovisioning gap Every `member_add` event deserves scrutiny. Who invited this person? What's their email domain? A contractor with a personal Gmail being added to sensitive shared folders is a risk most orgs don't catch until after the fact. The flip side matters equally: `member_remove` events that are *not* followed by revocation of shared link access create a persistent window. Dropbox does not automatically expire shared links when a member is removed. An attacker — or simply a departing employee — who extracted links before offboarding can still use them. #### Two-factor authentication: The canary in the coalmine `tfa_change_status` is one of the highest-signal events in the Dropbox audit log. When a team member disables two-factor authentication, it's either a security regression or an indicator of account compromise. It should always fire an alert. Full stop. 🚨 *** ### How and what to look for Dropbox's Admin console Activity page is functional — filter by date, member, event type, and content, click any row for a side panel showing the exact timestamp, file path, IP address, and device. It works. But it's linear. You're scrolling a timeline, not doing analytics. For hunting at scale, pull from `team_log/get_events` directly and push into your SIEM or data lake. Events return a consistent schema: `timestamp`, `event_category`, `event_type`, `actor`, `context`, `origin`, and `participants`. The `origin` field is your pivot point — it carries source IP, access method (web, desktop, mobile), and geographic location, making it the cornerstone of impossible travel and anomalous session detection. Dropbox exposes a cursor-based `team_log/get_events/continue` endpoint for pagination and continuous polling. Poll every 5–10 minutes, store the raw JSON, and you own your retention independent of Dropbox's 180-day (Business/Advanced) or 365-day (Enterprise) log limits. Panther's open-source detection library also ships pre-built rules for Dropbox `Dropbox.TeamEvent` logs that are worth using as a starting baseline. Use Turngate *** ### Audit events of interest **Authentication & Access:** * `login_success` — Pivot on IP and geo; this is your foundation for impossible travel * `login_fail` — High volume against a single account = brute-force signal * `tfa_change_status` — 2FA disabled 🚨 * `password_change` — Especially outside business hours or from a new IP * `sign_in_as_session_start` — Admin impersonating a team member; always review **File Operations (Advanced/Enterprise only):** * `file_add` — Bulk uploads of unusual file types to personal namespace * `file_delete` — Correlate with departing member timelines * `file_download` — High velocity in a short window = exfiltration signal * `file_move` — From team folder to personal namespace is a red flag * `file_copy` — Staging data before exfiltration * `file_get_copy_reference` — Precursor to cross-account file transfer * `file_permanently_delete` — Bypasses trash; potential evidence destruction **Sharing & External Access:** * `shared_link_create` — Check access level: public vs. team vs. password-protected * `shared_link_view` — Includes the accessor's IP, even for non-team members * `shared_link_remove_expiry` — Someone just extended indefinite access to a link * `shared_link_settings_change_access_level` — Link opened up to public * `shared_content_add_invitees` — Watch for external or personal email domains * `shared_content_change_invitee_role` — Viewer quietly promoted to editor * `shared_content_copy` — Non-team member copying your content to their own Dropbox * `shared_content_download` — External invitee bulk-downloading content **App & Integration Events:** * `app_link_user` — Personal app linked; baseline and alert on new app names * `app_link_team` — Team-wide OAuth grant 🚨 alert on every occurrence * `app_unlink_team` — App removed (could indicate covering tracks) **Member & Team Management:** * `member_add` — New invite; flag external domains * `member_remove` — Offboarding; check for link persistence * `member_change_admin_role` — Privilege change * `member_change_email` — Account email changed (account takeover indicator) * `member_transfer_account_contents` — Content moved between accounts * `group_add_member` — Grants all group-shared folder access; watch for lateral movement * `group_change_management_type` — Group admin control shifted to user-managed **Admin & Policy Changes:** * `team_folder_permanently_delete` — Irreversible; potential evidence destruction * `sharing_change_link_policy` — Team-wide link policy loosened * `sharing_change_member_policy` — External sharing policy changed * `tfa_add_exception` — Member exempted from 2FA requirement * `tfa_change_policy` — Team-wide 2FA policy changed * `device_delete` — Device unlinked; normal during offboarding, suspicious otherwise *** ### Suspicious patterns to detect **Velocity-based anomalies:** * Burst of `file_download` or `shared_content_download` events within a short window, especially after hours * Rapid sequence of `file_copy` across multiple team folders → `shared_link_create` with public access * Multiple `shared_link_create` events across diverse folder paths within minutes of each other **Time-based anomalies:** * `login_success` from a new country followed immediately by `shared_link_create` or `app_link_team` * `sign_in_as_session_start` outside business hours with no associated IT ticket * High-volume `file_download` events in the 48 hours preceding `member_remove` **Correlation patterns:** * `tfa_change_status` (disabled) → `password_change` → `login_success` from new IP — the classic account takeover chain * `member_remove` → `shared_link_view` from an external IP — link persisting post-offboarding * `sharing_change_link_policy` (loosened) → `shared_link_create` (bulk) — policy change used as a staging action * `app_link_team` from unknown application → `shared_content_download` — OAuth app immediately harvesting data *** ### A note on gaps Dropbox is explicit that some activity is not captured in the team log. Microsoft co-authoring session activity, certain Dropbox Sign workflows, and actions performed during some third-party integrations may not appear. Understand your blind spots — because an attacker certainly will. *** *Event type names follow the Dropbox Business API v2 `team_log/get_events` schema and the* [*Dropbox Java SDK EventTypeArg reference*](https://dropbox.github.io/dropbox-sdk-java/api-docs/v3.2.x/com/dropbox/core/v2/teamlog/EventTypeArg.html)*. Some names differ from the Admin console UI labels. The Dropbox developer blog's* [*CEF integration post*](https://dropbox.tech/developers/converting-the-dropbox-activity-log-into-common-event-framework-) *and Panther's* [*Dropbox log schema documentation*](https://docs.panther.com/data-onboarding/supported-logs/dropbox) *are useful companion references.*