openapi: 3.0.1
info:
  title: ThreatSync Management API
  description: REST API to manage ThreatSync incidents and actions.
  version: 1.1.8
  contact:
    name: API Support
    url: https://www.watchguard.com/wgrd-support/contact-support
  termsOfService: 
    https://www.watchguard.com/help/docs/api/Content/en-US/license_agreement.html?cshid=18007
paths:
  /health:
    get:
      tags:
        - Check Health
      description: HealthCheck URL
      summary: Perform health check.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/checkHealth'

  /v1/{accountId}/incidents:
    get:
      tags:
        - Get Incidents
      description: Retrieves a list of specific ThreatSync incidents for an account.
      summary: Retrieves a list of incidents.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentQuery'
        - $ref: '#/components/parameters/incidentSortBy'
        - $ref: '#/components/parameters/sortOrder'
        - $ref: '#/components/parameters/groupBy'
        - $ref: '#/components/parameters/incidentFields'
        - $ref: '#/components/parameters/countOnly'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/incidentStartAfter'
        - $ref: '#/components/parameters/duration'
        - $ref: '#/components/parameters/tenants'
        - $ref: '#/components/parameters/includeActions'
        - $ref: '#/components/parameters/includeComments'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchIncidents'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/incidents/{incidentId}:
    get:
      tags:
        - Get Incident
      description: Retrieves a specific incident by incident ID.
      summary: Retrieves a specific incident.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/includeActions'
        - $ref: '#/components/parameters/includeComments'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchIncident'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
    patch:
      tags:
        - Update Incident Status
      description: Updates the status of a specific incident.
      summary: Updates the incident status.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        description: Request body that includes the updated incident status. You must
          update the incident status value and you can add an optional comment. Allowed
          values are one of new, read, and closed.
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
                  description: |
                    Updated incident status. This can be one of these values:
                    - new - New incidents not yet reviewed.
                    - read - Reviewed incidents or incidents marked as read.
                    - closed - Incidents closed by an automation policy or manual action.
                  example: closed
                comment:
                  type: string
                  description: Comment on an incident.
                  example: sample comment
              required:
                - status
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/updateIncident'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/incidents/{incidentId}/actions:
    get:
      tags:
        - Get Actions for Specific Incident
      description: Retrieves a list of actions for a specific incident.
      summary: Retrieves a list of actions for an incident.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/actionIncidentId'
        - $ref: '#/components/parameters/actionQuery'
        - $ref: '#/components/parameters/actionSortBy'
        - $ref: '#/components/parameters/sortOrder'
        - $ref: '#/components/parameters/groupBy'
        - $ref: '#/components/parameters/actionFields'
        - $ref: '#/components/parameters/countOnly'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/actionStartAfter'
        - $ref: '#/components/parameters/duration'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchActionsForIncident'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
    post:
      tags:
        - Perform Action for a Specific Incident
      description: Performs an action for a specific incident.
      summary: Performs an action for specific incident.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/actionIncidentId'
      requestBody:
        description: |
          Request body that includes details used to perform an action. 

          Specify one of these actions in the command parameter and include the relevant parameters:
            - blockAddress - Adds an IP address to the Blocked Sites list of the account.
                Required parameters: address (the IP address to block)
            - unblockAddress - Removes an IP address from the Blocked Sites list of the account.
                Required parameters: address (the IP address to unblock)
            - isolate - Isolates an endpoint-protected computer.
                Required parameters: None
            - unIsolate - Unisolates an isolated computer.
                Required parameters: None
            - killProcess - Ends a process on an endpoint-protected computer.  
                Required parameters: pid (the process ID) or md5 (the md5 hash of the file)
            - quarantineFile - Quarantines a file on an endpoint-protected computer.
                Required parameters: md5 (the md5 hash of the file)

          Note: entityId is a required request parameter for endpoint actions and optional for Firebox actions.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                command:
                  type: string
                  description: Name of the action to perform.
                  example: blockAddress
                parameters:
                  type: object
                  description: Parameters required to perform the action. These depend
                    on the specified action.
                  example:
                    address: 3.3.3.3
                entityId:
                  type: string
                  description: ID of the entity.
                  example: 96
                comment:
                  type: string
                  description: Comment on an action.
                  example: sample comment
              required:
                - command
                - parameters
      responses:
        '201':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/createActionForIncident'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/incidents/{incidentId}/actions/{actionId}:
    get:
      tags:
        - Get Action for a Specific Incident
      description: Retrieves details of a specific action for an incident.
      summary: Retrieves details of a specific action.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/actionIncidentId'
        - $ref: '#/components/parameters/actionId'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchActionForIncident'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/actions:
    get:
      tags:
        - Get Actions
      description: Retrieves a list of actions.
      summary: Retrieves a list of actions.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/actionQuery'
        - $ref: '#/components/parameters/actionSortBy'
        - $ref: '#/components/parameters/sortOrder'
        - $ref: '#/components/parameters/groupBy'
        - $ref: '#/components/parameters/actionFields'
        - $ref: '#/components/parameters/countOnly'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/actionStartAfter'
        - $ref: '#/components/parameters/duration'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchActions'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
    post:
      tags:
        - Perform Action
      description: Performs a specified action.
      summary: Performs an action.
      parameters:
        - $ref: '#/components/parameters/accountId'
      requestBody:
        description: |
          Request body that includes details used to perform an action. 

          Specify one of these actions in the command parameter and include the relevant parameters:
            - blockAddress - Adds an IP address to the Blocked Sites list of the account.
                Required parameters: address (the IP address to block)
            - unblockAddress - Removes an IP address from the Blocked Sites list of the account.
                Required parameters: address (the IP address to unblock)
            - isolate - Isolates an endpoint-protected computer.
                Required parameters: None
            - unIsolate - Unisolates an isolated computer.
                Required parameters: None
            - killProcess - Ends a process on an endpoint-protected computer.  
                Required parameters: pid (the process ID) or md5 (the md5 hash of the file)
            - quarantineFile - Quarantines a file on an endpoint-protected computer.
                Required parameters: md5 (the md5 hash of the file)

          Note: entityId is a required request parameter for endpoint actions and optional for Firebox actions.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                command:
                  type: string
                  description: Name of the action to perform.
                  example: blockAddress
                parameters:
                  type: object
                  description: Parameters required to perform the action. These depend
                    on the specified action.
                  example:
                    address: 3.3.3.3
                entityId:
                  type: string
                  description: ID of the entity.
                  example: 96
              required:
                - command
                - parameters
      responses:
        '201':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/createAction'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/transact:
    post:
      tags:
        - Initiate Transaction
      description: Submits multiple requests to ThreatSync Management API endpoints
        at the same time.
      summary: Initiates a transaction to submit multiple requests.
      requestBody:
        description: Request body that includes details of the requests to submit
          in the transaction.
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                type: object
                properties:
                  path:
                    type: string
                    description: Path of the API endpoint.
                  method:
                    type: string
                    description: HTTP method.
                  data:
                    type: object
                    description: Request body for this request.
              example:
                - path: /v1/<accountId>/incidents/<incidentId>/actions
                  method: POST
                  data:
                    command: blockAddress
                    parameters:
                      address: 3.3.3.3
                    entityId: '96'
                - path: /v1/<accountId>/actions
                  method: POST
                  data:
                    command: blockAddress
                    parameters:
                      address: 3.3.3.3
                    entityId: '96'
                    comment: Optional comment for a create action for an incident.
                - path: /v1/<accountId>/incidents/<incidentId>
                  method: PATCH
                  data:
                    status: closed
                    comment: Optional comment for an incident status update.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transact'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/incidents/{incidentId}/comments:
    get:
      tags:
        - Get Comments for a Specific Incident
      description: Retrieves a list of comments for a specific incident.
      summary: Retrieves a list of comments for an incident.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/sortOrder'
        - $ref: '#/components/parameters/commentSortBy'
        - $ref: '#/components/parameters/commentFields'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/duration'
        - $ref: '#/components/parameters/commentStartAfter'
        - $ref: '#/components/parameters/commentGroupBy'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/fetchComments'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
    post:
      tags:
        - Create Comment for Specific Incident
      description: Create comment for a specific incident.
      summary: Create a comment.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        description: Request body that includes a comment to create for a specified
          incident.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment for an incident.
                  example: sample comment
              required:
                - comment
      responses:
        '201':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/createComment'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

  /v1/{accountId}/incidents/{incidentId}/comments/{commentId}:
    patch:
      tags:
        - Update Specific Comment
      description: Update a specific comment.
      summary: Updates a specific comment.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/commentId'
      requestBody:
        description: Request body that includes an updated comment for a specified
          incident.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Updated comment.
                  example: updated comment
              required:
                - comment
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/updateComment'
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'
    delete:
      tags:
        - Delete Specific Comment
      description: Delete a specific comment.
      summary: Deletes a specific comment.
      parameters:
        - $ref: '#/components/parameters/accountId'
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/commentId'
      responses:
        '204':
          description: The comment was successfully deleted.
        default:
          description: Error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error'

components:
  parameters:
    accountId:
      name: accountId
      in: path
      description: Your WatchGuard Cloud Account ID.
      required: true
      schema:
        type: string
      example: WCG-1-123abc456 or ACC-1234567
    incidentId:
      name: incidentId
      in: path
      description: ID of an incident.
      required: true
      schema:
        type: string
      example: cg0f0s2h7skomt847f1g
    actionId:
      name: actionId
      in: path
      description: ID of an action.
      required: true
      schema:
        type: string
      example: cd08f4a339fb40feb4ee69314cdb1f8c
    actionIncidentId:
      name: incidentId
      in: path
      description: ID of an incident.
      required: true
      schema:
        type: string
      example: ch3hmad3u2h464hfedi0
    commentId:
      name: commentId
      in: path
      description: ID of a comment.
      required: true
      schema:
        type: string
      example: 6026c9e0e7fb44a39bd3ee540e37ef41
    incidentQuery:
      name: query
      in: query
      description: Query string that enables you to search for records that match
        the specified data. Specify parameter names and associated values to retrieve
        objects that match those values.
      required: false
      schema:
        type: string
      example: threatScore:>5 && status:closed
    actionQuery:
      name: query
      in: query
      description: Query string that enables you to search for records that match
        the specified data. Specify parameter names and associated values to retrieve
        objects that match those values.
      required: false
      schema:
        type: string
      example: status:performed OR status:failed OR status:inProgress AND responder:System
    incidentSortBy:
      name: sortBy
      in: query
      description: Specifies how to sort results. This can be the names of one or
        more response parameters, separated by commas.
      required: false
      schema:
        type: string
      example: timestamp,threatScore
    actionSortBy:
      name: sortBy
      in: query
      description: Specifies how to sort results. This can be the names of one or
        more response parameters, separated by commas.
      required: false
      schema:
        type: string
      example: creationTime,command
    sortOrder:
      name: sortOrder
      in: query
      description: |
        Specifies whether to sort the results in ascending or descending order. This can be one of these values:
          - asc - Sorts results in ascending order.
          - desc - Sorts results in descending order.
      required: false
      schema:
        type: string
      example: desc
    groupBy:
      name: groupBy
      in: query
      description: Specifies the parameter to group data by.
      required: false
      schema:
        type: string
      example: status
    incidentFields:
      name: fields
      in: query
      description: Specifies which response parameters to return in the results. If
        you do not specify a value, the API returns all response parameters. This
        can be one or more values, separated by commas.
      required: false
      schema:
        type: string
      example: id,threatScore,status,timestamp,lastUpdateTime
    actionFields:
      name: fields
      in: query
      description: Specifies which response parameters to return in the results. If
        you do not specify a value, the API returns all response parameters. This
        can be one or more values, separated by commas.
      required: false
      schema:
        type: string
      example: id,command,status,creationTime,incidentId
    countOnly:
      name: countOnly
      in: query
      description: Specifies whether to retrieve only a count of records.
      required: false
      schema:
        type: boolean
      example: false
    limit:
      name: limit
      in: query
      description: Maximum number of records to retrieve in the response. The maximum
        is limited to 500 records. The default value is 250.
      required: false
      schema:
        type: integer
        maximum: 500
      example: 250
    incidentStartAfter:
      name: startAfter
      in: query
      description: Cursor value that identifies the record after which you want to
        retrieve records. This value must match the data returned in the response
        parameter you specify in the sortBy request paramter.
      required: false
      schema:
        type: string
      example: 2023-07-26T14:32:25Z,8
    actionStartAfter:
      name: startAfter
      in: query
      description: Cursor value that identifies the record after which you want to
        retrieve records. This value must match the data returned in the response
        parameter you specify in the sortBy request paramter.
      required: false
      schema:
        type: string
      example: 2023-08-08T10:09:53Z,unblockAddress
    duration:
      name: duration
      in: query
      description: Duration of time in days to retrieve records for. Specify a number
        followed by the letter D. For example, 7D.
      required: false
      schema:
        type: string
      example: 27D
    tenants:
      name: tenants
      in: query
      description: Specifies whether to retrieve data for both Service Provider and
        managed accounts.
      required: false
      schema:
        type: boolean
        default: false
      example: true
    includeActions:
      name: includeActions
      in: query
      description: Specifies whether to include actions for an incident.
      required: false
      schema:
        type: boolean
        default: false
      example: true
    includeComments:
      name: includeComments
      in: query
      description: Specifies whether to include comments for an incident.
      required: false
      schema:
        type: boolean
        default: false
      example: true
    commentSortBy:
      name: sortBy
      in: query
      description: Specifies how to sort results. This can be the names of one or
        more response parameters, separated by commas.
      required: false
      schema:
        type: string
      example: creationTime,id
    commentGroupBy:
      name: groupBy
      in: query
      description: Specifies the response parameter to group data by.
      required: false
      schema:
        type: string
      example: 
        id,account,incidentId,actionId,user,comment,creationTime,lastUpdateTime,context,newStatus
    commentStartAfter:
      name: startAfter
      in: query
      description: Cursor value that identifies the record after which you want to
        retrieve records. This value must match the data returned in the response
        parameter you specify in the sortBy request parameter.
      required: false
      schema:
        type: string
      example: 2023-07-26T14:32:25Z,6026c9e0e7fb44a39bd3ee540e37ef41
    commentFields:
      name: fields
      in: query
      description: Specifies which response parameters to return in the results. If
        you do not specify a value, the API returns all response parameters. This
        can be the names of one or more response parameters, separated by commas.
      required: false
      schema:
        type: string
      example: 
        id,account,incidentId,actionId,user,comment,creationTime,lastUpdateTime,context,newStatus
  schemas:
    incident:
      type: object
      description: Incident information.
      properties:
        id:
          type: string
          description: ID of the incident.
          example: cg0f0s2h7skomt847f1g
        account:
          type: string
          description: Account ID.
          example: WCG-1-123abc456 or ACC-1234567
        category:
          type: string
          description: Category of the incident.
          example: malware
        type:
          type: string
          description: Specific type of incident within an incident category.
          example: Panda.SpywareB.TestFile
        timestamp:
          type: string
          description: Date and time the incident was created.
          example: 2023-03-02T18:52:20Z
        threatScore:
          type: integer
          description: Threat score of incident.
          example: 5
        severity:
          type: string
          description: The severity of the incident. Possible values are Low, Medium,
            High, and Critical.
          example: Medium
        description:
          type: string
          description: A description of the incident.
          example:
        remediated:
          type: boolean
          description: Remediation status of the incident.
          example: false
        entities:
          type: object
          description: Details of the entity that the incident belongs to.
          properties:
            8ed6cbce746d4597A6469bbc0c4edce9:
              type: object
              description: Entity data.
              properties:
                type:
                  type: string
                  description: Type of entity.
                  example: endpoint
                recommendedActions:
                  type: array
                  description: List of recommended actions.
                  items:
                    type: object
                    properties:
                      command:
                        type: string
                        description: Action to take.
                      parameters:
                        type: object
                        description: Parameters of an action.
                        properties:
                          md5:
                            type: string
                            description: The MD5 hash of the file or process associated
                              with the incident.
                  example:
                    - command: isolate
                    - command: quarantineFile
                      parameters:
                        md5: E76A3640348DC959CB4D87C81F27A1A1
                actionPerformed:
                  type: object
                  description: Information about an action that was performed at the
                    source in response to the event.
                  properties:
                    command:
                      type: string
                      description: Performed action.
                      example: deleteFile
                    parameters:
                      type: object
                      description: Parameters of an action.
                      properties:
                        md5:
                          type: string
                          description: The MD5 hash of the file or process associated
                            with the incident.
                          example: E76A3640348DC959CB4D87C81F27A1A1
                threatDetails:
                  type: object
                  description: Threat details of an incident.
                  properties:
                    malware:
                      type: string
                      description: The name of the malware associated with the incident.
                      example: Panda.SpywareB.TestFile
                    file:
                      type: string
                      description: The local path of a file on the computer associated
                        with the incident.
                      example: DESKTOPDIRECTORY|\\WESS tools\\malware\\Spy.EXE
                    md5:
                      type: string
                      description: The MD5 hash of the file or process associated
                        with the incident.
                      example: E76A3640348DC959CB4D87C81F27A1A1
        entityIds:
          type: array
          items:
            type: string
          example:
            - 8ed6cbce-746d-4597-a646-9bbc0c4edce9
        status:
          type: string
          description: |
            Specifies the status of the incident. This can be one of these values:
              - new - New incidents not yet reviewed.
              - read - Reviewed incidents or incidents marked as read.
              - closed - Incidents closed by an automation policy or manually closed.
          example: closed
        lastUpdateTime:
          type: string
          description: The date and time (in UTC) when the incident status was last
            changed.
          example: 2023-09-27T06:21:43Z
        updatedBy:
          type: string
          description: The name of the operator that updated the incident status.
            Or "system" if the update was in response to an automated action.
          example: ffc1c30697abdc4e_rw_id
    action:
      type: object
      description: Action information.
      properties:
        id:
          type: string
          description: ID of an action.
          example: cd08f4a339fb40feb4ee69314cdb1f8c
        account:
          type: string
          description: Account ID.
          example: WCG-1-123abc456 or ACC-1234567
        entityId:
          type: string
          description: ID of the entity.
          example: 96
        entityType:
          type: string
          description: The type of entity.
          example: firebox
        parameters:
          type: object
          description: Parameters required to perform the action. These depend on
            the specified action.
          properties:
            address:
              type: string
              description: The IP address to block.
              example: 3.3.3.3
        irreversible:
          type: boolean
          description: Indicates whether the action is reversible.
          example: false
        type:
          type: string
          description: Identifies whether an action was performed manually or through
            an automation policy.
          example: manual
        responder:
          type: string
          description: Indicates whether the action was initiated at the source, initiated
            manually, or initiated by an automation policy.
          example: System
        creationTime:
          type: string
          description: The time the action was created.
          example: 2023-09-27T06:44:34Z
        command:
          type: string
          description: The name of the action performed.
          example: blockAddress
        lastUpdateTime:
          type: string
          description: Last updated time of the action.
          example: 2023-09-27T06:44:34Z
        initiatedBy:
          type: string
          description: The name of the operator who initiated the action.
          example: ffc1c30697abdc4e_rw_id
    actionWithIncidentId:
      allOf:
        - $ref: '#/components/schemas/action'
        - type: object
          properties:
            incidentId:
              type: string
              description: ID of an incident.
              example: ch3hmad3u2h464hfedi0
    actionWithoutIncidentId:
      allOf:
        - $ref: '#/components/schemas/action'
        - type: object
          properties:
            incidentId:
              type: string
              description: ID of an incident.
              example:
    actionInProgress:
      allOf:
        - type: object
          properties:
            errorMessage:
              type: string
              description: Describes the reason the action failed.
              example:
        - type: object
          properties:
            status:
              type: string
              description: Status of the action.
              example: inProgress
        - type: object
          properties:
            history:
              type: array
              items:
                type: object
                properties:
                  lastUpdateTime:
                    type: string
                    description: Last updated time of the action.
                    example: 2023-09-27T06:44:34Z
                  status:
                    type: string
                    description: Status of the action.
                    example: inProgress
    actionPerformed:
      allOf:
        - type: object
          properties:
            errorMessage:
              type: string
              description: Describes the reason the action failed.
              example: ''
        - type: object
          properties:
            status:
              type: string
              description: Status of the action.
              example: performed
        - type: object
          properties:
            history:
              type: array
              description: History of the action.
              items:
                type: object
                properties:
                  errorMessage:
                    type: string
                    description: Describes the reason the action failed.
                  lastUpdateTime:
                    type: string
                    description: Last updated time of the action.
                  status:
                    type: string
                    description: Status of the action.
              example:
                - lastUpdateTime: 2023-09-27T06:44:34Z
                  status: inProgress
                - errorMessage: ''
                  lastUpdateTime: 2023-09-27T06:44:34Z
                  status: performed
        - type: object
          properties:
            result:
              type: object
              description: Result of the action.
              properties:
                status:
                  type: string
                  description: Status of the action.
                  example: performed
    actionWithIncidentIdInProgress:
      allOf:
        - $ref: '#/components/schemas/actionWithIncidentId'
        - $ref: '#/components/schemas/actionInProgress'
    actionWithIncidentIdPerformed:
      allOf:
        - $ref: '#/components/schemas/actionWithIncidentId'
        - $ref: '#/components/schemas/actionPerformed'
    actionWithoutIncidentIdInProgress:
      allOf:
        - $ref: '#/components/schemas/actionWithoutIncidentId'
        - $ref: '#/components/schemas/actionInProgress'
    incidentWithActions:
      allOf:
        - $ref: '#/components/schemas/incident'
        - $ref: '#/components/schemas/action'
    incidentWithComments:
      allOf:
        - $ref: '#/components/schemas/incident'
        - type: object
          properties:
            comments:
              type: array
              description: List of comments.
              items:
                oneOf:
                  - $ref: '#/components/schemas/comment'
                  - $ref: '#/components/schemas/updatedComment'
                  - $ref: '#/components/schemas/commentWithIncidentTransition'
                  - $ref: '#/components/schemas/commentWithActionTransition'
    checkHealth:
      type: object
      description: HealthCheck response.
      properties:
        healthy:
          type: boolean
          description: Indicates whether the service is OK.
          default: false
          example: true
    fetchIncidents:
      type: object
      description: Get incident response.
      properties:
        items:
          type: array
          description: List of incidents.
          items:
            oneOf:
              - $ref: '#/components/schemas/incident'
              - $ref: '#/components/schemas/incidentWithActions'
              - $ref: '#/components/schemas/incidentWithComments'
        count:
          type: integer
          description: Total count of incidents.
          example: 1
    fetchIncident:
      $ref: '#/components/schemas/incident'
    updateIncident:
      $ref: '#/components/schemas/incident'
    createAction:
      $ref: '#/components/schemas/actionWithoutIncidentIdInProgress'
    fetchActions:
      type: object
      description: Get actions for an incident.
      properties:
        items:
          type: array
          description: List of actions.
          items:
            $ref: '#/components/schemas/actionWithIncidentIdPerformed'
        count:
          type: integer
          description: Total count of actions.
          example: 1
    fetchActionsForIncident:
      type: object
      description: Get actions for a specific incident.
      properties:
        items:
          type: array
          description: List of actions.
          items:
            $ref: '#/components/schemas/actionWithIncidentIdPerformed'
        count:
          type: integer
          description: Total count of actions.
          example: 1
    createActionForIncident:
      $ref: '#/components/schemas/actionWithIncidentIdInProgress'
    fetchActionForIncident:
      $ref: '#/components/schemas/actionWithIncidentIdPerformed'
    transact:
      type: array
      description: Transaction response.
      items:
        oneOf:
          - $ref: '#/components/schemas/actionWithIncidentIdInProgress'
          - $ref: '#/components/schemas/actionWithoutIncidentIdInProgress'
          - $ref: '#/components/schemas/incident'
    comment:
      type: object
      description: Create a comment for a specific incident.
      properties:
        id:
          type: string
          description: ID of a comment.
          example: 903b824302b4419cac6ac4b0ead6719d
        incidentId:
          type: string
          description: ID of an incident.
          example: cq7m4paoksm0rb2o46ag
        account:
          type: string
          description: Account ID.
          example: WCG-1-123abc456 or ACC-1234567
        user:
          type: string
          description: User name.
          example: xdradmin
        comment:
          type: string
          description: The comment added to the specified incident.
          example: sample comment
        creationTime:
          type: string
          description: The time the comment was created.
          example: 2023-09-27T06:44:34Z
    updatedComment:
      oneOf:
        - $ref: '#/components/schemas/comment'
        - $ref: '#/components/schemas/commentWithActionTransition'
        - $ref: '#/components/schemas/commentWithIncidentTransition'
        - type: object
          properties:
            lastUpdateTime:
              type: string
              description: Last updated time of the comment.
              example: 2023-09-27T06:44:34Z
    commentWithActionTransition:
      allOf:
        - $ref: '#/components/schemas/comment'
        - type: object
          properties:
            command:
              type: string
              description: The action that was created.
              example: blockAddress
            actionId:
              type: string
              description: ID of an Action.
              example: 6a53f515f5994e0983df9e47444c1fc7
            context:
              type: string
              description: Context type whether an incident status is updated or a
                new action is created.
              example: action
    commentWithIncidentTransition:
      allOf:
        - $ref: '#/components/schemas/comment'
        - type: object
          properties:
            newStatus:
              type: string
              description: New incident status.
              example: new
            context:
              type: string
              description: Context type whether an incident status is updated or a
                new action is created.
              example: statusChange
    createComment:
      $ref: '#/components/schemas/comment'
    updateComment:
      $ref: '#/components/schemas/updatedComment'
    fetchComments:
      type: object
      description: Get comments for an incident.
      properties:
        items:
          type: array
          description: List of comments.
          items:
            oneOf:
              - $ref: '#/components/schemas/comment'
              - $ref: '#/components/schemas/updatedComment'
              - $ref: '#/components/schemas/commentWithIncidentTransition'
              - $ref: '#/components/schemas/commentWithActionTransition'
        count:
          type: integer
          description: Total count of actions.
          example: 1
    error:
      type: object
      description: Error response.
      properties:
        message:
          type: string
          description: Error message.
          example: Invalid request
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: WatchGuard-API-Key
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
servers:
  - url: https://api.usa.cloud.watchguard.com/rest/threatsync/management
    description: Prod USA Region
  - url: https://api.deu.cloud.watchguard.com/rest/threatsync/management
    description: Prod DEU region
  - url: https://api.jpn.cloud.watchguard.com/rest/threatsync/management
    description: Prod JPN region
security:
  - ApiKeyAuth: []
    BearerAuth: []
externalDocs:
  description: Additional documentation
  url: https://www.watchguard.com/help/docs/api/Content/en-US/home.html
