# Connector API The Synqly Connector APIs provide a unifying interface and data model for all supported service Providers. See the [Synqly Overview](/guides/getting-started/overview) for more information. ## Servers Synqly ``` https://api.synqly.com ``` ## Security ### BearerAuth Type: http Scheme: bearer ## Download OpenAPI description [Connector API](https://docs.synqly.com/_bundle/api-reference/connectors.yaml) ## Application Security (Pre-Release) {% admonition type="info" name="Pre-Release" %} This feature is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this feature. {% /admonition %} ### Query Applications - [GET /v1/app-sec/applications](https://docs.synqly.com/api-reference/connectors/appsec/appsec_query_applications.md): {% admonition type="info" name="Pre-Release" %} This operation is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this operation. {% /admonition %} Returns a list of applications matching the query from a the token-linked application security integration. Operation ID: appsec_query_applications ### Query Application Findings - [GET /v1/app-sec/applications/{applicationId}/findings](https://docs.synqly.com/api-reference/connectors/appsec/appsec_query_application_findings.md): {% admonition type="info" name="Pre-Release" %} This operation is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this operation. {% /admonition %} Returns a list of an application's findings matching {applictionId} and the query from a the token-linked application security integration. Operation ID: appsec_query_application_findings ### Query findings across all applications - [GET /v1/app-sec/findings](https://docs.synqly.com/api-reference/connectors/appsec/appsec_query_findings.md): {% admonition type="info" name="Pre-Release" %} This operation is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this operation. {% /admonition %} Returns a list of each findings details combined with the application details for all applications in the token-linked application security integration. This API may perform multiple provider API calls per executation so can be slower to respond. Operation ID: appsec_query_findings ### Get Application Finding Details - [GET /v1/app-sec/applications/{applicationId}/findings/{findingId}](https://docs.synqly.com/api-reference/connectors/appsec/appsec_get_application_finding_details.md): {% admonition type="info" name="Pre-Release" %} This operation is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this operation. {% /admonition %} Returns the details of the finding matching {findingId} where the finding belongs to the application matching {applicationId} from the token-linked application security integration. Operation ID: appsec_get_application_finding_details ## Assets ### Query Devices - [GET /v1/assets/devices](https://docs.synqly.com/api-reference/connectors/assets/assets_query_devices.md): Query devices from an asset inventory system Operation ID: assets_query_devices ### Create Device - [POST /v1/assets/devices](https://docs.synqly.com/api-reference/connectors/assets/assets_create_asset.md): Creates a Device object in the token-linked Integration. Operation ID: assets_create_asset ### Create Devices - [POST /v1/assets/devices/bulk](https://docs.synqly.com/api-reference/connectors/assets/assets_create_devices.md): Bulk create devices in an device inventory system Operation ID: assets_create_devices ### Get Labels - [GET /v1/assets/labels](https://docs.synqly.com/api-reference/connectors/assets/assets_get_labels.md): Get labels from an asset inventory system Operation ID: assets_get_labels ### Query Software Inventory - [GET /v1/assets/software](https://docs.synqly.com/api-reference/connectors/assets/assets_query_software.md): Query software inventory records from an asset management system Operation ID: assets_query_software ### Create Software Inventory - [POST /v1/assets/software](https://docs.synqly.com/api-reference/connectors/assets/assets_create_software.md): Creates a software inventory record in the token-linked Integration. Operation ID: assets_create_software ### Bulk Update Device Properties - [POST /v1/assets/devices/bulk-properties](https://docs.synqly.com/api-reference/connectors/assets/assets_update_device_properties.md): Set custom properties on devices by MAC address (Armis V3 bulk). Creates custom properties if needed. Operation ID: assets_update_device_properties ### Query Alerts - [GET /v1/assets/alerts](https://docs.synqly.com/api-reference/connectors/assets/assets_query_alerts.md): Query alerts from an asset inventory system Operation ID: assets_query_alerts ### Query Vulnerabilities - [GET /v1/assets/vulnerabilities](https://docs.synqly.com/api-reference/connectors/assets/assets_query_vulnerabilities.md): Query vulnerabilities from an asset inventory system Operation ID: assets_query_vulnerabilities ### Query Utilization - [GET /v1/assets/utilization](https://docs.synqly.com/api-reference/connectors/assets/assets_query_utilization.md): Query utilization from an asset inventory system Operation ID: assets_query_utilization ## Chat ### Query Users - [GET /v1/chat/users](https://docs.synqly.com/api-reference/connectors/chat/chat_query_users.md): Returns a list of users in the connected workspace or tenant. Used to discover whose conversations can be queried. Operation ID: chat_query_users ### Query User Conversations - [GET /v1/chat/users/{userId}/conversations](https://docs.synqly.com/api-reference/connectors/chat/chat_query_user_conversations.md): Returns a list of conversations scoped to a specific user — DMs, group chats, or (for AI providers) synthesised sessions. Operation ID: chat_query_user_conversations ### Query User Conversation Members - [GET /v1/chat/users/{userId}/conversations/{conversationId}/members](https://docs.synqly.com/api-reference/connectors/chat/chat_query_user_conversation_members.md): Returns the members of a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions). Operation ID: chat_query_user_conversation_members ### Query User Conversation Messages - [GET /v1/chat/users/{userId}/conversations/{conversationId}/messages](https://docs.synqly.com/api-reference/connectors/chat/chat_query_user_conversation_messages.md): Returns messages from a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions). Operation ID: chat_query_user_conversation_messages ### Query Conversations - [GET /v1/chat/conversations](https://docs.synqly.com/api-reference/connectors/chat/chat_query_conversations.md): Returns a list of conversations (channels or workspaces) not scoped to a specific user. Providers that can only enumerate conversations per-user return NotImplemented; use query_user_conversations instead. Operation ID: chat_query_conversations ### Query Conversation Members - [GET /v1/chat/conversations/{conversationId}/members](https://docs.synqly.com/api-reference/connectors/chat/chat_query_conversation_members.md): Returns the members of a specific conversation. Use the user-scoped variant (query_user_conversation_members) for chats that only exist in a user's mailbox (e.g. Teams 1:1 chats). Operation ID: chat_query_conversation_members ### Query Conversation Messages - [GET /v1/chat/conversations/{conversationId}/messages](https://docs.synqly.com/api-reference/connectors/chat/chat_query_conversation_messages.md): Returns messages from a specific conversation. The conversationId must be obtained from query_conversations or query_user_conversations. Use the user-scoped variant (query_user_conversation_messages) for chats that only exist in a user's mailbox. Operation ID: chat_query_conversation_messages ## Cloud Security (In Development) {% admonition type="warning" name="In Development" %} This feature is actively being developed. Breaking changes should be expected. Please contact us before using this feature. {% /admonition %} ### Query Events - [GET /v1/cloudsecurity/events](https://docs.synqly.com/api-reference/connectors/cloudsecurity/cloudsecurity_query_events.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of events that match the query from the cloud security provider. Operation ID: cloudsecurity_query_events ### Query IOMs - [GET /v1/cloudsecurity/ioms](https://docs.synqly.com/api-reference/connectors/cloudsecurity/cloudsecurity_query_ioms.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of Indicators of Misconfiguration (IOM) findings that match the query from the cloud security provider. Operation ID: cloudsecurity_query_ioms ### Query Cloud Resource Inventory - [GET /v1/cloudsecurity/cloudresourcesinventory](https://docs.synqly.com/api-reference/connectors/cloudsecurity/cloudsecurity_query_cloud_resource_inventory.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of cloud resources that match the query from the cloud security provider. Operation ID: cloudsecurity_query_cloud_resource_inventory ### Query Compliance Findings - [GET /v1/cloudsecurity/compliancefindings](https://docs.synqly.com/api-reference/connectors/cloudsecurity/cloudsecurity_query_compliance_findings.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of compliance findings matching the query from the cloud security provider. Operation ID: cloudsecurity_query_compliance_findings ### Query Threats - [GET /v1/cloudsecurity/threats](https://docs.synqly.com/api-reference/connectors/cloudsecurity/cloudsecurity_query_threats.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of threat detections that match the query from the cloud security provider. Operation ID: cloudsecurity_query_threats ## Endpoint Detection & Response (EDR) ### Query Endpoints - [GET /v1/edr/endpoints](https://docs.synqly.com/api-reference/connectors/edr/edr_query_endpoints.md): Returns a list of endpoint assets matching the query from the token-linked EDR source. Operation ID: edr_query_endpoints ### Get Endpoint - [GET /v1/edr/endpoints/{id}](https://docs.synqly.com/api-reference/connectors/edr/edr_get_endpoint.md): Gets a single endpoint assets matching the UID from the token-linked EDR source. Operation ID: edr_get_endpoint ### Execute Command - [POST /v1/edr/endpoints/{uid}/actions/execute-command](https://docs.synqly.com/api-reference/connectors/edr/edr_execute_command.md): Runs a provider-backed command on the endpoint identified by {uid} and returns normalized stdout and stderr without exposing provider session details. Operation ID: edr_execute_command ### Retrieve File - [POST /v1/edr/endpoints/{uid}/actions/retrieve-file](https://docs.synqly.com/api-reference/connectors/edr/edr_retrieve_file.md): Retrieves a file from the endpoint identified by {uid} and returns the provider artifact as a binary file response. Operation ID: edr_retrieve_file ### Query Applications - [GET /v1/edr/applications](https://docs.synqly.com/api-reference/connectors/edr/edr_query_applications.md): Returns a list of applications matching the query from the token-linked EDR source. Operation ID: edr_query_applications ### Quarantine Endpoints - [POST /v1/edr/endpoints/actions/quarantine](https://docs.synqly.com/api-reference/connectors/edr/edr_network_quarantine.md): Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections. Operation ID: edr_network_quarantine ### Query Threat Events - [GET /v1/edr/threats](https://docs.synqly.com/api-reference/connectors/edr/edr_query_threatevents.md): Returns a list of threats that match the query from the token-linked EDR source. Operation ID: edr_query_threatevents ### Query Alerts - [GET /v1/edr/alerts](https://docs.synqly.com/api-reference/connectors/edr/edr_query_alerts.md): Returns a list of alerts that match the query from the token-linked EDR source. Operation ID: edr_query_alerts ### Query IOCs - [GET /v1/edr/iocs](https://docs.synqly.com/api-reference/connectors/edr/edr_query_iocs.md): Returns a list of iocs that match the query from the token-linked EDR source. Operation ID: edr_query_iocs ### Create IOCs - [POST /v1/edr/iocs](https://docs.synqly.com/api-reference/connectors/edr/edr_create_iocs.md): Creates a list of iocs that match the stix input for the EDR source. Operation ID: edr_create_iocs ### Delete IOCs - [DELETE /v1/edr/iocs](https://docs.synqly.com/api-reference/connectors/edr/edr_delete_iocs.md): Deletes a list of iocs that match the input of ids in the query param Operation ID: edr_delete_iocs ### Query Posture Score - [GET /v1/edr/posture_score](https://docs.synqly.com/api-reference/connectors/edr/edr_query_posture_score.md): Returns the posture score of the endpoint assets that match the query from the token-linked EDR source. Operation ID: edr_query_posture_score ### Query EDR Events - [GET /v1/edr/edr_events](https://docs.synqly.com/api-reference/connectors/edr/edr_query_edr_events.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of EDR events that match the query from the token-linked EDR source. Operation ID: edr_query_edr_events ### Get Threat Notes - [GET /v1/edr/threats/{threatId}/notes](https://docs.synqly.com/api-reference/connectors/edr/edr_get_threat_notes.md): Returns a list of notes for a threat. Operation ID: edr_get_threat_notes ### Create Threat Note - [POST /v1/edr/threats/{threatId}/notes](https://docs.synqly.com/api-reference/connectors/edr/edr_create_threat_note.md): Creates a note for a threat. Operation ID: edr_create_threat_note ## Email Security (In Development) {% admonition type="warning" name="In Development" %} This feature is actively being developed. Breaking changes should be expected. Please contact us before using this feature. {% /admonition %} ### Query Threats - [GET /v1/email-security/threats](https://docs.synqly.com/api-reference/connectors/emailsecurity/emailsecurity_query_threats.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of threats matching the query from the token-linked Email Security provider. Defaults to the last 30 days of threats. This can be overridden by using the time filter. Note that some providers may have a maximum time range limit. A threat is an automated detection that was deemed to be a threat by the Email Security provider. Operation ID: emailsecurity_query_threats ### Get Threat Details - [GET /v1/email-security/threats/{threatId}](https://docs.synqly.com/api-reference/connectors/emailsecurity/emailsecurity_get_threat_details.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns the details of the threat matching {threatId} from the token-linked Email Security provider. If a provider allows for the gathering of more detailed information about a threat, the response will include the additional information. Otherwise, the response will only include the basic information about the threat returned by the query_threats endpoint. Operation ID: emailsecurity_get_threat_details ### Query Email Events - [GET /v1/email-security/email-events](https://docs.synqly.com/api-reference/connectors/emailsecurity/emailsecurity_query_email_events.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of email events matching the query from the token-linked Email Security provider. Defaults to the last 30 days of email events. This can be overridden by using the time filter. Note that some providers may have a maximum time range limit. Operation ID: emailsecurity_query_email_events ## Endpoint Management ### Query Devices - [GET /v1/endpoint-management/devices](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_query_devices.md): Returns a list of managed devices matching the query from the token-linked endpoint management source. Operation ID: endpointmanagement_query_devices ### Get Device - [GET /v1/endpoint-management/devices/{id}](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_get_device.md): Gets a single managed device matching the ID from the token-linked endpoint management source. Operation ID: endpointmanagement_get_device ### Query Device Compliance - [GET /v1/endpoint-management/compliance](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_query_compliance_findings.md): Returns a list of device compliance findings matching the query from the token-linked endpoint management source. Operation ID: endpointmanagement_query_compliance_findings ### Remediate Device - [POST /v1/endpoint-management/devices/actions/remediate](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_remediate_device.md): Performs a remediation action on a managed device from the token-linked endpoint management source. Operation ID: endpointmanagement_remediate_device ### Update Device - [POST /v1/endpoint-management/devices/actions/update](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_update_device.md): Triggers the device to check in and enforce all assigned policies, profiles, and pending updates. Operation ID: endpointmanagement_update_device ### Lock Device - [POST /v1/endpoint-management/devices/actions/lock](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_lock_device.md): Remotely locks the device screen. Operation ID: endpointmanagement_lock_device ### Restart Device - [POST /v1/endpoint-management/devices/actions/restart](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_restart_device.md): Remotely reboots the device. Operation ID: endpointmanagement_restart_device ### Wipe Device - [POST /v1/endpoint-management/devices/actions/wipe](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_wipe_device.md): Factory resets or erases all data from the device. Operation ID: endpointmanagement_wipe_device ### Query Device Applications - [GET /v1/endpoint-management/devices/{id}/applications](https://docs.synqly.com/api-reference/connectors/endpointmanagement/endpointmanagement_query_device_applications.md): Returns a list of applications installed on a managed device from the token-linked endpoint management source. Operation ID: endpointmanagement_query_device_applications ## Hooks ### Proxy Webhook - [POST /v1/hooks](https://docs.synqly.com/api-reference/connectors/hooks/hooks_proxy.md): Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in that context, not a standalone implementation. Operation ID: hooks_proxy ### Open Proxy Webhook - [POST /v1/hooks/passthrough/{webHookCursor}](https://docs.synqly.com/api-reference/connectors/hooks/hooks_passthrough.md): Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in that context, not a standalone implementation. Operation ID: hooks_passthrough ## Identity ### Query Audit Log - [GET /v1/identity/audit](https://docs.synqly.com/api-reference/connectors/identity/identity_query_audit_log.md): Returns a list of Event objects from the token-linked audit log. Operation ID: identity_query_audit_log ### Query Risk Events - [GET /v1/identity/risk-events](https://docs.synqly.com/api-reference/connectors/identity/identity_query_risk_events.md): Returns identity threat / risk events (for example Microsoft Entra Identity Protection risk detections for users), normalized to OCSF. Operation ID: identity_query_risk_events ### Query Risky Users - [GET /v1/identity/risky-users](https://docs.synqly.com/api-reference/connectors/identity/identity_query_risky_users.md): Returns rolled-up risky user records (for example Microsoft Entra Identity Protection riskyUsers), each normalized to an OCSF Entity Management Read event. Operation ID: identity_query_risky_users ### Query Users - [GET /v1/identity/users](https://docs.synqly.com/api-reference/connectors/identity/identity_query_users.md): Returns a list of User objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider. Operation ID: identity_query_users ### Get User - [GET /v1/identity/users/{userId}](https://docs.synqly.com/api-reference/connectors/identity/identity_get_user.md): Returns a User object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending on the providers offerings, this may include additional user information, such as the user's current groups, roles, and Identity Protection risk state (when the provider exposes it and the user has a risk record). Operation ID: identity_get_user ### Query Groups - [GET /v1/identity/groups](https://docs.synqly.com/api-reference/connectors/identity/identity_query_groups.md): Returns a list of Group objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider. Operation ID: identity_query_groups ### Get Group - [GET /v1/identity/groups/{groupId}](https://docs.synqly.com/api-reference/connectors/identity/identity_get_group.md): Returns a Group object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending on the providers offerings, this may include additional group information, such as the roles assigned. Operation ID: identity_get_group ### Get Group Members - [GET /v1/identity/groups/{groupId}/members](https://docs.synqly.com/api-reference/connectors/identity/identity_get_group_members.md): Returns list of User objects wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider that are members in the group referenced by ID. Operation ID: identity_get_group_members ### Enable User - [POST /v1/identity/users/{userId}/actions/enable](https://docs.synqly.com/api-reference/connectors/identity/identity_enable_user.md): Reenables a disabled user in the identity system based on user ID. Operation ID: identity_enable_user ### Disable User - [POST /v1/identity/users/{userId}/actions/disable](https://docs.synqly.com/api-reference/connectors/identity/identity_disable_user.md): Disables a user in the identity system based on user ID. Operation ID: identity_disable_user ### Force User Password Reset - [POST /v1/identity/users/{userId}/actions/force_reset_password](https://docs.synqly.com/api-reference/connectors/identity/identity_force_user_password_reset.md): Forces a user to reset their password before they can log in again. Operation ID: identity_force_user_password_reset ### Expire All User Sessions - [POST /v1/identity/users/{userId}/actions/expire_all_sessions](https://docs.synqly.com/api-reference/connectors/identity/identity_expire_all_user_sessions.md): Logs a user out of all current sessions so they must log in again. Operation ID: identity_expire_all_user_sessions ### Get User Picture - [GET /v1/identity/users/{userId}/picture](https://docs.synqly.com/api-reference/connectors/identity/identity_get_user_picture.md): {% admonition type="info" name="Pre-Release" %} This operation is available for testing but may be unstable. Breaking changes are unlikely but may still be necessary. Please contact us before using this operation. {% /admonition %} Returns the profile picture for a user as binary image data. The Content-Type header indicates the image format (e.g., image/jpeg, image/png). Operation ID: identity_get_user_picture ## Incident Response (In Development) {% admonition type="warning" name="In Development" %} This feature is actively being developed. Breaking changes should be expected. Please contact us before using this feature. {% /admonition %} ### Query Escalation Policies - [GET /v1/incident-response/escalation-policies](https://docs.synqly.com/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policies.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of incident response escalation policies. Operation ID: incidentresponse_query_escalation_policies ### Query Escalation Policy Users On Call - [GET /v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call](https://docs.synqly.com/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policy_users_on_call.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns a list of users that are currently on call for an incident response escalation policy. Operation ID: incidentresponse_query_escalation_policy_users_on_call ## Integration Webhooks ### Create Integration WebHook Configuration - [POST /v1/integration-webhooks](https://docs.synqly.com/api-reference/connectors/integrationwebhooks/integrationwebhooks_create_webhook.md): Creates a WebHook for the token-linked Integration. Operation ID: integrationWebhooks_create_webhook ### Delete Integration WebHook Configuration - [DELETE /v1/integration-webhooks](https://docs.synqly.com/api-reference/connectors/integrationwebhooks/integrationwebhooks_delete_webhook.md): Deletes the WebHook matching the token-linked Integration. Operation ID: integrationWebhooks_delete_webhook ### List Integration WebHook Configurations - [GET /v1/integration-webhooks](https://docs.synqly.com/api-reference/connectors/integrationwebhooks/integrationwebhooks_list_webhooks.md): Lists all WebHooks from the token-linked Integration. Operation ID: integrationWebhooks_list_webhooks ## Notifications ### Get Notification - [GET /v1/notifications/get/{notificationId}](https://docs.synqly.com/api-reference/connectors/notifications/notifications_get_message.md): Returns the Notification object matching {notificationId} from the token-linked Integration. Operation ID: notifications_get_message ### Create Notification - [POST /v1/notifications/create](https://docs.synqly.com/api-reference/connectors/notifications/notifications_create_message.md): Creates a Notification object in the token-linked Integration. Operation ID: notifications_create_message ### Clear Notification - [POST /v1/notifications/clear/{notificationId}](https://docs.synqly.com/api-reference/connectors/notifications/notifications_clear_message.md): Resolves a Notification object in the token-linked Integration. Operation ID: notifications_clear_message ## Operations (In Development) {% admonition type="warning" name="In Development" %} This feature is actively being developed. Breaking changes should be expected. Please contact us before using this feature. {% /admonition %} ### Get Asynchronous Operation state - [GET /v1/operations/{operationId}](https://docs.synqly.com/api-reference/connectors/operations/operations_get.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Returns the Asynchronous Operation object matching {operationId}. Operation ID: operations_get ### Cancel Asynchronous Operation - [POST /v1/operations/{operationId}](https://docs.synqly.com/api-reference/connectors/operations/operations_cancel.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Cancels the Asynchronous Operation matching {operationId}. Operation ID: operations_cancel ### Create Asynchronous Operation - [POST /v1/operations](https://docs.synqly.com/api-reference/connectors/operations/operations_create.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Creates an Asynchronous Operation object. Operation ID: operations_create ## Security Information & Event Management (SIEM) ### Query Investigations - [GET /v1/siem/investigations](https://docs.synqly.com/api-reference/connectors/siem/siem_query_investigations.md): Queries investigations Operation ID: siem_query_investigations ### Get Investigation - [GET /v1/siem/investigations/{id}](https://docs.synqly.com/api-reference/connectors/siem/siem_get_investigation.md): Retrieves an investigation by ID. Operation ID: siem_get_investigation ### Patch Investigation - [PATCH /v1/siem/investigations/{id}](https://docs.synqly.com/api-reference/connectors/siem/siem_patch_investigation.md): Updates an investigation by ID. Operation ID: siem_patch_investigation ### Get Evidence - [GET /v1/siem/investigations/{id}/evidence](https://docs.synqly.com/api-reference/connectors/siem/siem_get_evidence.md): Retrieves the evidence for an investigation. Operation ID: siem_get_evidence ### Query Log Providers - [GET /v1/siem/log-providers](https://docs.synqly.com/api-reference/connectors/siem/siem_query_log_providers.md): Queries available log providers in the source SIEM Operation ID: siem_query_log_providers ### Post Events - [POST /v1/siem/events](https://docs.synqly.com/api-reference/connectors/siem/siem_post_events.md): Writes a batch of Event objects to the SIEM configured with the token used for authentication. Operation ID: siem_post_events ### Query Events - [GET /v1/siem/events](https://docs.synqly.com/api-reference/connectors/siem/siem_query_events.md): Queries events from the SIEM configured with the token used for authentication. Operation ID: siem_query_events ### Query Alerts - [GET /v1/siem/alerts](https://docs.synqly.com/api-reference/connectors/siem/siem_query_alerts.md): Queries alerts from the SIEM configured with the token used for authentication. Operation ID: siem_query_alerts ### Get Alert - [GET /v1/siem/alerts/{id}](https://docs.synqly.com/api-reference/connectors/siem/siem_get_alert.md): Retrieves an alert by ID. Operation ID: siem_get_alert ## Sink ### Post Events - [POST /v1/sink/events](https://docs.synqly.com/api-reference/connectors/sink/sink_post_events.md): Writes a batch of Event objects to the Sink configured with the token used for authentication. Operation ID: sink_post_events ## Storage ### List Files - [GET /v1/storage/folders/{path}](https://docs.synqly.com/api-reference/connectors/storage/storage_list_files.md): Returns a list of contents from the token-linked Integration. Operation ID: storage_list_files ### Upload File - [POST /v1/storage/files/{path}](https://docs.synqly.com/api-reference/connectors/storage/storage_upload_file.md): Uploads a file from the provided {path} to the token-linked Integration. Operation ID: storage_upload_file ### Download File - [GET /v1/storage/files/{path}](https://docs.synqly.com/api-reference/connectors/storage/storage_download_file.md): Downloads a file from the provided {path} in the token-linked Integration. Operation ID: storage_download_file ### Delete File - [DELETE /v1/storage/files/{path}](https://docs.synqly.com/api-reference/connectors/storage/storage_delete_file.md): Deletes a file from the provided {path} in the token-linked Integration. Operation ID: storage_delete_file ## Ticketing ### List Remote Fields - [GET /v1/ticketing/remote-fields](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_remote_fields.md): List all remote fields for all Projects in a ticketing integration. The response will include a list of fields for each issue type in the ticketing provider. Operation ID: ticketing_list_remote_fields ### List Projects - [GET /v1/ticketing/projects](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_projects.md): Returns a list of Projects from the token-linked Integration. Tickets must be created and retrieved within the context of a specific Project. Operation ID: ticketing_list_projects ### Query Tickets - [GET /v1/ticketing/tickets](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_query_tickets.md): Returns a list of Ticket objects from the token-linked Integration. Operation ID: ticketing_query_tickets ### Create Ticket - [POST /v1/ticketing/tickets](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_create_ticket.md): Creates a Ticket object in the token-linked Integration. Operation ID: ticketing_create_ticket ### Get Ticket - [GET /v1/ticketing/tickets/{ticketId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_get_ticket.md): Returns a Ticket object matching {ticketId} from the token-linked Integration. Operation ID: ticketing_get_ticket ### Patch Ticket - [PATCH /v1/ticketing/tickets/{ticketId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_patch_ticket.md): Updates the Ticket object matching {ticketId} in the token-linked Integration. Operation ID: ticketing_patch_ticket ### Create Attachment - [POST /v1/ticketing/attachments/{ticketId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_create_attachment.md): [beta: currently supported by Jira] Creates an Attachment for the ticket with id {ticketId} in the token-linked Integration. Operation ID: ticketing_create_attachment ### List Attachments Metadata - [GET /v1/ticketing/attachments/{ticketId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_attachments_metadata.md): [beta: currently supported by Jira] Returns metadata for all Attachments for a Ticket object matching {ticketId} from the token-linked Integration. Operation ID: ticketing_list_attachments_metadata ### Download Attachment - [GET /v1/ticketing/attachments/{ticketId}/{attachmentId}/download](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_download_attachment.md): [beta: currently supported by Jira] Downloads the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration. Operation ID: ticketing_download_attachment ### Delete Attachment - [DELETE /v1/ticketing/attachments/{ticketId}/{attachmentId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_delete_attachment.md): [beta: currently supported by Jira] Deletes the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration. Operation ID: ticketing_delete_attachment ### List Comments - [GET /v1/ticketing/tickets/{ticketId}/comments](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_comments.md): Lists all comments for the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_list_comments ### Create Comment - [POST /v1/ticketing/tickets/{ticketId}/comments](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_create_comment.md): Creates a comment on the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_create_comment ### Delete Comment - [DELETE /v1/ticketing/tickets/{ticketId}/comments/{commentId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_delete_comment.md): Deletes the comment matching {commentId} form the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_delete_comment ### Create Note - [POST /v1/ticketing/tickets/{ticketId}/notes](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_create_note.md): Creates a note on the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_create_note ### List Notes - [GET /v1/ticketing/tickets/{ticketId}/notes](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_notes.md): Lists all notes for the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_list_notes ### Delete Note - [DELETE /v1/ticketing/tickets/{ticketId}/notes/{noteId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_delete_note.md): Deletes the note matching {noteId} form the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_delete_note ### Patch Note - [PATCH /v1/ticketing/tickets/{ticketId}/notes/{noteId}](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_patch_note.md): Update a note matching {noteId} title and/or content on the ticket matching {ticketId} from the token-linked Integration. Operation ID: ticketing_patch_note ### Query Escalation Policies - [GET /v1/ticketing/escalation-policies](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_query_escalation_policies.md): Returns a list of escalation policies. Operation ID: ticketing_query_escalation_policies ### List On Call Agents - [GET /v1/ticketing/escalation-policies/{escalationPolicyId}/on-call](https://docs.synqly.com/api-reference/connectors/ticketing/ticketing_list_on_call.md): Returns a list of all on-call agents for an escalation policy. Operation ID: ticketing_list_on_call ## Vulnerabilities ### Query Findings - [GET /v1/vulnerabilities/findings](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_query_findings.md): Query vulnerability findings Operation ID: vulnerabilities_query_findings ### Create Findings - [POST /v1/vulnerabilities/findings/bulk](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_create_findings.md): Create findings (bulk) in a vulnerability scanning system Operation ID: vulnerabilities_create_findings ### Update Finding - [PUT /v1/vulnerabilities/findings/{findingId}](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_update_finding.md): update a finding in a vulnerability scanning system Operation ID: vulnerabilities_update_finding ### Query Assets - [GET /v1/vulnerabilities/assets](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_query_assets.md): Query assets in a vulnerability scanning system Operation ID: vulnerabilities_query_assets ### Create Asset - [POST /v1/vulnerabilities/assets](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_create_asset.md): Create assets in a vulnerability scanning system Operation ID: vulnerabilities_create_asset ### Update Asset - [PUT /v1/vulnerabilities/assets/{assetId}](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_update_asset.md): update an asset in a vulnerability scanning system Operation ID: vulnerabilities_update_asset ### Query Scans - [GET /v1/vulnerabilities/scans](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_query_scans.md): Query scans in a vulnerability scanning system Operation ID: vulnerabilities_query_scans ### Upload Scan - [POST /v1/vulnerabilities/scans](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_upload_scan.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Upload a scan in a vulnerability scanning system Operation ID: vulnerabilities_upload_scan ### Get Scan Activity - [GET /v1/vulnerabilities/scans/{scan_id}/activity](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activity.md): Deprecated: use GET /scans/{scan_id}/activities instead, which returns the full execution history for a scan definition. Operation ID: vulnerabilities_get_scan_activity ### Get Scan Activities - [GET /v1/vulnerabilities/scans/{scan_id}/activities](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activities.md): Get scan execution history for a configured scan. Returns one OCSF Scan Activity per execution (e.g. each Tenable.sc scan result for the given scan definition id). Operation ID: vulnerabilities_get_scan_activities ### Get Scan Status - [GET /v1/vulnerabilities/scans/{scan_id}/status](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_status.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Get the status of a upload scan Operation ID: vulnerabilities_get_scan_status ### Get Labels - [GET /v1/vulnerabilities/labels](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_get_labels.md): Get labels from an asset inventory system Operation ID: vulnerabilities_get_labels ### Query Scan Findings - [GET /v1/vulnerabilities/scans/{scanId}/findings](https://docs.synqly.com/api-reference/connectors/vulnerabilities/vulnerabilities_query_scan_findings.md): {% admonition type="warning" name="In Development" %} This operation is actively being developed. Breaking changes should be expected. Please contact us before using this operation. {% /admonition %} Query findings for a scan Operation ID: vulnerabilities_query_scan_findings