# Create Integration Point Create a IntegrationPoint object. Operation ID: integrationPoints_create Endpoint: POST /v1/integration-points Security: BearerAuth ## Request fields (application/json): - `connector` (string, required) Id of the Integrations category Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities" - `environments` (object, required) - `environments.test` (array,null) List of allowed providers for test environment. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "*" - `environments.prod` (array,null) List of allowed providers for production environment. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "*" - `name` (string,null) Unique short name for this Integration Point (lowercase [a-z0-9_-], can be used in URLs). Also used for case insensitive duplicate name detection and default sort order. Defaults to IntegrationPointId if both name and fullname are not specified. - `fullname` (string,null) Name of integration point, will be shown to end-users in the Connect UI. Defaults to the same value as the 'name' field if not specified. - `description` (string,null) Optional description of the Integration Point. Will not be displayed to end-users of Connect UI. - `mappings` (array,null) A list of mapping chains to apply to integrations using this integration point. Each mapping chain is a list of mappings to apply to the integration in the order they should be applied. Mappings are applied by operation ID. If an integration is created that declares its own mappings for an operation, they will override this list of mappings. Leave this empty to use the default default mappings. - `mappings.providers` (array, required) A list of provider ID strings that this mapping applies to. Mapping templates must have at least one provider. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "*" - `mappings.mappings` (array, required) A list of mapping IDs to apply in the format {mapping_id}:{version}. - `mappings.operation_ids` (array, required) The operation IDs to apply the mappings to. - `additional_mappings` (array,null) Additional data mappings for integrations added to this integration point. This allows for custom data to be mapped to the custom_fields portion of the response. - `additional_mappings.providers` (array, required) A list of provider ID strings that this mapping applies to. Mapping templates must have at least one provider. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "*" - `additional_mappings.resource` (string, required) Enum: "alerts", "applications", "audit_logs", "comments", "devices", "events", "evidence", "findings", "groups", "investigations", "iocs", "log_providers", "posture_scores", "projects", "scans", "scan_activities", "threats", "tickets", "users", "compliance", "cloudresourceinventory" - `additional_mappings.actions` (array, required) The actions that this mapping applies to. At least one action must be specified. Enum: "query", "read", "create", "update", "delete", "patch" - `additional_mappings.source` (string, required) The dot-separated path to the field in the source data coming from the provider. Use \. to escape literal dots in the field name. - `additional_mappings.destination` (string, required) The dot-separated path to where the data should reside in the custom fields object when data is returned from the provider. - `additional_mappings.data_type` (string, required) Enum: "string", "number", "datetime", "boolean", "array", "any" - `additional_mappings.mapping_type` (string) Enum: "recommended", "optional", "fixed" - `additional_mappings.literal` (boolean,null) When true, the value in 'source' is treated as a literal value rather than a mapping. This allows adding static values to custom fields. Default: false - `scheduled_operations` (array,null) A list of operations that are scheduled to run for this integration point. Whenever an integration is created, these operations will automatically be scheduled to run based on the schedule defined for the operation. - `scheduled_operations.operation` (string, required) Enum: "assets_query_devices", "assets_query_alerts", "assets_query_utilization", "assets_query_vulnerabilities", "cloudsecurity_query_cloud_resource_inventory", "cloudsecurity_query_compliance_findings", "cloudsecurity_query_events", "cloudsecurity_query_ioms", "cloudsecurity_query_threats", "edr_query_alerts", "edr_query_applications", "edr_query_endpoints", "edr_query_iocs", "edr_query_posture_score", "edr_query_threatevents", "identity_query_audit_log", "identity_query_groups", "identity_query_groups_enriched", "identity_query_users", "identity_query_users_enriched", "siem_query_events", "siem_query_investigations", "vulnerabilities_query_assets", "vulnerabilities_query_findings", "vulnerabilities_query_scans", "appsec_query_findings" - `scheduled_operations.enabled` (boolean, required) Whether the schedule is active. When false, no executions will occur. - `scheduled_operations.frequency` (any, required) - `scheduled_operations.filters` (array,null) Optional filters to apply when querying data from the source API. Format and available filters depend on the specific operation. Example: "severity[eq]critical" or "status[eq]active". - `scheduled_operations.backfill_from_time` (string,null) Starting point for the initial data collection. No data before this time will be fetched. Accepts: - RFC 3339 datetime: "2024-01-01T00:00:00Z" - Relative duration: "7d" (7 days ago), "24h" (24 hours ago), "30m" (30 minutes ago) - "max": Collect all available historical data If not specified, starts from the operation's creation time. - `scheduled_operations.incremental_config` (object) Controls how data is fetched from the source API on each execution. - `scheduled_operations.incremental_config.mode` (string, required) Strategy for fetching data from the source API. Enum: "incremental", "full_snapshot" - `scheduled_operations.incremental_config.time_filter_field` (string,null) Custom field to use for time-based filtering in incremental mode. Overrides the operation's default time filter field. Examples: "modified_time" or "finding.last_seen_time". The filter will use this field with "[gt]" (greater than) operator. First run will use initial_backfill_start_time as the filter value, and subsequent runs use the last execution time. ## Response 200 fields (application/json): - `result` (object, required) Enables creation, editing and deletion of Integrations. - `result.id` (string, required) - `result.connector` (string, required) Id of the Integrations category Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities" - `result.environments` (object, required) - `result.name` (string, required) Human-readable name for this resource - `result.created_at` (string, required) Time object was originally created - `result.updated_at` (string, required) Last time object was updated - `result.fullname` (string,null) Name of integration point, will be shown to end-users in the Connect UI. - `result.description` (string,null) Optional description of the Integration Point. Will not be displayed to end-users of Connect UI. - `result.mappings` (array,null) A list of mapping chains to apply to integrations using this integration point. Each mapping chain is a list of mappings to apply to the integration in the order they should be applied. Mappings are applied by operation ID. If an integration is created that declares its own mappings for an operation, they will override this list of mappings. Leave this empty to use the default default mappings. - `result.additional_mappings` (array,null) Additional data mappings for integrations added to this integration point. This allows for custom data to be mapped to the custom_fields portion of the response. - `result.scheduled_operations` (array,null) A list of operations that are scheduled to run for this integration point. Whenever an integration is created, these operations will automatically be scheduled to run based on the schedule defined for the operation. ## Response 400 fields (application/json): - `occurred_at` (string, required) The date and time the problem occurred. - `status` (integer, required) The HTTP status code of the problem. Matches the HTTP response code sent by the server. - `instance` (string, required) A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced. - `message` (string, required) A short, display-friendly summary of the problem. - `type` (string) A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type. - `cause` (array,null) A list of the root cause(s) for this problem occurrence. Includes at minimum one root cause, and is otherwise an unordered list of causes. - `cause.type` (string, required) A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type. - `cause.message` (string, required) A short, display-friendly summary of the problem. - `cause.detail` (string,null) A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem. - `cause.remediation` (string,null) A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible. - `cause.context` (object) - `cause.context.parameter` (object) - `cause.context.parameter.id` (string, required) If the location of the parameter is body, this value is always a JSON Pointer, otherwise it's the name of the parameter. - `cause.context.parameter.location` (string, required) Enum: "header", "path", "query", "body" - `cause.context.parameter.value` (any,null) The given value of the parameter. - `cause.context.resources` (array,null) - `cause.context.resources.type` (string, required) Enum: "account", "bridge", "credential", "integration_point", "integration", "member", "operation", "organization_webhook", "role", "sub_org", "token", "transform" - `cause.context.resources.id` (string, required) ID of the related resource. - `cause.context.resources.rel` (string, required) Enum: "affected", "cause" - `cause.context.raw_error` (string,null) If available this represents the underlying raw error, for example an error response from a Provider. - `cause.context.provider_details` (object,null) If available this represents the underlying details from the provider. May include the error message, status code, and other details. - `detail` (string,null) A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem. - `remediation` (string,null) A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible. - `context` (object)