Contains the operations for the root resource.
Detection Definition
v3
Provides authoring rules functionality.
Rules
#Contains the operations for rule instances.
get
Returns the collection of rules in the identified project.Get a list of rules
post
Creates a new rule in the identified project. A new rule is always created in the Coding state.Create a rule
get
Retrieves a rule by ID.Get a rule (Deprecated)
patch
Updates the properties of a rule. The rule must be in the Coding state.Update a rule's properties (Deprecated)
delete
Deletes a rule in the identified project. The rule must be in the Recycle state.Delete a rule (Deprecated)
post
Creates a new rule (with a new version number) from an existing rule in the same project.Create a new rule version (Deprecated)
post
Updates the state of a set of rules to Coding, Testing, Production, or Recycle. The update is atomic. Either all the provided rules are updated, or none of the rules are updated. These are the supported state transitions and their consistency requirements.Update the state of a rule set
get
Retrieves the active rules in the project in prioritized order, based on rule type, execution order type, and execution order priority as follows:Get active rules by prioritization
patch
Updates rule prioritizations in the project. Rule prioritizations can be updated for rules in the following states:Update rule prioritizations
post
Disables a set of rules, so they cannot be run against incoming transactions. If any rule in the set cannot be disabled (for example, a rule has an invalid rule ID), then no rules are disabled.Disable rules
post
Enables a set of rules, so they can be run against incoming transactions. If any rule in the set cannot be enabled (for example, a rule has an invalid rule ID), then no rules are enabled.Enable rules
post
Checks for errors in the rule code.Validate rule code (Deprecated)
post
Deletes a selection of rules. The selected rules must all be in the Recycle state.Delete rules
get
Retrieves the audit-log history for a rule by base-rule ID.Get the audit log for a rule
get
Retrieves a rule by ID.Get a rule
patch
Updates the properties of a rule. The rule must be in the Coding state.Update a rule's properties
delete
Deletes a rule. The rule must be in the Recycle state.Delete a rule
post
Creates a new rule (with a new version number) from an existing rule in the same project.Create a new rule version
post
Checks for errors in the rule code.Validate rule code
get
Returns the list of all functions that are supported for the rule programming language.Get a list of functions
get
Returns a collection of all actions that are supported for the rule programming language. Filtering The collection can be filtered by the rule type that allows the action. In 'filter-criteria', use the following:Get a list of actions
Organizations
#Contains the operations for organization instances.
post
Creates an organization in the following way:Create an organization
get
Returns the collection of organizations. In addition to listing an organization's properties, you can filter the list by the associated schema name, the schema ID, or both.Get a list of organizations
get
Retrieves the organization by its ID. Specify a depth to return the associated message classification and sub-message classifications up to the depth. If a depth is not specified, then no message classifications are returned. Set the depth to 0 to include only the associated message classification. To return all sub-message classifications, set depth to -1.Get an organization
patch
Updates the specified organization. Select the content type "application/json-patch+json" to update the name of an organization, description of an organization, and display name of an organization, add new relations to an organization, or remove existing relations from an organization. You can also use other content types when only modifying the name, description, and display name of an organization.Update an organization
delete
Deletes an organization and removes all links to associated roles and message schemas. Also deletes the organization's deployment definition.Delete an organization
get
Returns the collection of message classifications for the specified organization. Specify a depth to return sub-message classifications up to the depth. If no depth is specified or a depth is set to -1, then all sub-message classifications are returned.Get an organization's message classifications
get
Returns the collection of models that are registered for use by the organization.Get a list of models for an organization
post
Creates the relationship between an organization and a role of the Detection Definition service.Associate a role to an organization
delete
Deletes the relationship between an organization and a role of the Detection Definition service.Remove a role from an organization
post
Creates the relationship between an organization and a message schema of the Detection Definition service.Associate a message schema to an organization
delete
Deletes the relationship between an organization and a message schema.Remove a schema from an organization
post
Creates the relationship between an organization and a list.Associate a list to an organization
delete
Deletes the relationship between an organization and a list.Remove a list from an organization
get
Returns the lists that are associated with an organization.Get an organization's lists
get
Returns the list of variables for all message schemas that are associated with an organization.Get the variables for message schemas
post
Creates the relationship between an organization and an alert type.Associate an alert type to an organization
delete
Deletes the relationship between an organization and an alert type.Remove an alert type from an organization
Message Classifications
#Contains the operations for message classification instances.
post
Creates a message classification from a JSON representation.Create a message classification
get
Returns the collection of message classifications.Get message classifications
post
Exports message classifications in CSV format. To export an entire message classification hierarchical structure, or any subtree of the entire structure, to a CSV file, complete these steps:Export message classifications
post
Imports message classifications from a CSV file. To import an entire message classification hierarchical structure from a CSV file, complete these steps:Import message classifications
get
Retrieves the message classification by its ID. Specify a depth to return sub-message classifications together with the message classification. If a depth is not specified or is set to 0, then no sub-message classifications are returned. To return all sub-message classifications, set the depth to -1.Get a message classification
patch
Updates the specified message classification. Only the name and displayName fields can be modified.Update a message classification
delete
Deletes a message classification and all its sub-message classifications.Delete a message classification
Impact Analyses
#Contains the operations for impact analysis.
post
Retrieves information about the ability of a transaction population to support executing the given rules.Get transaction-related information for rules
get
Returns a list of impact analyses.Get a list of impact analyses
post
Creates a new impact analysis by using criteria that you provide.Create an impact analysis
post
Deletes a selection of impact analyses.Delete impact analyses
get
Retrieves an impact analysis by ID.Get an impact analysis
delete
Deletes an impact analysis.Delete an impact analysis
get
Returns the list of rules that were used in an impact analysis.Get rules for an impact analysis
get
Retrieves the details of the rules that were used in an impact analysis.Get rule details for an impact analysis
post
Cancels an impact analysis.Cancel an impact analysis
get
Retrieves information about how long it took to execute the impact analysis.Get timing metrics for an impact analysis
get
Returns the list of alerts for an impact analysis.Get alerts for an impact analysis
get
Returns the list of variables that are available for the output transactions in an impact analysis.Get transaction-related variables for an impact analysis
post
Returns the list of transactions fired by the rules in an impact analysis.Get transactions for an impact analysis
Projects
#Contains the operations for project instances.
get
Returns a list of projects.Get a list of projects
post
Creates a new project with the properties specified in the request body.Create a project
get
Retrieves the project that is identified by the given ID.Get a project (Deprecated)
delete
Deletes a project, if there are no associated assets, such as rules. The profile variable user group that belongs to the project is also removed.Delete a project (Deprecated)
patch
Updates a project. Select the content type 'application/json-patch+json' to update the name and description of a project, add new relations to a project, or remove existing relations from a project. You can also use other content types when you change the project's name and description only.Update a project (Deprecated)
get
Returns the list of variables for the message schemas that are associated with the project.Get variables for a project's message schemas (Deprecated)
get
Returns the list of projects of which the current user is a member.Get a current user's projects
get
Retrieves the project that is identified by the given ID.Get a project
delete
Deletes a project, if there are no associated assets, such as rules. The profile variable user group that belongs to the project is also removed.Delete a project
patch
Updates a project. Select the content type 'application/json-patch+json' to update the name and description of a project, add new relations to a project, or remove existing relations from a project. You can also use other content types when you change a project's name and description only.Update a project
get
Returns the list of variables of the message schemas that are associated with the project.Get the variables for a project's message schemas
get
Retrieves the message classifications that are associated with the project identified by the given ID.Get a project's message classifications
get
Retrieves the message classification that is associated with the project identified by the given ID. Specify a depth to return sub-message classifications together with the message classification.Get a project's message classification
get
Returns the lists that are associated with a project.Get a project's lists
Deployments
#Contains the operations for deployments.
get
Retrieves the details about a deployment.Get a deployment
get
Retrieves the details about a deployment.Get a deployment's model manifest
get
Retrieves the deployment updates since the last deployment and retrieves the current deployable candidates.Get deployment updates for organizations
get
Returns the list of deployments for one or more organizations.Get a list of deployments
post
Deploys the specified organization's detection rules and models.Create a deployment
Deployment Definitions
#Contains the operations for deployment definitions.
get
Retrieves the deployment definitions for an organization.Get deployment definitions
post
Creates definitions that are related to deployment.Create deployment definitions
patch
Updates the deployment definitions for an organization. This replaces prior deployment definition values.Update a deployment definition
delete
Deletes deployment definitions for an organization.Delete deployment definitions
post
Validates the detectionURL and tdrTopic properties of a deployment definition.Validate a deployment definition
Roles and Users
#Contains the operations for roles, users, and capabilities of the Detection Definition service.
get
Returns the list of roles for the Detection Definition service. If an orgId is specified, then the list contains the roles that are associated with the specified organization. For more information about filterable and sortable fields of groups, see the SAS Identity Service API.Get a list of roles
get
Returns the list of the users of the Detection Definition service. If an orgId is specified, then the list contains users of the roles that are associated with the organization. Valid users are direct members of the role of Detection Definition service. For more information about filterable and sortable fields, see the SAS Identity Service API.Get a list of users
get
Retrieves your capabilities for the Detection Definition service. If you specify an orgId, then the list contains your capabilities for the roles that are associated with the organization. If you are a SAS Administrator, then you can also retrieve the list of capabilities defined in SAS Detection Architecture or the capabilities of a role.Get your capabilities
get
Returns whether the current user has been granted capabilities within the service. Specify the capabilities to be checked with the criteria parameter. A single capability can be checked or you can specify a combination of capabilities to check (for example, AND(sda.projects.view, sda.rules.view)). Returns 'true' if the current user has the capabilities, or and 'false' if they do not. Some capabilities are granted at service scope, and other capabilities are granted at organization or project scope. If the criteria parameter consists of one or more capabilities with a project scope, then you must provide a projectId. If the criteria parameter consists of one or more capabilities with an organization scope, then you must provide an orgId (unless you specified a projectId).Get a user's capabilities
Models
#Contains the operations for models.
get
Returns a collection of models.Get a list of models
post
Creates a new model.Create a model
get
Retrieves a specified model.Get a registered model
patch
Updates a model. Only label, associated organizational relationship, URI, and inputs can be updated.Update a model
head
Retrieves the metadata for a specific model through response headers.Get metadata for a registered model
delete
Deletes a model with a specified ID.Delete a model
post
Deletes multiple models with specified model IDs.Delete multiple models
get
Returns a list of all model packages.Get model packages
get
Retrieves a specific package from the model repository.Get a package from the model repository
get
Retrieves from the model repository all signature models that are used by a model.Get all signature models for a model
Alert Types
#Contains the operations for alert types.
get
Returns a collection of alert types.Get a list of alert types
post
Creates an alert type.Create an alert type
get
Retrieves information about a specific alert type.Get details for an alert type
delete
Deletes an alert type.Delete an alert type
Message Schemas
#Contains the operations for message schemas.
head
Returns the status of a message schema. Returns 'OK' if the message schema is in use or if it exists.Get a message schema's status
get
Returns a list of message schemas with an option to filter by organizations, message categories, or both.Get the latest message schemas
get
Retrieves the variables of a variable set. The information that is returned includes the number of rules that use each variable and the ID of the rules, when applicable.Get a list of variables
Lists
#Contains the operations for lists.
get
Returns the collection of lists from the repository folder.Get a list of lists
get
Retrieves a specified list.Get a specific list (Deprecated)
post
Registers a list with the specified list ID from the List Data service.Register a list (Deprecated)
delete
Deletes a list with the specified list ID.