Skip to content

Document query parameters for schema and SBOM selectors #449

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
lc-kirill wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Document query parameters for schema and SBOM selectors #449

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/8-reference/event-schemas.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,9 @@ The value is generally the Event Type except for Detections where it is the `cat

### Retrieveing Schema Definition

Retrieving a specific schema definition can be done by doing a `GET` on `api.limacharlie.io/v1/orgs/YOUR-OID/schema/EVENT-TYPE`, where the `EVENT-TYPE` is one of the exact keys returned by the listing API above.
Retrieving a specific schema definition can be done by doing a `GET` on `api.limacharlie.io/v1/orgs/YOUR-OID/schema?name=EVENT-TYPE`, where the `EVENT-TYPE` is one of the exact keys returned by the listing API above.

URL-encode the `name` query value. Omitting `name` lists available schemas; an empty value is invalid. A prefix such as `name=evt:` returns all matching schemas under a `schemas` map. The legacy `/schema/EVENT-TYPE` path remains available for compatibility.

The returned data looks like:

Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-security/api-reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ Shared behaviors:
| `GET /ciem/facets` | `{facets}` — identity facet counts. |
| `GET /ciem/identities` | `{principals, next_cursor}` — the same per-principal effective-access rows `public-access` carries, but server-filtered and keyset-paginated instead of a top-N. Takes the same selectors as `/ciem/facets`, so the rail's counts always describe the population in the list. Ranked by risk score by default, so a walk that spans a projector rebuild can move a row across the cursor — use it for browsing, and `/inventory` with `type=Identity` and the default `urn` sort for an exact export. |
| `GET /ciem/identity?urn=` | `{identity}` — the Identity 360 single-identity rollup for one principal URN: its grants, reachable sensitive resources, access levels, and escalation paths. |
| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/repos/{repo}/sbom`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). |
| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/sbom?repo={repo}`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). |
| `GET /inventory` | `{resources, next_cursor}`. Filters: `type`, `provider`, `account`, `region`, `q`, `account_unscoped` (drop the account scoping and walk the whole estate), `sort` (`urn`, the default and the safe order for a full walk or export; `risk` with `type=Identity`; `last_seen` with `type=ThirdPartyAsset`), paging. With `type=Identity`, `provider`/`source`, `account`, and `region` become repeatable and the identity cross-filter applies: `kind`, `criticality`, `risk_band`, `mfa` (`on`/`off`/`unknown`), and the tri-state `admin`, `external`, `public`, `disabled`, `crown_jewel`, `can_escalate`, `dormant_90d`, `with_sensitive`. Pages served from the materialized view also carry `served_from` and `data_as_of` (the snapshot's build time) so a client can render "as of" instead of implying live. |
| `GET /inventory/facets` | Inventory facet counts by type/account/region. |
| `GET /data-security/facets` | `{facets}` — DSPM data-store rollup. |
Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-security/code-security/reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ subscribed to `ext-cloud-security`.
| `GET /code/status` | `code status` | Run status per connection. |
| `GET /code/capabilities` | `code capabilities` | What each GitHub connection can do, and its webhook status. Optional `repo`. |
| `GET /code/fixes` | `code fixes` | Open dependency findings grouped by the upgrade that fixes them. |
| `GET /code/repos/{repo}/sbom` | `code sbom` | A short-lived download link for the repository's SBOM. |
| `GET /code/sbom?repo={repo}` | `code sbom` | A short-lived download link for the repository's SBOM. |
| `GET /code/images`, `GET /code/images/{digest}` | | Container images and one image's detail. |
| `GET /code/image-repos`, `GET /code/image-repos/facets` | | Image repositories and their filter counts. |
| `POST /code/scan` | `code rescan` | Rescan one repository. Body: `{repo, ref?, provider?}`. |
Expand Down
Loading