[
{
"method": "GET",
"endpoints": [
{
"name": "/",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.default_controller.default_info",
"description": "Return basic information about the API",
"summary": "Root-endpoint info",
"tags": [],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agents",
"description": "Return information about all available agents or a list of them",
"summary": "Get agents",
"tags": [
"agents"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "group",
"description": "Filter by group of agents",
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
},
{
"name": "ip",
"description": "Filter by the IP used by the agent to communicate with the manager. If it's not available, it will have the same value as registerIP",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "manager",
"description": "Filter by manager hostname where agents are connected to",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "name",
"description": "Filter by agent name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "node_name",
"description": "Filter by node name",
"schema": {
"type": "string",
"format": "names"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "older_than",
"description": "Filter out agents whose time lapse from last keep alive signal is longer than specified. Time in seconds, ‘[n_days]d’, ‘[n_hours]h’, ‘[n_minutes]m’ or ‘[n_seconds]s’. For never_connected agents, uses the register date. For example, `7d`, `10s` and `10` are valid values. When no time unit is specified, seconds are used.\n",
"schema": {
"type": "string",
"format": "timeframe"
}
},
{
"name": "os.name",
"description": "Filter by OS name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "os.platform",
"description": "Filter by OS platform",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "os.version",
"description": "Filter by OS version",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "registerIP",
"description": "Filter by the IP used when registering the agent",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by agent status. Use commas to enter multiple statuses",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"active",
"pending",
"never_connected",
"disconnected"
]
},
"minItems": 1
}
},
{
"name": "version",
"description": "Filter by agents version",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/config/:component/:configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_config",
"description": "Return the active configuration the agent is currently using. This can be different from the configuration present in the configuration file, if it has been modified and the agent has not been restarted yet",
"summary": "Get active configuration",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
},
{
"name": ":component",
"description": "Selected agent's component",
"required": true,
"schema": {
"type": "string",
"enum": [
"agent",
"agentless",
"analysis",
"auth",
"com",
"csyslog",
"integrator",
"logcollector",
"mail",
"monitor",
"request",
"syscheck",
"wmodules"
]
}
},
{
"name": ":configuration",
"description": "Selected agent's configuration to read. The configuration to read depends on the selected component. The following table shows all available combinations of component and configuration values:
\n\n\n\n| Component | \nConfiguration | \nTag | \n
\n\n\n\n| agent | \nclient | \n<client> | \n
\n\n| agent | \nbuffer | \n<client_buffer> | \n
\n\n| agent | \nlabels | \n<labels> | \n
\n\n| agent | \ninternal | \nagent, monitord, remoted | \n
\n\n| agentless | \nagentless | \n<agentless> | \n
\n\n| analysis | \nglobal | \n<global> | \n
\n\n| analysis | \nactive_response | \n<active-response> | \n
\n\n| analysis | \nalerts | \n<alerts> | \n
\n\n| analysis | \ncommand | \n<command> | \n
\n\n| analysis | \nrules | \n<rule> | \n
\n\n| analysis | \ndecoders | \n<decoder> | \n
\n\n| analysis | \ninternal | \nanalysisd | \n
\n\n| auth | \nauth | \n<auth> | \n
\n\n| com | \nactive-response | \n<active-response> | \n
\n\n| com | \nlogging | \n<logging> | \n
\n\n| com | \ninternal | \nexecd | \n
\n\n| com | \ncluster | \ncluster | \n
\n\n| csyslog | \ncsyslog | \n<csyslog_output> | \n
\n\n| integrator | \nintegration | \n<integration> | \n
\n\n| logcollector | \nlocalfile | \n<localfile> | \n
\n\n| logcollector | \nsocket | \n<socket> | \n
\n\n| logcollector | \ninternal | \nlogcollector | \n
\n\n| mail | \nglobal | \n<global><email...> | \n
\n\n| mail | \nalerts | \n<email_alerts> | \n
\n\n| mail | \ninternal | \nmaild | \n
\n\n| monitor | \ninternal | \nmonitord | \n
\n\n| monitor | \ninternal | \nreports | \n
\n\n| request | \nremote | \n<remote> | \n
\n\n| request | \ninternal | \nremoted | \n
\n\n| syscheck | \nsyscheck | \n<syscheck> | \n
\n\n| syscheck | \nrootcheck | \n<rootcheck> | \n
\n\n| syscheck | \ninternal | \nsyscheck, rootcheck | \n
\n\n| wmodules | \nwmodules | \n<wodle> | \n
\n\n
\n",
"required": true,
"schema": {
"type": "string",
"enum": [
"client",
"buffer",
"labels",
"internal",
"agentless",
"global",
"active_response",
"alerts",
"command",
"rules",
"decoders",
"auth",
"logging",
"reports",
"active-response",
"cluster",
"csyslog",
"integration",
"localfile",
"socket",
"remote",
"syscheck",
"rootcheck",
"wmodules"
]
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/group/is_sync",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_sync_agent",
"description": "Return whether the agent configuration has been synchronized with the agent or not. This can be useful to check after updating a group configuration",
"summary": "Get agent configuration sync status",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/key",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_key",
"description": "Return the key of an agent",
"summary": "Get agent key",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/upgrade_result",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_upgrade",
"description": "Return the upgrade result after updating an agent",
"summary": "Get upgrade result from agent",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/no_group",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_no_group",
"description": "Return a list with all the available agents without group",
"summary": "Get all agents without group",
"tags": [
"agents"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/outdated",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_outdated",
"description": "Return the list of outdated agents",
"summary": "Get outdated agents",
"tags": [
"agents"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/stats/distinct",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_fields",
"description": "Return all the different combinations that agents have for the selected fields. It also indicates the total number of agents that have each combination",
"summary": "Get distinct fields in agents",
"tags": [
"agents"
],
"query": [
{
"name": "fields",
"description": "List of fields affecting the operation",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/summary/os",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_summary_os",
"description": "Return a summary of the OS of available agents",
"summary": "Get agents OS summary",
"tags": [
"agents"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/summary/status",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agent_summary_status",
"description": "Return a summary of the status of available agents",
"summary": "Get agents status summary",
"tags": [
"agents"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/ciscat/:agent_id/results",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.ciscat_controller.get_agents_ciscat_results",
"description": "Return the agent's ciscat results info",
"summary": "Get CIS-CAT results from an agent",
"tags": [
"ciscat"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "benchmark",
"description": "Filter by benchmark type",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "error",
"description": "Filter by encountered errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "fail",
"description": "Filter by failed checks",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "notchecked",
"description": "Filter by not checked",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pass",
"description": "Filter by passed checks",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "profile",
"description": "Filter by evaluated profile",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "score",
"description": "Filter by final score",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "unknown",
"description": "Filter by unknown results",
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_configuration_node",
"description": "Return wazuh configuration used in node {node_id}",
"summary": "Get a specified node's configuration",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "field",
"description": "Indicate a section child. E.g, fields for *ruleset* section are: decoder_dir, rule_dir, etc",
"schema": {
"type": "string",
"format": "names"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "section",
"description": "Indicates the wazuh configuration section",
"schema": {
"type": "string",
"enum": [
"active-response",
"agentless",
"alerts",
"auth",
"client",
"client_buffer",
"cluster",
"command",
"database_output",
"email_alerts",
"global",
"integration",
"labels",
"localfile",
"logging",
"remote",
"reports",
"rootcheck",
"ruleset",
"sca",
"socket",
"syscheck",
"syslog_output",
"agent-key-polling",
"aws-s3",
"azure-logs",
"cis-cat",
"docker-listener",
"open-scap",
"osquery",
"syscollector",
"vulnerability-detector"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/configuration/:component/:configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_node_config",
"description": "Return the requested configuration in JSON format",
"summary": "Get active configuration in node node_id",
"tags": [
"cluster"
],
"args": [
{
"name": ":component",
"description": "Selected agent's component",
"required": true,
"schema": {
"type": "string",
"enum": [
"agent",
"agentless",
"analysis",
"auth",
"com",
"csyslog",
"integrator",
"logcollector",
"mail",
"monitor",
"request",
"syscheck",
"wmodules"
]
}
},
{
"name": ":configuration",
"description": "Selected agent's configuration to read. The configuration to read depends on the selected component. The following table shows all available combinations of component and configuration values:
\n\n\n\n| Component | \nConfiguration | \nTag | \n
\n\n\n\n| agent | \nclient | \n<client> | \n
\n\n| agent | \nbuffer | \n<client_buffer> | \n
\n\n| agent | \nlabels | \n<labels> | \n
\n\n| agent | \ninternal | \nagent, monitord, remoted | \n
\n\n| agentless | \nagentless | \n<agentless> | \n
\n\n| analysis | \nglobal | \n<global> | \n
\n\n| analysis | \nactive_response | \n<active-response> | \n
\n\n| analysis | \nalerts | \n<alerts> | \n
\n\n| analysis | \ncommand | \n<command> | \n
\n\n| analysis | \nrules | \n<rule> | \n
\n\n| analysis | \ndecoders | \n<decoder> | \n
\n\n| analysis | \ninternal | \nanalysisd | \n
\n\n| auth | \nauth | \n<auth> | \n
\n\n| com | \nactive-response | \n<active-response> | \n
\n\n| com | \nlogging | \n<logging> | \n
\n\n| com | \ninternal | \nexecd | \n
\n\n| com | \ncluster | \ncluster | \n
\n\n| csyslog | \ncsyslog | \n<csyslog_output> | \n
\n\n| integrator | \nintegration | \n<integration> | \n
\n\n| logcollector | \nlocalfile | \n<localfile> | \n
\n\n| logcollector | \nsocket | \n<socket> | \n
\n\n| logcollector | \ninternal | \nlogcollector | \n
\n\n| mail | \nglobal | \n<global><email...> | \n
\n\n| mail | \nalerts | \n<email_alerts> | \n
\n\n| mail | \ninternal | \nmaild | \n
\n\n| monitor | \ninternal | \nmonitord | \n
\n\n| monitor | \ninternal | \nreports | \n
\n\n| request | \nremote | \n<remote> | \n
\n\n| request | \ninternal | \nremoted | \n
\n\n| syscheck | \nsyscheck | \n<syscheck> | \n
\n\n| syscheck | \nrootcheck | \n<rootcheck> | \n
\n\n| syscheck | \ninternal | \nsyscheck, rootcheck | \n
\n\n| wmodules | \nwmodules | \n<wodle> | \n
\n\n
\n",
"required": true,
"schema": {
"type": "string",
"enum": [
"client",
"buffer",
"labels",
"internal",
"agentless",
"global",
"active_response",
"alerts",
"command",
"rules",
"decoders",
"auth",
"logging",
"reports",
"active-response",
"cluster",
"csyslog",
"integration",
"localfile",
"socket",
"remote",
"syscheck",
"rootcheck",
"wmodules"
]
}
},
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_files_node",
"description": "Return file contents from any file in cluster node {node_id}",
"summary": "Get file contents from a specified node in the cluster",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "path",
"description": "Filepath to return file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_and_ruleset_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/info",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_info_node",
"description": "Return basic information about a specified node such as version, compilation date, installation path",
"summary": "Get a specified node's information",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/logs",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_log_node",
"description": "Return the last 2000 wazuh log entries in node {node_id}",
"summary": "Get a specified node's wazuh logs",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "level",
"description": "Filter by log level",
"schema": {
"type": "string",
"enum": [
"critical",
"debug",
"debug2",
"error",
"info",
"warning"
]
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "tag",
"description": "Wazuh component that logged the event",
"schema": {
"type": "string",
"enum": [
"ossec-agentlessd",
"ossec-analysisd",
"ossec-authd",
"ossec-csyslogd",
"ossec-dbd",
"ossec-execd",
"ossec-integratord",
"ossec-maild",
"ossec-monitord",
"ossec-logcollector",
"ossec-remoted",
"ossec-reportd",
"ossec-rootcheck",
"ossec-syscheckd",
"ossec-testrule",
"sca",
"wazuh-db",
"wazuh-modulesd",
"wazuh-modulesd:agent-key-polling",
"wazuh-modulesd:aws-s3",
"wazuh-modulesd:azure-logs",
"wazuh-modulesd:ciscat",
"wazuh-modulesd:control",
"wazuh-modulesd:command",
"wazuh-modulesd:database",
"wazuh-modulesd:docker-listener",
"wazuh-modulesd:download",
"wazuh-modulesd:oscap",
"wazuh-modulesd:osquery",
"wazuh-modulesd:syscollector",
"wazuh-modulesd:vulnerability-detector"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/logs/summary",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_log_summary_node",
"description": "Return a summary of the last 2000 wazuh log entries in node {node_id}",
"summary": "Get a summary of a specified node's wazuh logs",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/stats",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_stats_node",
"description": "Return Wazuh statistical information in node {node_id} for the current or specified date",
"summary": "Get a specified node's stats",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "date",
"description": "Date to obtain statistical information from. Format YYYY-MM-DD",
"schema": {
"type": "string",
"format": "date"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/stats/analysisd",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_stats_analysisd_node",
"description": "Return Wazuh analysisd statistical information in node {node_id}",
"summary": "Get a specified node's analysisd stats",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/stats/hourly",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_stats_hourly_node",
"description": "Return Wazuh statistical information in node {node_id} per hour. Each number in the averages field represents the average of alerts per hour",
"summary": "Get a specified node's stats per hour",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/stats/remoted",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_stats_remoted_node",
"description": "Return Wazuh remoted statistical information in node {node_id}",
"summary": "Get a specified node's remoted stats",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/stats/weekly",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_stats_weekly_node",
"description": "Return Wazuh statistical information in node {node_id} per week. Each number in the averages field represents the average of alerts per hour for that specific day",
"summary": "Get a specified node's stats per week",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/status",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_status_node",
"description": "Return the status of all Wazuh daemons in node node_id",
"summary": "Get a specified node's status",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_api_config",
"description": "Return the API configuration of all the selected nodes in JSON format",
"summary": "Get the API configuration of all nodes (or a list of them)",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/configuration/validation",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_conf_validation",
"description": "Return whether the Wazuh configuration is correct or not in all cluster nodes or a list of them",
"summary": "Check cluster nodes Wazuh configuration",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/healthcheck",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_healthcheck",
"description": "Return cluster healthcheck information for all nodes or a list of them. Such information includes last keep alive, last synchronization time and number of agents reporting on each node",
"summary": "Get cluster nodes healthcheck",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/local/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_config",
"description": "Return the current node cluster configuration",
"summary": "Get local node cluster configuration",
"tags": [
"cluster"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/local/info",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_cluster_node",
"description": "Return basic information about the cluster node receiving the request",
"summary": "Get information about the local node",
"tags": [
"cluster"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/nodes",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_cluster_nodes",
"description": "Get information about all nodes in the cluster or a list of them",
"summary": "Get cluster nodes information",
"tags": [
"cluster"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "type",
"description": "Filter by node type",
"schema": {
"type": "string",
"enum": [
"worker",
"master"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/status",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.get_status",
"description": "Return information about the cluster status",
"summary": "Get cluster status",
"tags": [
"cluster"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/decoders",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.decoders_controller.get_decoders",
"description": "Return information about all decoders included in ossec.conf. This information include decoder's route, decoder's name, decoder's file among others",
"summary": "Get all decoders",
"tags": [
"decoders"
],
"query": [
{
"name": "decoder_names",
"description": "Decoder name",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by list status. Use commas to enter multiple statuses",
"schema": {
"type": "string",
"enum": [
"enabled",
"disabled",
"all"
],
"minItems": 1
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/decoders/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.decoders_controller.get_decoders_files",
"description": "Return information about all decoders files used in Wazuh. This information include decoder's file, decoder's route and decoder's status among others",
"summary": "Get all decoders files",
"tags": [
"decoders"
],
"query": [
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by list status. Use commas to enter multiple statuses",
"schema": {
"type": "string",
"enum": [
"enabled",
"disabled",
"all"
],
"minItems": 1
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/decoders/files/:filename/download",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.decoders_controller.get_download_file",
"description": "Download an specified decoder file",
"summary": "Download an specified decoder file",
"tags": [
"decoders"
],
"args": [
{
"name": ":filename",
"required": true,
"description": "Filename to download",
"schema": {
"type": "string",
"format": "alphanumeric"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/decoders/parents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.decoders_controller.get_decoders_parents",
"description": "Return information about all parent decoders. A parent decoder is a decoder used as base of other decoders",
"summary": "Get all parent decoders",
"tags": [
"decoders"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/ciscat/results",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_cis_cat_results",
"description": "Return CIS-CAT results for all agents or a list of them",
"summary": "Get CIS-CAT results",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "benchmark",
"description": "Filter by benchmark type",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "error",
"description": "Filter by encountered errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "fail",
"description": "Filter by failed checks",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "notchecked",
"description": "Filter by not checked",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pass",
"description": "Filter by passed checks",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "profile",
"description": "Filter by evaluated profile",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "score",
"description": "Filter by final score",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "unknown",
"description": "Filter by unknown results",
"schema": {
"type": "integer",
"format": "int32"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/hardware",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_hardware_info",
"description": "Return all agents (or a list of them) hardware info. This information include cpu, ram, scan info among others of all agents",
"summary": "Get hardware info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "board_serial",
"description": "Filter by board_serial",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "cpu.cores",
"description": "Filter by cpu.cores",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 1
}
},
{
"name": "cpu.mhz",
"description": "Filter by cpu.mhz",
"schema": {
"type": "number",
"format": "float",
"minimum": 1
}
},
{
"name": "cpu.name",
"description": "Filter by cpu.name",
"schema": {
"type": "string"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "ram.free",
"description": "Filter by ram.free",
"schema": {
"type": "integer",
"format": "int64",
"minimum": 0
}
},
{
"name": "ram.total",
"description": "Filter by ram.total",
"schema": {
"type": "integer",
"format": "int64",
"minimum": 0
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/hotfixes",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_hotfixes_info",
"description": "Return all agents (or a list of them) hotfixes info",
"summary": "Get hotfixes info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "hotfix",
"description": "Filter by hotfix",
"schema": {
"type": "string"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/netaddr",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_network_address_info",
"description": "Return all agents (or a list of them) IPv4 and IPv6 addresses associated to their network interfaces. This information include used IP protocol, interface, and IP address among others",
"summary": "Get the IPv4 and IPv6 addresses associated to network interfaces",
"tags": [
"experimental"
],
"query": [
{
"name": "address",
"description": "Filter by IP address",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "broadcast",
"description": "Filter by broadcast direction",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "netmask",
"description": "Filter by netmask",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "proto",
"description": "Filter by IP protocol",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/netiface",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_network_interface_info",
"description": "Return all agents (or a list of them) network interfaces. This information includes rx, scan, tx info and some network information among other",
"summary": "Get all network interfaces from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "adapter",
"description": "Filter by adapter",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "mtu",
"description": "Filter by mtu",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "name",
"description": "Filter by agent name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "rx.bytes",
"description": "Filter by rx.bytes",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.dropped",
"description": "Filter by rx.dropped",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.errors",
"description": "Filter by rx.errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.packets",
"description": "Filter by rx.packets",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "tx.bytes",
"description": "Filter by tx.bytes",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.dropped",
"description": "Filter by tx.dropped",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.errors",
"description": "Filter by tx.errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.packets",
"description": "Filter by tx.packets",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "type",
"description": "Type of network",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/netproto",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_network_protocol_info",
"description": "Return all agents (or a list of them) routing configuration for each network interface. This information includes interface, type protocol information among other",
"summary": "Get network protocol info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "dhcp",
"description": "Filter by network dhcp (enabled or disabled)",
"schema": {
"type": "string",
"description": "DHCP status",
"enum": [
"enabled",
"disabled",
"unknown",
"BOOTP"
]
}
},
{
"name": "gateway",
"description": "Filter by network gateway",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "iface",
"description": "Filter by network interface",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "type",
"description": "Type of network",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/os",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_os_info",
"description": "Return all agents (or a list of them) OS info. This information includes os information, architecture information among other",
"summary": "Get OS info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "architecture",
"description": "Filter by architecture",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "os.name",
"description": "Filter by OS name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "os.version",
"description": "Filter by OS version",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "release",
"description": "Filter by release",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "version",
"description": "Filter by agents version",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/packages",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_packages_info",
"description": "Return all agents (or a list of them) packages info. This information includes name, section, size, and priority information of all packages among other",
"summary": "Get packages info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "architecture",
"description": "Filter by architecture",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "format",
"description": "Filter by file format. For example 'deb' will output deb files.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "name",
"description": "Filter by agent name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "vendor",
"description": "Filter by vendor",
"schema": {
"type": "string"
}
},
{
"name": "version",
"description": "Filter by version name",
"schema": {
"type": "string"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/ports",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_ports_info",
"description": "Return all agents (or a list of them) ports info. This information includes local IP, Remote IP, protocol information among other",
"summary": "Get ports info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "local.ip",
"description": "Filter by Local IP",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "local.port",
"description": "Filter by Local Port",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pid",
"description": "Filter by pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "process",
"description": "Filter by process name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "protocol",
"description": "Filter by protocol",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "remote.ip",
"description": "Filter by Remote IP",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "tx_queue",
"description": "Filter by tx_queue",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscollector/processes",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.get_processes_info",
"description": "Return all agents (or a list of them) processes info",
"summary": "Get processes info from agents",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "egroup",
"description": "Filter by process egroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "euser",
"description": "Filter by process euser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "fgroup",
"description": "Filter by process fgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "name",
"description": "Filter by process name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "nlwp",
"description": "Filter by process nlwp",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pgrp",
"description": "Filter by process pgrp",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pid",
"description": "Filter by process pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "ppid",
"description": "Filter by process parent pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "priority",
"description": "Filter by process priority",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "rgroup",
"description": "Filter by process rgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "ruser",
"description": "Filter by process ruser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sgroup",
"description": "Filter by process sgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by process state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "suser",
"description": "Filter by process suser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_list_group",
"description": "Get information about all groups or a list of them. Returns a list containing basic information about each group such as number of agents belonging to the group and the checksums of the configuration and shared files",
"summary": "Get groups",
"tags": [
"groups"
],
"query": [
{
"name": "groups_list",
"description": "Array of group IDs",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
},
{
"name": "hash",
"description": "Select algorithm to generate the returned checksums",
"schema": {
"type": "string",
"enum": [
"md5",
"sha1",
"sha224",
"sha256",
"sha384",
"sha512",
"blake2b",
"blake2s",
"sha3_224",
"sha3_256",
"sha3_384",
"sha3_512"
]
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/agents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_agents_in_group",
"description": "Return the list of agents that belong to the specified group",
"summary": "Get agents in a group",
"tags": [
"groups"
],
"args": [
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by agent status. Use commas to enter multiple statuses",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"active",
"pending",
"never_connected",
"disconnected"
]
},
"minItems": 1
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_group_config",
"description": "Return the group configuration defined in the `agent.conf` file",
"summary": "Get group configuration",
"tags": [
"groups"
],
"args": [
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_group_files",
"description": "Return the files placed under the group directory",
"summary": "Get group files",
"tags": [
"groups"
],
"args": [
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "hash",
"description": "Select algorithm to generate the returned checksums",
"schema": {
"type": "string",
"enum": [
"md5",
"sha1",
"sha224",
"sha256",
"sha384",
"sha512",
"blake2b",
"blake2s",
"sha3_224",
"sha3_256",
"sha3_384",
"sha3_512"
]
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/files/:file_name/json",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_group_file_json",
"description": "Return the contents of the specified group file parsed to JSON",
"summary": "Get a file in group",
"tags": [
"groups"
],
"args": [
{
"name": ":file_name",
"description": "Filename",
"required": true,
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "type",
"description": "Type of file",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"conf",
"rootkit_files",
"rootkit_trojans",
"rcl"
]
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/files/:file_name/xml",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.get_group_file_xml",
"description": "Return the contents of the specified group file parsed to XML",
"summary": "Get a file in group",
"tags": [
"groups"
],
"args": [
{
"name": ":file_name",
"description": "Filename",
"required": true,
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "type",
"description": "Type of file",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"conf",
"rootkit_files",
"rootkit_trojans",
"rcl"
]
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/lists",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.lists_controller.get_lists",
"description": "Return the contents of all CDB lists. Optionally, the result can be filtered by several criteria. See available parameters for more details",
"summary": "Get all CDB lists",
"tags": [
"lists"
],
"query": [
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/lists/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.lists_controller.get_lists_files",
"description": "Return the path from all CDB lists. Use this method to know all the CDB lists and their location in the filesystem relative to Wazuh installation folder",
"summary": "Get paths from all CDB lists",
"tags": [
"lists"
],
"query": [
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_api_config",
"description": "Return the local API configuration in JSON format",
"summary": "Get local API configuration",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_configuration",
"description": "Return wazuh configuration used",
"summary": "Get configuration",
"tags": [
"manager"
],
"query": [
{
"name": "field",
"description": "Indicate a section child. E.g, fields for *ruleset* section are: decoder_dir, rule_dir, etc",
"schema": {
"type": "string",
"format": "names"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "section",
"description": "Indicates the wazuh configuration section",
"schema": {
"type": "string",
"enum": [
"active-response",
"agentless",
"alerts",
"auth",
"client",
"client_buffer",
"cluster",
"command",
"database_output",
"email_alerts",
"global",
"integration",
"labels",
"localfile",
"logging",
"remote",
"reports",
"rootcheck",
"ruleset",
"sca",
"socket",
"syscheck",
"syslog_output",
"agent-key-polling",
"aws-s3",
"azure-logs",
"cis-cat",
"docker-listener",
"open-scap",
"osquery",
"syscollector",
"vulnerability-detector"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/configuration/:component/:configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_manager_config_ondemand",
"description": "Return the requested configuration in JSON format",
"summary": "Get active configuration in manager for one component [on demand]",
"tags": [
"manager"
],
"args": [
{
"name": ":component",
"description": "Selected agent's component",
"required": true,
"schema": {
"type": "string",
"enum": [
"agent",
"agentless",
"analysis",
"auth",
"com",
"csyslog",
"integrator",
"logcollector",
"mail",
"monitor",
"request",
"syscheck",
"wmodules"
]
}
},
{
"name": ":configuration",
"description": "Selected agent's configuration to read. The configuration to read depends on the selected component. The following table shows all available combinations of component and configuration values:
\n\n\n\n| Component | \nConfiguration | \nTag | \n
\n\n\n\n| agent | \nclient | \n<client> | \n
\n\n| agent | \nbuffer | \n<client_buffer> | \n
\n\n| agent | \nlabels | \n<labels> | \n
\n\n| agent | \ninternal | \nagent, monitord, remoted | \n
\n\n| agentless | \nagentless | \n<agentless> | \n
\n\n| analysis | \nglobal | \n<global> | \n
\n\n| analysis | \nactive_response | \n<active-response> | \n
\n\n| analysis | \nalerts | \n<alerts> | \n
\n\n| analysis | \ncommand | \n<command> | \n
\n\n| analysis | \nrules | \n<rule> | \n
\n\n| analysis | \ndecoders | \n<decoder> | \n
\n\n| analysis | \ninternal | \nanalysisd | \n
\n\n| auth | \nauth | \n<auth> | \n
\n\n| com | \nactive-response | \n<active-response> | \n
\n\n| com | \nlogging | \n<logging> | \n
\n\n| com | \ninternal | \nexecd | \n
\n\n| com | \ncluster | \ncluster | \n
\n\n| csyslog | \ncsyslog | \n<csyslog_output> | \n
\n\n| integrator | \nintegration | \n<integration> | \n
\n\n| logcollector | \nlocalfile | \n<localfile> | \n
\n\n| logcollector | \nsocket | \n<socket> | \n
\n\n| logcollector | \ninternal | \nlogcollector | \n
\n\n| mail | \nglobal | \n<global><email...> | \n
\n\n| mail | \nalerts | \n<email_alerts> | \n
\n\n| mail | \ninternal | \nmaild | \n
\n\n| monitor | \ninternal | \nmonitord | \n
\n\n| monitor | \ninternal | \nreports | \n
\n\n| request | \nremote | \n<remote> | \n
\n\n| request | \ninternal | \nremoted | \n
\n\n| syscheck | \nsyscheck | \n<syscheck> | \n
\n\n| syscheck | \nrootcheck | \n<rootcheck> | \n
\n\n| syscheck | \ninternal | \nsyscheck, rootcheck | \n
\n\n| wmodules | \nwmodules | \n<wodle> | \n
\n\n
\n",
"required": true,
"schema": {
"type": "string",
"enum": [
"client",
"buffer",
"labels",
"internal",
"agentless",
"global",
"active_response",
"alerts",
"command",
"rules",
"decoders",
"auth",
"logging",
"reports",
"active-response",
"cluster",
"csyslog",
"integration",
"localfile",
"socket",
"remote",
"syscheck",
"rootcheck",
"wmodules"
]
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/configuration/validation",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_conf_validation",
"description": "Return whether the Wazuh configuration is correct",
"summary": "Check Wazuh configuration",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_files",
"description": "Return file contents from any file",
"summary": "Get file contents",
"tags": [
"manager"
],
"query": [
{
"name": "path",
"description": "Filepath to return file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_and_ruleset_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/info",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_info",
"description": "Return basic information such as version, compilation date, installation path",
"summary": "Get Wazuh manager information",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/logs",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_log",
"description": "Return the last 2000 wazuh log entries",
"summary": "Get the wazuh manager logs",
"tags": [
"manager"
],
"query": [
{
"name": "level",
"description": "Filter by log level",
"schema": {
"type": "string",
"enum": [
"critical",
"debug",
"debug2",
"error",
"info",
"warning"
]
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "tag",
"description": "Wazuh component that logged the event",
"schema": {
"type": "string",
"enum": [
"ossec-agentlessd",
"ossec-analysisd",
"ossec-authd",
"ossec-csyslogd",
"ossec-dbd",
"ossec-execd",
"ossec-integratord",
"ossec-maild",
"ossec-monitord",
"ossec-logcollector",
"ossec-remoted",
"ossec-reportd",
"ossec-rootcheck",
"ossec-syscheckd",
"ossec-testrule",
"sca",
"wazuh-db",
"wazuh-modulesd",
"wazuh-modulesd:agent-key-polling",
"wazuh-modulesd:aws-s3",
"wazuh-modulesd:azure-logs",
"wazuh-modulesd:ciscat",
"wazuh-modulesd:control",
"wazuh-modulesd:command",
"wazuh-modulesd:database",
"wazuh-modulesd:docker-listener",
"wazuh-modulesd:download",
"wazuh-modulesd:oscap",
"wazuh-modulesd:osquery",
"wazuh-modulesd:syscollector",
"wazuh-modulesd:vulnerability-detector"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/logs/summary",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_log_summary",
"description": "Return a summary of the last 2000 wazuh log entries",
"summary": "Get a summary of the wazuh manager logs",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/stats",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_stats",
"description": "Return Wazuh statistical information for the current or specified date",
"summary": "Get stats",
"tags": [
"manager"
],
"query": [
{
"name": "date",
"description": "Date to obtain statistical information from. Format YYYY-MM-DD",
"schema": {
"type": "string",
"format": "date"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/stats/analysisd",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_stats_analysisd",
"description": "Return Wazuh analysisd statistical information",
"summary": "Get analysisd stats",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/stats/hourly",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_stats_hourly",
"description": "Return Wazuh statistical information per hour. Each number in the averages field represents the average of alerts per hour",
"summary": "Get stats by hour",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/stats/remoted",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_stats_remoted",
"description": "Return Wazuh remoted statistical information",
"summary": "Get remoted stats",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/stats/weekly",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_stats_weekly",
"description": "Return Wazuh statistical information per week. Each number in the averages field represents the average of alerts per hour for that specific day",
"summary": "Get stats by week",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/status",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.get_status",
"description": "Return the status of all Wazuh daemons",
"summary": "Get the Wazuh manager status",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/mitre",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.mitre_controller.get_attack",
"description": "Return the requested attacks from MITRE database",
"summary": "Get attacks information from MITRE database",
"tags": [
"mitre"
],
"query": [
{
"name": "id",
"description": "MITRE attack ID.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "phase_name",
"description": "Show results filtered by phase.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "platform_name",
"description": "Show results filtered by platform.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/overview/agents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.overview_controller.get_overview_agents",
"description": "Return a dictionary with a full agents overview",
"summary": "Get a full agents overview",
"tags": [
"overview"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rules_controller.get_rules",
"description": "Return a list containing information about each rule such as file where it's defined, description, rule group, status, etc",
"summary": "Get information about a list of Wazuh rules",
"tags": [
"rules"
],
"query": [
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "gdpr",
"description": "Filter by GDPR requirement",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "gpg13",
"description": "Filter by GPG13 requirement",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "group",
"description": "Filter by rule group",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "hipaa",
"description": "Filter by HIPAA requirement",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "level",
"description": "Filter by rule level. Can be a single level (4) or an interval (2-4)",
"schema": {
"type": "string",
"format": "range"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "mitre",
"description": "Filters by MITRE attack ID.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "nist-800-53",
"description": "Filter by NIST-800-53 requirement",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pci_dss",
"description": "Filter by PCI_DSS requirement name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "rule_ids",
"description": "List of rule IDs",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32",
"minimum": 1
}
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by list status. Use commas to enter multiple statuses",
"schema": {
"type": "string",
"enum": [
"enabled",
"disabled",
"all"
],
"minItems": 1
}
},
{
"name": "tsc",
"description": "Filters by TSC requirement.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/rules/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rules_controller.get_rules_files",
"description": "Return a list containing all files used to define rules and their status",
"summary": "Get all files which defines rules",
"tags": [
"rules"
],
"query": [
{
"name": "filename",
"description": "Filter by filename",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "alphanumeric"
}
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "relative_dirname",
"description": "Filter by relative directory name",
"schema": {
"type": "string",
"format": "etc_and_ruleset_path"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by list status. Use commas to enter multiple statuses",
"schema": {
"type": "string",
"enum": [
"enabled",
"disabled",
"all"
],
"minItems": 1
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/rules/files/:filename/download",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rules_controller.get_download_file",
"description": "Download an specified rule file",
"summary": "Download an specified rule file",
"tags": [
"rules"
],
"args": [
{
"name": ":filename",
"required": true,
"description": "Filename to download",
"schema": {
"type": "string",
"format": "alphanumeric"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/rules/groups",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rules_controller.get_rules_groups",
"description": "Return a list containing all rule groups names",
"summary": "Get all rule groups names",
"tags": [
"rules"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/rules/requirement/:requirement",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.rules_controller.get_rules_requirement",
"description": "Return all specified requirement names defined in the Wazuh ruleset",
"summary": "Get all specified requirements",
"tags": [
"rules"
],
"args": [
{
"name": ":requirement",
"required": true,
"schema": {
"type": "string",
"enum": [
"pci_dss",
"gdpr",
"hipaa",
"nist-800-53",
"gpg13",
"tsc",
"mitre"
]
}
}
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/sca/:agent_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.sca_controller.get_sca_agent",
"description": "Return the security SCA database of an agent",
"summary": "Get security configuration assessment (SCA) database",
"tags": [
"sca"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "description",
"description": "Filter by policy description",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "name",
"description": "Filter by policy name",
"schema": {
"type": "string"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "references",
"description": "Filter by references",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/sca/:agent_id/checks/:policy_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.sca_controller.get_sca_checks",
"description": "Return the policy monitoring alerts for a given policy",
"summary": "Get policy monitoring alerts for a given policy",
"tags": [
"sca"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
},
{
"name": ":policy_id",
"description": "Filter by policy id",
"required": true,
"schema": {
"type": "string",
"format": "alphanumeric"
}
}
],
"query": [
{
"name": "command",
"description": "Filter by command",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "condition",
"description": "Filter by condition",
"schema": {
"type": "string"
}
},
{
"name": "description",
"description": "Filter by policy description",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "directory",
"description": "Filter by directory",
"schema": {
"type": "string"
}
},
{
"name": "file",
"description": "Filter by full path",
"schema": {
"type": "string",
"format": "paths"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "process",
"description": "Filter by process name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "rationale",
"description": "Filter by rationale",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "reason",
"description": "Filter by reason",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "references",
"description": "Filter by references",
"schema": {
"type": "string"
}
},
{
"name": "registry",
"description": "Filter by registry",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "remediation",
"description": "Filter by remediation",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "result",
"description": "Filter by result",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "status",
"description": "Filter by status",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "title",
"description": "Filter by title",
"schema": {
"type": "string",
"format": "alphanumeric_symbols"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/actions",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_rbac_actions",
"description": "Get all RBAC actions, including the potential related resources and endpoints.",
"summary": "Get all RBAC actions",
"tags": [
"security"
],
"query": [
{
"name": "endpoint",
"description": "Look for the RBAC actions which are related to the specified endpoint",
"schema": {
"type": "string"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_security_config",
"description": "Return the security configuration in JSON format",
"summary": "Get current security configuration",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_policies",
"description": "Get all policies in the system, including the administrator policy",
"summary": "Get all policies in the system",
"tags": [
"security"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "policy_ids",
"description": "List of policy IDs",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "Policy ID"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/resources",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_rbac_resources",
"description": "This method should be called to get all current defined RBAC resources.",
"summary": "Get RBAC resources",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "resource",
"description": "List of current RBAC's resources.",
"schema": {
"type": "string",
"enum": [
"*:*",
"agent:id",
"group:id",
"node:id",
"file:path",
"decoder:file",
"list:path",
"rule:file",
"policy:id",
"role:id",
"user:id"
]
}
}
]
},
{
"name": "/security/roles",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_roles",
"description": "For a specific list, indicate the ids separated by commas. Example: ?role_ids=1,2,3",
"summary": "Gets a list of roles or all roles in the system without specifying anything",
"tags": [
"security"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "role_ids",
"description": "List of role IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_rules",
"description": "Get a list of security rules from the system or all of them. These rules must be mapped with roles to obtain certain access privileges. For a specific list, indicate the ids separated by commas. Example: ?rule_ids=1,2,3",
"summary": "Get all security rules",
"tags": [
"security"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "rule_ids",
"description": "List of rule IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "Rule ID"
}
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/user/authenticate",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.login_user",
"description": "This method should be called to get an API token. This token will expire after auth_token_exp_timeout seconds (default: 3600). This value can be changed using PUT /security/config",
"summary": "User/password authentication to get an access token",
"tags": [
"security"
],
"query": [
{
"name": "raw",
"description": "Format response in plain text",
"required": false,
"schema": {
"type": "boolean"
}
}
]
},
{
"name": "/security/users",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_users",
"description": "Get the information of a specified user",
"summary": "Get user information",
"tags": [
"security"
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "user_ids",
"description": "List of user IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "User ID"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/users/me",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_user_me",
"description": "Get the information of the current user",
"summary": "Get current user information",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/users/me/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_user_me_policies",
"description": "Get the processed policies information for the current user",
"summary": "Get current user processed policies",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscheck/:agent_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.get_syscheck_agent",
"description": "Return FIM findings in the specified agent",
"summary": "Get File integrity monitoring scan results",
"tags": [
"syscheck"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "distinct",
"description": "Look for distinct values.",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "file",
"description": "Filter by full path",
"schema": {
"type": "string",
"format": "paths"
}
},
{
"name": "hash",
"description": "Filter files with the specified hash (md5, sha256 or sha1)",
"schema": {
"type": "string",
"format": "hash"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "md5",
"description": "Filter files with the specified MD5 checksum",
"schema": {
"type": "string",
"format": "hash"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sha1",
"description": "Filter files with the specified SHA1 checksum",
"schema": {
"type": "string",
"format": "hash"
}
},
{
"name": "sha256",
"description": "Filter files with the specified SHA256 checksum",
"schema": {
"type": "string",
"format": "hash"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "summary",
"description": "Return a summary grouping by filename",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "type",
"description": "Filter by file type",
"schema": {
"type": "string",
"enum": [
"file",
"registry"
]
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscheck/:agent_id/last_scan",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.get_last_scan_agent",
"description": "Return when the last syscheck scan started and ended. If the scan is still in progress the end date will be unknown",
"summary": "Get last syscheck scan dates",
"tags": [
"syscheck"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/hardware",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_hardware_info",
"description": "Return the agent's hardware info. This information include cpu, ram, scan info among others",
"summary": "Get hardware info",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/hotfixes",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_hotfix_info",
"description": "Return all hotfixes installed by Microsoft(R) in Windows(R) systems (KB... fixes)",
"summary": "Get hotfixes",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "hotfix",
"description": "Filter by hotfix",
"schema": {
"type": "string"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/netaddr",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_network_address_info",
"description": "Return the agent's network address info. This information include used IP protocol, interface, IP address among others",
"summary": "Get network address info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "address",
"description": "Filter by IP address",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "broadcast",
"description": "Filter by broadcast direction",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "iface",
"description": "Filter by network interface",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "netmask",
"description": "Filter by netmask",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "proto",
"description": "Filter by IP protocol",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/netiface",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_network_interface_info",
"description": "Return the agent's network interface info. This information include rx, scan, tx info and some network information among others",
"summary": "Get network interface info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "adapter",
"description": "Filter by adapter",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "mtu",
"description": "Filter by mtu",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "name",
"description": "Filter by agent name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "rx.bytes",
"description": "Filter by rx.bytes",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.dropped",
"description": "Filter by rx.dropped",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.errors",
"description": "Filter by rx.errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "rx.packets",
"description": "Filter by rx.packets",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "tx.bytes",
"description": "Filter by tx.bytes",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.dropped",
"description": "Filter by tx.dropped",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.errors",
"description": "Filter by tx.errors",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "tx.packets",
"description": "Filter by tx.packets",
"schema": {
"type": "integer",
"format": "int32",
"minimum": 0
}
},
{
"name": "type",
"description": "Type of file",
"schema": {
"type": "string"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/netproto",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_network_protocol_info",
"description": "Return the agent's routing configuration for each network interface",
"summary": "Get network protocol info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "dhcp",
"description": "Filter by network dhcp (enabled or disabled)",
"schema": {
"type": "string",
"description": "DHCP status",
"enum": [
"enabled",
"disabled",
"unknown",
"BOOTP"
]
}
},
{
"name": "gateway",
"description": "Filter by network gateway",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "iface",
"description": "Filter by network interface",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "type",
"description": "Type of network",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/os",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_os_info",
"description": "Return the agent's OS info. This information include os information, architecture information among others of all agents",
"summary": "Get OS info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/packages",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_packages_info",
"description": "Return the agent's packages info. This information include name, section, size, priority information of all packages among others",
"summary": "Get packages info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "architecture",
"description": "Filter by architecture",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "format",
"description": "Filter by file format. For example 'deb' will output deb files.",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "name",
"description": "Filter by agent name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "vendor",
"description": "Filter by vendor",
"schema": {
"type": "string"
}
},
{
"name": "version",
"description": "Filter by version name",
"schema": {
"type": "string"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/ports",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_ports_info",
"description": "Return the agent's ports info. This information include local IP, Remote IP, protocol information among others",
"summary": "Get ports info of an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "local.ip",
"description": "Filter by Local IP",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "local.port",
"description": "Filter by Local Port",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pid",
"description": "Filter by pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "process",
"description": "Filter by process name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "protocol",
"description": "Filter by protocol",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "remote.ip",
"description": "Filter by Remote IP",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "tx_queue",
"description": "Filter by tx_queue",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscollector/:agent_id/processes",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscollector_controller.get_processes_info",
"description": "Return the agent's processes info",
"summary": "Get processes info an agent",
"tags": [
"syscollector"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "egroup",
"description": "Filter by process egroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "euser",
"description": "Filter by process euser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "fgroup",
"description": "Filter by process fgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "limit",
"description": "Maximum number of elements to return",
"schema": {
"type": "integer",
"format": "int32",
"default": 500,
"minimum": 1,
"maximum": 500
}
},
{
"name": "name",
"description": "Filter by process name",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "nlwp",
"description": "Filter by process nlwp",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "offset",
"description": "First element to return in the collection",
"schema": {
"type": "integer",
"format": "int32",
"default": 0,
"minimum": 0
}
},
{
"name": "pgrp",
"description": "Filter by process pgrp",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pid",
"description": "Filter by process pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "ppid",
"description": "Filter by process parent pid",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "priority",
"description": "Filter by process priority",
"schema": {
"type": "string",
"format": "numbers"
}
},
{
"name": "q",
"description": "Query to filter results by. For example q="status=active"",
"schema": {
"type": "string"
}
},
{
"name": "rgroup",
"description": "Filter by process rgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "ruser",
"description": "Filter by process ruser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "search",
"description": "Look for elements containing the specified string. To obtain a complementary search, use '-' at the\nbeggining\n",
"schema": {
"type": "string",
"format": "search"
}
},
{
"name": "select",
"description": "Select which fields to return (separated by comma). Use '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "names"
}
}
},
{
"name": "sgroup",
"description": "Filter by process sgroup",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "sort",
"description": "Sort the collection by a field or fields (separated by comma). Use +/- at the beggining to list in ascending or descending order.\nUse '.' for nested fields. For example, \"{field1: field2}\" may be selected with \"field1.field2\"\n",
"schema": {
"type": "string",
"format": "sort"
}
},
{
"name": "state",
"description": "Filter by process state",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "suser",
"description": "Filter by process suser",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
}
]
},
{
"method": "PUT",
"endpoints": [
{
"name": "/active-response",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.active_response_controller.run_command",
"description": "Run an Active Response command on all agents",
"summary": "Run AR command in all agents",
"tags": [
"active-response"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"properties": {
"arguments": {
"description": "Command arguments",
"type": "array",
"items": {
"type": "string"
}
},
"command": {
"description": "Command running in the agent. If this value starts by `!`, then it refers to a script name instead of a command name",
"type": "string"
},
"custom": {
"description": "Whether the specified command is a custom command or not",
"type": "boolean",
"default": false
}
},
"required": [
"command"
]
}
]
},
{
"name": "/agents/:agent_id/group/:group_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.put_agent_single_group",
"description": "Assign an agent to a specified group",
"summary": "Assign an agent to a group",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
},
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "force_single_group",
"description": "Whether to append the new group to current agent's multigroup or replace it",
"schema": {
"type": "boolean"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.restart_agent",
"description": "Restart the specified agent",
"summary": "Restart an agent",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/upgrade",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.put_upgrade_agent",
"description": "Upgrade the agent using a WPK file from online repository",
"summary": "Upgrade agent using online repository",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "force",
"description": "Force upgrade",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "use_http",
"description": "Use http protocol. If it's false use https. By default the value is set to false",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "version",
"description": "Wazuh version to upgrade to",
"schema": {
"type": "string"
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wpk_repo",
"description": "WPK repository",
"schema": {
"type": "string",
"format": "path"
}
}
]
},
{
"name": "/agents/:agent_id/upgrade_custom",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.put_upgrade_custom_agent",
"description": "Upgrade the agent using a local WPK file",
"summary": "Upgrade agent using a custom file",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "file_path",
"description": "Full path to the WPK file. The file must be on a folder on the Wazuh's installation directory (by default, /var/ossec)",
"required": true,
"schema": {
"type": "string",
"format": "path"
}
},
{
"name": "installer",
"description": "Installation script. Default is upgrade.sh or upgrade.bat for windows agents",
"schema": {
"type": "string",
"format": "alphanumeric"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/group",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.put_multiple_agent_single_group",
"description": "Assign all agents or a list of them to the specified group",
"summary": "Assign agents to a single group",
"tags": [
"agents"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "force_single_group",
"description": "Whether to append the new group to current agent's multigroup or replace it",
"schema": {
"type": "boolean"
}
},
{
"name": "group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/group/:group_id/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.restart_agents_by_group",
"description": "Restart all agents which belong to a given group",
"summary": "Restart all agents in a group",
"tags": [
"agents"
],
"args": [
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/node/:node_id/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.restart_agents_by_node",
"description": "Restart all agents which belong to a specific given node",
"summary": "Restart all agents which belong to a node",
"tags": [
"agents"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.restart_agents",
"description": "Restart all agents or a list of them",
"summary": "Restart agents",
"tags": [
"agents"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.put_files_node",
"description": "Replace file contents with the data contained in the API request in a specified cluster node",
"summary": "Updates file contents in a specified cluster node",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "overwrite",
"description": "If set to false, an exception will be raised when updating contents of an already existing filename",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "path",
"description": "Filepath to upload/delete file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.put_api_config",
"description": "Update the API configuration of all the selected nodes with the data contained in the API request",
"summary": "Update the API configuration of all nodes (or a list of them)",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"minProperties": 1,
"properties": {
"access": {
"description": "API Security Options",
"type": "object",
"additionalProperties": false,
"properties": {
"max_login_attempts": {
"description": "Maximum number of login attempts in {block_time} seconds",
"type": "integer",
"format": "int32",
"minimum": 1,
"example": 5
},
"block_time": {
"description": "Blocking time for IPs that have exceeded {max_login_attempts}. Time counts from the first attempt",
"type": "integer",
"format": "int32",
"minimum": 0,
"example": 300
},
"max_request_per_minute": {
"description": "Maximum number of requests allowed per minute",
"type": "integer",
"format": "int32",
"minimum": 1,
"example": 300
}
}
},
"behind_proxy_server": {
"description": "Set this option to \"yes\" in case the API is running behind a proxy server.",
"type": "boolean",
"default": false
},
"logs": {
"type": "object",
"additionalProperties": false,
"properties": {
"level": {
"description": "Verbosity level of API logs.",
"default": "info",
"type": "string",
"enum": [
"disabled",
"info",
"warning",
"error",
"debug",
"debug2"
]
}
}
},
"cache": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable cache.",
"type": "boolean",
"default": true
},
"time": {
"description": "Cache expiration time in seconds.",
"type": "number",
"format": "double",
"minimum": 0,
"example": 0.75
}
}
},
"cors": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable CORS",
"type": "boolean",
"default": false
},
"source_route": {
"description": "Sources for which the resources will be available. For example 'http://client.example.org'",
"type": "string",
"example": "*"
},
"expose_headers": {
"description": "Which headers can be exposed as part of the response.",
"type": "string",
"example": "*"
},
"allow_headers": {
"description": "Which HTTP headers can be used during the actual request.",
"type": "string",
"example": "*"
},
"allow_credentials": {
"description": "Browsers will only expose the response to frontend JavaScript code if this is enabled.",
"type": "boolean",
"default": false
}
}
},
"use_only_authd": {
"description": "Force the use of authd when adding and removing agents.",
"type": "boolean",
"default": false
},
"experimental_features": {
"description": "Enable features under development.",
"type": "boolean",
"default": false
}
}
}
]
},
{
"name": "/cluster/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.put_restart",
"description": "Restart all nodes in the cluster or a list of them",
"summary": "Restart cluster nodes",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups/:group_id/configuration",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.put_group_config",
"description": "Update an specified group's configuration. This API call expects a full valid XML file with the shared configuration tags/syntax",
"summary": "Update group configuration",
"tags": [
"groups"
],
"args": [
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.put_api_config",
"description": "Update local API configuration with the data contained in the API request",
"summary": "Update local API configuration",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"minProperties": 1,
"properties": {
"access": {
"description": "API Security Options",
"type": "object",
"additionalProperties": false,
"properties": {
"max_login_attempts": {
"description": "Maximum number of login attempts in {block_time} seconds",
"type": "integer",
"format": "int32",
"minimum": 1,
"example": 5
},
"block_time": {
"description": "Blocking time for IPs that have exceeded {max_login_attempts}. Time counts from the first attempt",
"type": "integer",
"format": "int32",
"minimum": 0,
"example": 300
},
"max_request_per_minute": {
"description": "Maximum number of requests allowed per minute",
"type": "integer",
"format": "int32",
"minimum": 1,
"example": 300
}
}
},
"behind_proxy_server": {
"description": "Set this option to \"yes\" in case the API is running behind a proxy server.",
"type": "boolean",
"default": false
},
"logs": {
"type": "object",
"additionalProperties": false,
"properties": {
"level": {
"description": "Verbosity level of API logs.",
"default": "info",
"type": "string",
"enum": [
"disabled",
"info",
"warning",
"error",
"debug",
"debug2"
]
}
}
},
"cache": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable cache.",
"type": "boolean",
"default": true
},
"time": {
"description": "Cache expiration time in seconds.",
"type": "number",
"format": "double",
"minimum": 0,
"example": 0.75
}
}
},
"cors": {
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable CORS",
"type": "boolean",
"default": false
},
"source_route": {
"description": "Sources for which the resources will be available. For example 'http://client.example.org'",
"type": "string",
"example": "*"
},
"expose_headers": {
"description": "Which headers can be exposed as part of the response.",
"type": "string",
"example": "*"
},
"allow_headers": {
"description": "Which HTTP headers can be used during the actual request.",
"type": "string",
"example": "*"
},
"allow_credentials": {
"description": "Browsers will only expose the response to frontend JavaScript code if this is enabled.",
"type": "boolean",
"default": false
}
}
},
"use_only_authd": {
"description": "Force the use of authd when adding and removing agents.",
"type": "boolean",
"default": false
},
"experimental_features": {
"description": "Enable features under development.",
"type": "boolean",
"default": false
}
}
}
]
},
{
"name": "/manager/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.put_files",
"description": "Replace file contents with the data contained in the API request",
"summary": "Update file contents",
"tags": [
"manager"
],
"query": [
{
"name": "overwrite",
"description": "If set to false, an exception will be raised when updating contents of an already existing filename",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "path",
"description": "Filepath to upload/delete file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/restart",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.put_restart",
"description": "Restart the wazuh manager",
"summary": "Restart the wazuh manager",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.put_security_config",
"description": "Update the security configuration with the data contained in the API request",
"summary": "Update security configuration",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"minProperties": 1,
"properties": {
"auth_token_exp_timeout": {
"description": "Time in seconds until the token expires",
"type": "integer",
"format": "int32",
"minimum": 30,
"example": 3600
},
"rbac_mode": {
"description": "RBAC mode (white/black)",
"type": "string",
"enum": [
"white",
"black"
],
"example": "white"
}
}
}
]
},
{
"name": "/security/policies/:policy_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.update_policy",
"description": "Modify a policy, at least one property must be indicated",
"summary": "Modify a specified policy",
"tags": [
"security"
],
"args": [
{
"name": ":policy_id",
"description": "Specify a policy id",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Policy ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"properties": {
"name": {
"description": "Policy name",
"type": "string"
},
"policy": {
"description": "This is the definition of the new policy",
"type": "object",
"properties": {
"actions": {
"type": "array",
"description": "These are the actions that the policy performs",
"items": {
"type": "string"
}
},
"resources": {
"type": "array",
"description": "Resources accessed by policy",
"items": {
"type": "string"
}
},
"effect": {
"type": "string",
"description": "Effect of the policy"
}
},
"required": [
"actions",
"resources",
"effect"
]
}
}
}
]
},
{
"name": "/security/roles/:role_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.update_role",
"description": "Modify a role, cannot modify associated policies in this endpoint, at least one property must be indicated",
"summary": "Modify a specified role",
"tags": [
"security"
],
"args": [
{
"name": ":role_id",
"description": "Specify a role ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Role name"
}
}
}
]
},
{
"name": "/security/rules/:rule_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.update_rule",
"description": "Modify a security rule by specifying its ID",
"summary": "Modify a security rule",
"tags": [
"security"
],
"args": [
{
"name": ":rule_id",
"description": "Specify a rule ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Rule ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Rule name"
},
"rule": {
"type": "object",
"description": "Rule body"
}
}
}
]
},
{
"name": "/security/user/revoke",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.revoke_all_tokens",
"description": "This method should be called to revoke all JWT tokens",
"summary": "Revoke all active JWT tokens",
"tags": [
"security"
]
},
{
"name": "/security/users/:user_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.update_user",
"description": "Modify a user's password by specifying their ID",
"summary": "Modify a user",
"tags": [
"security"
],
"args": [
{
"name": ":user_id",
"description": "User ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "User ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"name": "allow_run_as",
"type": "boolean",
"default": false
},
{
"name": "password",
"type": "string",
"maxLength": 64,
"minLength": 8,
"format": "password"
}
]
},
{
"name": "/syscheck",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.put_syscheck",
"description": "Run syscheck in all agents",
"summary": "Run a syscheck scan in all agents",
"tags": [
"syscheck"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
}
]
},
{
"method": "POST",
"endpoints": [
{
"name": "/agents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.add_agent",
"description": "Add a new agent",
"summary": "Add agent",
"tags": [
"agents"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"name": "force_time",
"description": "Remove the old agent with the same IP if disconnected since seconds",
"type": "integer",
"format": "int32",
"minimum": 0
},
{
"name": "ip",
"description": "If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option behind_proxy_server to yes at api.yaml and make sure the proxy is setting HTTP header 'X-Forwarded-For' with origin IP address. Allowed values: IP, IP/NET, ANY",
"type": "string",
"format": "alphanumeric"
},
{
"name": "name",
"description": "Agent name",
"type": "string",
"format": "names"
}
]
},
{
"name": "/agents/insert",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.insert_agent",
"description": "Add an agent specifying its name, ID and IP. If an agent with the same ID already exists, replace it using `force` parameter",
"summary": "Add an agent specifying all its basic properties",
"tags": [
"agents"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"name": "force_time",
"description": "Remove the old agent with the same IP if disconnected for seconds",
"type": "integer",
"format": "int32",
"minimum": 0
},
{
"name": "id",
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
},
{
"name": "ip",
"description": "If this is not included, the API will get the IP automatically. If you are behind a proxy, you must set the option behind_proxy_server to yes at api.yaml and make sure the proxy is setting HTTP header 'X-Forwarded-For' with origin IP address. Allowed values: IP, IP/NET, ANY",
"type": "string",
"format": "alphanumeric"
},
{
"name": "key",
"type": "string",
"maxLength": 64,
"minLength": 64,
"format": "wazuh_key",
"description": "Key to use when communicating with the manager. The agent must have the same key on its `client.keys` file"
},
{
"name": "name",
"description": "Agent name",
"type": "string",
"format": "names"
}
]
},
{
"name": "/agents/insert/quick",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.post_new_agent",
"description": "Add a new agent with name `agent_name`. This agent will use `any` as IP",
"summary": "Add agent (quick method)",
"tags": [
"agents"
],
"query": [
{
"name": "agent_name",
"description": "Agent name used when the agent was registered",
"required": true,
"schema": {
"type": "string",
"format": "names",
"maxLength": 128
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.post_group",
"description": "Create a new group",
"summary": "Create a group",
"tags": [
"groups"
],
"query": [
{
"name": "group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.add_policy",
"description": "Add a new policy, all fields need to be specified",
"summary": "Add a new policy",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"required": [
"name",
"policy"
],
"properties": {
"name": {
"description": "Policy name",
"type": "string"
},
"policy": {
"description": "This is the definition of the new policy",
"type": "object",
"properties": {
"actions": {
"type": "array",
"description": "These are the actions that the policy performs",
"items": {
"type": "string"
}
},
"resources": {
"type": "array",
"description": "Resources accessed by policy",
"items": {
"type": "string"
}
},
"effect": {
"type": "string",
"description": "Effect of the policy"
}
},
"required": [
"actions",
"resources",
"effect"
]
}
}
}
]
},
{
"name": "/security/roles",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.add_role",
"description": "Add a new role, all fields need to be specified",
"summary": "Add a new role to the system",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Role name"
}
}
}
]
},
{
"name": "/security/roles/:role_id/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.set_role_policy",
"description": "Create a specified relation role-policy, one role may have multiples policies",
"summary": "Create a relation between one role and one or more policies",
"tags": [
"security"
],
"args": [
{
"name": ":role_id",
"description": "Specify a role ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
],
"query": [
{
"name": "policy_ids",
"description": "List of policy IDs",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "Policy ID"
}
}
},
{
"name": "position",
"description": "Security position for roles/policies",
"required": false,
"schema": {
"type": "integer",
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/roles/:role_id/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.set_role_rule",
"description": "Create a specific role-rule relation. One role may have multiple security rules",
"summary": "Create a relation between one role and one or more security rules",
"tags": [
"security"
],
"args": [
{
"name": ":role_id",
"description": "Specify a role ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "rule_ids",
"description": "List of rule IDs (separated by comma)",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers",
"description": "Rule ID"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.add_rule",
"description": "Add a new security rule",
"summary": "Add a new security rule to the system",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"type": "object",
"required": [
"name",
"rule"
],
"properties": {
"name": {
"type": "string",
"description": "Rule name"
},
"rule": {
"type": "object",
"description": "Rule body"
}
}
}
]
},
{
"name": "/security/user/authenticate/run_as",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.login_user",
"description": "This method should be called to get an API token using an authorization context body. This token will expire after auth_token_exp_timeout seconds (default: 3600). This value can be changed using PUT /security/config",
"summary": "Auth_context based authentication to get an access token",
"tags": [
"security"
],
"query": [
{
"name": "raw",
"description": "Format response in plain text",
"required": false,
"schema": {
"type": "boolean"
}
}
],
"body": [
{
"name": "type",
"type": "object"
}
]
},
{
"name": "/security/users",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.create_user",
"description": "Add a new user to the system through the API",
"summary": "Create new user",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
],
"body": [
{
"name": "allow_run_as",
"type": "boolean",
"default": false
},
{
"name": "password",
"type": "string",
"maxLength": 64,
"minLength": 8,
"format": "password"
},
{
"name": "username",
"type": "string",
"minLength": 4,
"maxLength": 20,
"format": "names"
}
]
},
{
"name": "/security/users/:user_id/roles",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.set_user_role",
"description": "Create a specified relation role-policy, one user may have multiples roles",
"summary": "Create a specified relation between one user and one role",
"tags": [
"security"
],
"args": [
{
"name": ":user_id",
"description": "User ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "User ID"
}
}
],
"query": [
{
"name": "position",
"description": "Security position for roles/policies",
"required": false,
"schema": {
"type": "integer",
"minimum": 0
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "role_ids",
"description": "List of role IDs (separated by comma)",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"description": "Role ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
}
]
},
{
"method": "DELETE",
"endpoints": [
{
"name": "/agents",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.delete_agents",
"description": "Delete all agents or a list of them with optional criteria based on the status or time of the last connection",
"summary": "Delete agents",
"tags": [
"agents"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma), use the keyword 'all' to select all agents",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "older_than",
"description": "Consider only agents whose last keep alive is older than the specified time frame. For never_connected agents, register date is considered instead of last keep alive. For example, `7d`, `10s` and `10` are valid values. When no time unit is specified, seconds are assumed. Default value: 7d\n",
"schema": {
"type": "string",
"format": "timeframe",
"default": "7d"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "purge",
"description": "Permanently delete an agent from the key store",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "status",
"description": "Filter by agent status. Use commas to enter multiple statuses",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"active",
"pending",
"never_connected",
"disconnected"
]
},
"minItems": 1
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/group",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.delete_single_agent_multiple_groups",
"description": "Remove the agent from all groups or a list of them. The agent will automatically revert to the \"default\" group if it is removed from all its assigned groups",
"summary": "Remove agent from groups",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "groups_list",
"description": "Array of group IDs",
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/:agent_id/group/:group_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.delete_single_agent_single_group",
"description": "Remove an agent from an specified group. If the agent has multigroups, it will preserve all previous groups except the last one",
"summary": "Remove an agent from a specific group",
"tags": [
"agents"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
},
{
"name": ":group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/agents/group",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.delete_multiple_agent_single_group",
"description": "Remove all agents assignment or a list of them from the specified group",
"summary": "Remove agents assignment from a single group",
"tags": [
"agents"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma), use the keyword 'all' to select all agents",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "group_id",
"description": "Group ID. (Name of the group)",
"required": true,
"schema": {
"type": "string",
"minLength": 1,
"description": "Group name",
"format": "group_names"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/:node_id/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.delete_files_node",
"description": "Remove a specified file in the node {node-id}",
"summary": "Removes a file in a specified cluster node",
"tags": [
"cluster"
],
"args": [
{
"name": ":node_id",
"description": "Cluster node name",
"required": true,
"schema": {
"type": "string",
"format": "names"
}
}
],
"query": [
{
"name": "path",
"description": "Filepath to upload/delete file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/cluster/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.cluster_controller.delete_api_config",
"description": "Replace the API configuration of all the selected nodes with the default one",
"summary": "Restore the default API configuration of all nodes (or a list of them)",
"tags": [
"cluster"
],
"query": [
{
"name": "nodes_list",
"description": "List of node IDs (separated by comma)",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/experimental/syscheck",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.experimental_controller.clear_syscheck_database",
"description": "Clear the syscheck database for all agents or a list of them",
"summary": "Clear agents syscheck database",
"tags": [
"experimental"
],
"query": [
{
"name": "agents_list",
"description": "List of agent IDs (separated by comma), use the keyword 'all' to select all agents",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 3,
"description": "Agent ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/groups",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.agents_controller.delete_groups",
"description": "Delete all groups or a list of them",
"summary": "Delete groups",
"tags": [
"groups"
],
"query": [
{
"name": "groups_list",
"description": "List of group IDs (separated by comma), use the keyword 'all' to select all groups",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"description": "Group name|all",
"format": "group_names_delete"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/api/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.delete_api_config",
"description": "Replace local API configuration with the original one",
"summary": "Restore default API configuration",
"tags": [
"manager"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/manager/files",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.manager_controller.delete_files",
"description": "Remove a specified file",
"summary": "Removes a file",
"tags": [
"manager"
],
"query": [
{
"name": "path",
"description": "Filepath to upload/delete file. (Relative to wazuh installation folder)",
"required": true,
"schema": {
"type": "string",
"format": "etc_file_path"
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/config",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.delete_security_config",
"description": "Replaces the security configuration with the original one",
"summary": "Restore default security configuration",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_policies",
"description": "Roles linked to policies are not going to be removed",
"summary": "Delete a list of policies or all policies in the system",
"tags": [
"security"
],
"query": [
{
"name": "policy_ids",
"description": "List of policy IDs (separated by comma), use the keyword 'all' to select all policies",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"description": "Policy ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/roles",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_roles",
"description": "Policies linked to roles are not going to be removed",
"summary": "Delete a list of roles or all roles in the system",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "role_ids",
"description": "List of role IDs (separated by comma), use the keyword 'all' to select all roles",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"description": "Role ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/roles/:role_id/policies",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_role_policy",
"description": "Delete a specified relation role-policy",
"summary": "Delete a specified relation role-policy",
"tags": [
"security"
],
"args": [
{
"name": ":role_id",
"description": "Specify a role ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
],
"query": [
{
"name": "policy_ids",
"description": "List of policy IDs (separated by comma), use the keyword 'all' to select all policies",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"description": "Policy ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/roles/:role_id/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_role_rule",
"description": "Delete a specific role-rule relation",
"summary": "Delete a specific role-rule relation",
"tags": [
"security"
],
"args": [
{
"name": ":role_id",
"description": "Specify a role ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "Role ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "rule_ids",
"description": "List of rule IDs (separated by comma), use the keyword 'all' to select all rules",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers_delete",
"description": "Rule ID|all"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/rules",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_rules",
"description": "Roles linked to rules are not going to be removed",
"summary": "Delete a list of security rules or all security rules in the system",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "rule_ids",
"description": "List of rule IDs (separated by comma), use the keyword 'all' to select all rules",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers_delete",
"description": "Rule ID|all"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/user/authenticate",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.logout_user",
"description": "This method should be called to invalidate all the current user's tokens.",
"summary": "Logout current user",
"tags": [
"security"
]
},
{
"name": "/security/users",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.delete_users",
"description": "Delete a list of users by specifying their IDs",
"summary": "Delete a list of users",
"tags": [
"security"
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "user_ids",
"description": "List of user IDs (separated by comma), use the keyword 'all' to select all users",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"format": "numbers_delete",
"description": "User ID|all"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/security/users/:user_id/roles",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.remove_user_role",
"description": "Delete a specified relation user-roles",
"summary": "Delete a specified relation user-roles",
"tags": [
"security"
],
"args": [
{
"name": ":user_id",
"description": "User ID",
"required": true,
"schema": {
"type": "string",
"format": "numbers",
"description": "User ID"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "role_ids",
"description": "List of role IDs (separated by comma), use the keyword 'all' to select all roles",
"required": true,
"schema": {
"type": "array",
"items": {
"type": "string",
"description": "Role ID|all",
"format": "numbers_delete"
}
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
},
{
"name": "/syscheck/:agent_id",
"documentation": "https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.syscheck_controller.delete_syscheck_agent",
"description": "Clear file integrity monitoring scan results for a specified agent",
"summary": "Clear FIM scan results for a specified agent",
"tags": [
"syscheck"
],
"args": [
{
"name": ":agent_id",
"description": "Agent ID. All possible values from 000 onwards",
"required": true,
"schema": {
"type": "string",
"minLength": 3,
"description": "Agent ID",
"format": "numbers"
}
}
],
"query": [
{
"name": "pretty",
"description": "Show results in human-readable format",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "wait_for_complete",
"description": "Disable timeout response",
"schema": {
"type": "boolean",
"default": false
}
}
]
}
]
}
]