EclecticIQ Platform API

MITRE Attacks
- Get a list of MITRE Attacks.get
- Get MITRE Attack by ID.get
Datasets
Enrichers
Entities
Files
Groups
Incoming feeds
Knowledge Packs
Observables
Outgoing feeds
Permissions
- Returns a list of permissions on the platform.get
- Get a user permission by ID.get
Relationships
Roles
Discovery Rules
Enrichment Rules
Entity Rules
Observable Rules
Sources
- Get a list of all sources.get
- Get an source by ID.get
Tasks
Taxonomies
Tickets
Ticket Comments
- Get a ticket comment by ID.get
- Create a comment on a ticket.post
Users
Workspaces
Workspace Comments
Relation

Create a user.

post http://localhost/api/v1/users

Required permissions

modify users

Optional permissions

modify user-groups Required if you want to modify the groups associated to a user
modify user-roles Required if you want to modify the roles associated to a user
read permissions Required to access the permissions associated with a user
read sources Required to access the sources associated with a user

time	status	user agent
Retrieving recent requests…

Loading…

URL Expired

The URL for this request expired after 30 days.

Body Params

data

object

Responses

Response body

object

data

object

activation_link

url

This field is specified if the user has not been activated yet, and it is only visible to the user itself and to platform admins

created_at

string

User creation date

string

User email address

first_name

string

User first name

groups

string

List of groups the user is subscribed to. Possible values for roles: ['admin', 'member']

has_mfa_activated

boolean

True if the user has multi-factor authentication enabled

int32

required

User ID

is_admin

boolean

The user is a platform admin. This flag can only be modified by other admin users

last_name

string

User last name

last_updated_at

string

User last update

password_last_updated_at

string

When the user password was last updated

permissions

string

List of permissions associated to the user

roles

string

List of roles associated to the user

sources

string

List of sources the user is allowed to access

status

string

User status

inactive locked password reset requested pending active

username

string

User name

Response body

object

detail

string

status

integer

title

string

Response body

object

detail

string

status

integer

title

string

Response body

object

detail

string

status

integer

title

string

Response body

object

detail

string

status

integer

title

string

Updated over 3 years ago

Returns a list of users on the platform.

Create (or update if the name already exists) one or more users.

Language

Credentials

Bearer

JWT


xxxxxxxxxx
1
curl --request POST \
2
     --url http://localhost/api/v1/users \
3
     --header 'accept: application/json' \
4
     --header 'content-type: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

Updated over 3 years ago

Returns a list of users on the platform.

Create (or update if the name already exists) one or more users.

EclecticIQ Platform API
MITRE Attacks
Get MITRE Attack by ID.get
Get a list of MITRE Attacks.get
Datasets
Update a dataset.patch
Get a dataset by ID.get
Delete a dataset.delete
Create (or update if the name already exists) one or more datasets.put
Create a dataset.post
Get a list of datasets.get
Delete a set of datasets referenced by IDs.delete
Enrichers
Modify an enricher.patch
Get an enricher by ID.get
Enriches all given extracts and/or entities with a list of enrichers or with all available enrichers (if `enricher_tasks` is empty). If a list entities is provided, all entity extracts are enriched.post
Create (or modify if the name already exists) one or more enrichers.put
Create a new enricher.post
Get a list of enrichers.get
Entities
Update an entity by ID.patch
Get an entity by ID.get
Delete an entity by ID.delete
Create (or update/create a new version if the STIX ID already exists) one or more entities.put
Create an entity.post
Get a list of entities.get
Delete a set of entities referenced by internal or STIX IDs.delete
Files
Download a file by ID.get
Get a workspace file by ID.get
Delete a workspace file by ID.delete
Create a new file in a workspace.post
Get a list of workspace files.get
Delete a set of files referenced by IDs.delete
Download an entity attachment by ID.get
Get an entity attachment by ID.get
Delete an entity attachment by ID.delete
Create a new entity.post
Get a list of entity attachments.get
Delete a set of attachments referenced by IDs.delete
Groups
Update a group.patch
Get a group by ID.get
Delete a group by ID.delete
Create (or modify if the name already exists) one or more groups.put
Create a group.post
Returns a list of the groups on the platform.get
Delete a set of groups referenced by IDs.delete
Incoming feeds
Edit an incoming feed configuration by ID.patch
Get an incoming feed by ID.get
Delete an incoming feed configuration by ID.delete
Create (or update if the name already exists) an incoming feed.put
Configure a new incoming feed. Depending on the content type it will be required to provide additional transport configuration fields. For more details see the documentationpost
Get a list of incoming feeds.get
Delete a set of incoming feeds referenced by IDs.delete
Knowledge Packs
Update a knowledge pack.patch
Get a Knowledge Pack by ID.get
Delete a knowledge pack as publisher.delete
Create (or modify if already exists) one or more knowledge packs.put
Create a new knowledge pack.post
Returns a list of knowledge packs.get
Observables
Edit an observable by ID.patch
Get an observable by ID.get
Delete an observable by ID.delete
Create (or update if the (`type`, `value`) pair already exists) one or more observables.put
Create a new observable.post
Get a list of observables.get
Delete a set of observables referenced by IDs.delete
Outgoing feeds
Edit an outgoing feed configuration by ID.patch
Get an outgoing feed by ID.get
Delete an outgoing feed configuration by ID.delete
Create (or update if the name already exists) one or more outgoing feeds.put
Configure a new outgoing feed. Depending on the content type it will be required to provide additional transport configuration fields. For more details see the documentationpost
Get a list of outgoing feeds.get
Delete a set of outgoing feeds referenced by IDs.delete
Permissions
Get a user permission by ID.get
Returns a list of permissions on the platform.get
Relationships
Get a relationship by ID.get
Delete a relationship by ID.delete
Create a relationship.post
Get a list of relationships.get
Delete relationships based on source and/or target.delete
Roles
Update a role.patch
Get a role by ID.get
Delete a role by ID.delete
Create (or modify if the name already exists) one or more roles.put
Create a role.post
Returns a list of roles on the platform.get
Delete a set of roles referenced by IDs.delete
Discovery Rules
Edit an discovery rule by ID.patch
Get an discovery rule by ID.get
Delete an discovery rule by ID.delete
Create (or update if the name already exists) one or more discovery rules.put
Create a new discovery rule.post
Get a list of discovery rules.get
Delete a set of discovery_rules referenced by IDs.delete
Enrichment Rules
Edit an enrichment rule by ID.patch
Get an enrichment rule by ID.get
Delete an enrichment rule by ID.delete
Create (or update if the name already exists) one or more enrichment rules.put
Create a new enrichment rule.post
Get a list of enrichment rules.get
Delete a set of enrichment rules referenced by IDs.delete
Entity Rules
Edit an entity rule by ID.patch
Get an entity rule by ID.get
Delete an entity rule by ID.delete
Create (or update if the name already exists) one or more entity rules.put
Create a new entity rule.post
Get a list of entity rules.get
Delete a set of entity rules referenced by IDs.delete
Observable Rules
Edit an observable rule by ID.patch
Get an observable rule by ID.get
Delete an observable rule by ID.delete
Create (or update if the name already exists) one or more observable rules.put
Create a new observable rule.post
Get a list of observable rules.get
Delete a set of observable rules referenced by IDs.delete
Sources
Get an source by ID.get
Get a list of all sources.get
Tasks
Edit a task by ID.patch
Get a task by ID.get
Get a task run by ID.get
Stop a task execution by task run ID.delete
Run a task.post
Get a list of task runs.get
Get a list of tasks.get
Taxonomies
Update a taxonomy node.patch
Get a taxonomy node by ID.get
Delete a taxonomy node or a sub-tree.delete
Create taxonomy nodes by specifying a single node or a node path.put
Create taxonomy nodes by specifying a single node or a node path.post
Get a list of taxonomies.get
Delete a set of taxonomies nodes referenced by IDs.delete
Tickets
Update a ticket by ID.patch
Get a ticket by ID.get
Delete a ticket by ID.delete
Create a ticket.post
Get a list of all tickets.get
Delete a set of tickets referenced by IDs.delete
Ticket Comments
Create a comment on a ticket.post
Get a ticket comment by ID.get
Users
Update a user.patch
Get a user by ID.get
Create (or update if the name already exists) one or more users.put
Create a user.post
Returns a list of users on the platform.get
Workspaces
Edit a workspace by ID.patch
Get a workspace by ID.get
Delete a workspace by ID.delete
Create (or update if the name already exists) one or more workspaces.put
Create a new workspace.post
Get a list of workspaces.get
Delete a set of workspaces referenced by IDs.delete
Workspace Comments
Create a new workspace comment.post
Get the content of the comments of a workspace.get
Modify a workspace comment by ID.patch
Get a workspace comment by ID.get
Delete a workspace comment by ID.delete
Delete a set of workspace comments referenced by IDs.delete
Relation
Generic endpoint for adding a relation based on "main object" type and id and related object type and id.put
Generic endpoint for deleting a relation based on "main object" type and id and related object type and id.delete
Generic endpoint for bulk adding relations based on "main object" type and id and related objects type and ids (provided in request body).put
Generic endpoint for bulk deleting relations based on "main object" type and id and related objects type and ids (provided in request body).delete

201The created object

400Invalid request

401Unauthorized request

403Missing permissions

409The element already exists