{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"2"},"maxLevel":{"value":"2"},"outline":{"value":"false"},"type":{"value":"flat"},"separator":{"value":"brackets"},"printable":{"value":"false"}},"macroMetadata":{"macroId":{"value":"76a8c729-58b1-466f-995b-7c645463ef68"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"1f622566-8d9d-469f-a4e2-830db5a17ffc"}},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"html-macro","parameters":{"macroParams":{"__bodyContent":{"value":"

Hello world!

"},"sanitize":{"value":"false"},"height":{"value":""}},"macroMetadata":{"macroId":{"value":"a438aed8-6ee5-4222-911e-d18040665264"},"schemaVersion":{"value":"1"},"title":"HTML"}},"localId":"69da3d95-aee4-413c-892a-b46dd6a6ad13"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Authorization header","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"iframe","parameters":{"macroParams":{"scrolling":{"value":"yes"},"allowfullscreen":{"value":"true"},"src":{"value":"https://api-us.devo.com/lookup-api/swagger/#/"},"width":{"value":"100%"},"frameborder":{"value":"hide"},"align":{"value":"left"},"height":{"value":"4692.47px"}},"macroMetadata":{"macroId":{"value":"740ebf1d973470c95094560318217526c1db3a997e9e0beee8d2bdafe7b6960a"},"schemaVersion":{"value":"1"},"title":"Iframe"}},"localId":"3c5329e8-5006-4846-902c-3b02809e57c5"}},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"open-api","parameters":{"macroParams":{"__bodyContent":{"value":"openapi: 3.0.2\ninfo:\n title: Lookup REST API\n description: |-\n API to manage lookup life cycle by communicating with the Lookups\n Manager via the HTTP protocol following REST principles.\n termsOfService: https://www.devo.com/legal\n contact:\n name: Devo Inc\n url: https://www.devo.com\n email: support@devo.com\n license:\n name: Devo license\n url: https://www.devo.com\n version: 2.2.0-SNAPSHOT\nexternalDocs:\n description: External docs description\n url: https://docs.devo.com/space/latest/127500289/Lookups+API\nservers:\n- url: https://api.apac.devo.com/lookup-api\n description: AWS APAC Lookup API server\n- url: https://api.ca.devo.com/lookup-api\n description: AWS CA Lookup API server\n- url: https://api.eu.devo.com/lookup-api\n description: AWS EU Lookup API server\n- url: https://api.us.devo.com/lookup-api\n description: AWS US Lookup API server\npaths:\n /internal/lookup/{domain}/{name}:\n delete:\n summary: Send a lookup deletion request.\n description: Asynchronously send a request to the Lookups Manager to delete\n an existing Lookup.\n operationId: internalDeleteLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the deletion request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupDeletionResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to delete a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/internal/lookup/galactic_empire/destroyed_planets'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. User credentials are correct but the\n domain or the lookup do not exist.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupDeletionError'\n example:\n type: LookupDeletionError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /internal/lookup/{domain}/{name}/deploy-config:\n put:\n summary: Asynchronously send a request to the Lookups Manager to create or update\n a `Lookup`.\n description: Update the configuration for a given lookup.\n operationId: internalPutLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: forceFileType\n in: query\n description: \"If true, the lookup will always be saved as a file lookup. If\\\n \\ unset or false, it will get the lookup type from the Recipe.\"\n required: false\n style: form\n explode: true\n schema:\n type: boolean\n default: false\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployConfig'\n examples:\n simpleStaticQuery:\n value:\n id:\n creator: rebel_alliance\n name: TotallyNotFakeData\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select 0 as key, false as IsDataFake, 2147483647 as\\\n \\ RebelsImprisoned, 9223372036854775807 as CreditsOnImperialBanks,\\\n \\ hex4('fffffff') as Hex4Emperor, hex8('fffffffffffffff')\\\n \\ as Hex8Vader, 2.718281828459045 as EmperorClones, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as EmperorIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as EmperorIP6, 0m as TimeAfterBattleOfYavin, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: key\n columnFilter:\n - key\n - IsDataFake\n - RebelsImprisoned\n - CreditsOnImperialBanks\n - Hex4Emperor\n - Hex8Vader\n - EmperorClones\n - Pi\n - EmperorIP4\n - EmperorIP6\n - TimeAfterBattleOfYavin\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n complexStaticQuery:\n value:\n id:\n creator: galactic_empire\n name: ImperialIntranetActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select eventdate, domain, userid from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - domain\n - userid\n contribution:\n type: add\n requiresDate: false\n simpleStaticS3File:\n value:\n id:\n creator: jedi_order\n name: ForceSensitiveBeings\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT8\n - name: Location\n from: 1\n type: STRING\n - name: Age\n from: 2\n type: FLOAT8\n - name: Species\n from: 3\n type: STRING\n - name: MidiclorianLevel\n from: 4\n type: FLOAT4\n - name: Hex4Age\n from: 5\n type: HEX4\n - name: Hex8Age\n from: 6\n type: HEX8\n - name: CommLinkIP4\n from: 7\n type: IP4\n - name: CommLinkIP6\n from: 8\n type: IP6\n - name: TimeFromDiscovery\n from: 9\n type: DURATION\n - name: EmpireCIDR4\n from: 10\n type: NET4\n - name: EmpireCIDR6\n from: 11\n type: NET6\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n - Age\n - Species\n - MidiclorianLevel\n - Hex4Age\n - Hex8Age\n - CommLinkIP4\n - CommLinkIP6\n - TimeFromDiscovery\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n simpleDynamicQuery:\n value:\n id:\n creator: confederation_of_independent_systems\n name: TotallyNotFakeData\n recipe:\n recipeType: once\n source:\n query: \"select now() as key, false as IsPalpatineLordSidious,\\\n \\ 2147483647 as ClonesImprisoned, 9223372036854775807 as CreditsOnBankingClan,\\\n \\ hex4('fffffff') as Hex4Sidious, hex8('fffffffffffffff')\\\n \\ as Hex8Dooku, 2.718281828459045 as DroidsRandomSeed, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as GrievousIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as DroidekaIP6, 0m as TimeAfterBattleOfGeonosis, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: true\n key:\n type: first-column\n columnFilter:\n - key\n - IsPalpatineLordSidious\n - ClonesImprisoned\n - CreditsOnBankingClan\n - Hex4Sidious\n - Hex8Dooku\n - DroidsRandomSeed\n - Pi\n - GrievousIP4\n - DroidekaIP6\n - TimeAfterBattleOfGeonosis\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n complexDynamicQuery:\n value:\n id:\n creator: galactic_republic\n name: RepublicSenateWebActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select eventdate, sessionid, userEmail from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - sessionid\n - userEmail\n contribution:\n type: add\n requiresDate: false\n refreshMillis: 3600000\n startMillis: 537796640000\n allSubdomainsS3File:\n value:\n id:\n creator: council@jedi_order\n name: JediTempleExits\n visibility:\n type: all-subdomains\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT4\n - name: Location\n from: 1\n type: STRING\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: info-bucket\n keyName: public/data/temple-exits.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n contribution:\n type: add\n requiresDate: false\n required: true\n responses:\n \"200\":\n description: Successful response. The actual deployment is returned.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: a58a233b4a27\n code: 400\n context: null\n id: ae34801e-5387-11ed-859a-532f757eb240\n msg: \"Contribution policy values can be 'add', 'del' and 'col'\"\n \"401\":\n description: Unsuccessful response. User unauthorized to update a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/internal/lookup/galactic_empire/destroyed_planets/deploy-config'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. User credentials are correct but the\n domain or the lookup do not exist.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /internal/lookup/{domain}/{name}/disable:\n post:\n summary: Disables an enabled Lookup setting it as inactive.\n operationId: internalDisableLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: Successful response. Lookup was disabled.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to disable a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/internal/lookup/galactic_empire/destroyed_planets/disable'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. User credentials are correct but the\n domain or the lookup do not exist.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationError'\n example:\n type: LookupActivationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /internal/lookup/{domain}/{name}/enable:\n post:\n summary: Enables a disabled Lookup setting it as active.\n operationId: internalEnableLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: Successful response. Lookup was enabled.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to enable a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/internal/lookup/galactic_empire/destroyed_planets/enable'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. User credentials are correct but the\n domain or the lookup do not exist.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationError'\n example:\n type: LookupActivationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /internal/notify:\n post:\n summary: Notify lookup creation/deletion.\n operationId: internalNotifyLookup\n responses:\n \"200\":\n description: Successful response. Lookup was disabled.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to disable a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/internal/lookup/galactic_empire/destroyed_planets/disable'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. User credentials are correct but the\n domain or the lookup do not exist.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupActivationError'\n example:\n type: LookupActivationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /lookup/{domain}:\n get:\n summary: Returns meta information of the lookups existing on a given domain.\n operationId: listLookups\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: max_length\n in: query\n description: Max length of results to return. Defaults to 100.\n required: false\n style: form\n explode: true\n schema:\n maximum: 1000\n minimum: 1\n type: integer\n default: 100\n - name: pageToken\n in: query\n description: The token for continuing a previous list request on the next\n page. This should be set to the value of nextPageToken from the previous\n response.\n required: false\n style: form\n explode: true\n schema:\n minimum: 0\n type: integer\n format: int32\n default: 0\n - name: owner\n in: query\n description: |-\n Whether the API should return lookups whose owner is the user's domain, whose owners are other domains, but the user's domain has visibility over them or all of them. Supported values are:\n - THIS_DOMAIN: Only return lookups owned by the user's domain.\n - OTHER_DOMAINS: Only return lookups owned by other domains but\n are shared with the user's domain.\n - ANY_DOMAIN: Return both lookups owned by the user's domain\n and visible by it.\n Defaults to THIS_DOMAIN.\n required: false\n style: form\n explode: true\n schema:\n type: string\n enum:\n - THIS_DOMAIN\n - OTHER_DOMAINS\n - ANY_DOMAIN\n default: THIS_DOMAIN\n responses:\n \"200\":\n description: Successful response. Returns the list of lookups for the specified\n domain\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupMetaInfoListResponse'\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/ValidationError'\n example:\n code: 140\n msg: Validation failed.\n cid: 981d4e9056da\n context:\n failures: arg2 = 1001 <= must be less than or equal to 1000\n \"401\":\n description: Unsuccessful response. User unauthorized to list domain's lookups.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupMetaInfoListResponse'\n example:\n type: LookupMetaInfoListResponse\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /lookup/{domain}/{name}:\n get:\n summary: Returns the given lookup meta information.\n operationId: getLookupMetaInfo\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: Successful response. Returns the meta information of the given\n lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupMetaInfoResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to get the lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupMetaInfoResponseError'\n example:\n type: LookupMetaInfoResponseError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Lookup not found.\n delete:\n summary: Send a lookup deletion request.\n description: Asynchronously send a request to the Lookups Manager to delete\n an existing Lookup.\n operationId: deleteLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the deletion request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupDeletionResponse'\n \"401\":\n description: Unsuccessful response. User unauthorized to delete a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupDeletionError'\n example:\n type: LookupDeletionError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /lookup/{domain}/{name}/deploy-config:\n put:\n summary: Send a lookup update request (advanced method).\n description: Advanced method to send a request to update an existing Lookup.\n This method is valid for both file-based (CSV) and query-based lookups.\n operationId: putLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: shared\n in: query\n description: \"If true, the lookup will be saved as a shared lookup. If unset\\\n \\ or false, it will be saved as a private lookup.\"\n required: false\n style: form\n explode: true\n schema:\n type: boolean\n default: false\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployConfig'\n examples:\n simpleStaticQuery:\n value:\n id:\n creator: rebel_alliance\n name: TotallyNotFakeData\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select 0 as key, false as IsDataFake, 2147483647 as\\\n \\ RebelsImprisoned, 9223372036854775807 as CreditsOnImperialBanks,\\\n \\ hex4('fffffff') as Hex4Emperor, hex8('fffffffffffffff')\\\n \\ as Hex8Vader, 2.718281828459045 as EmperorClones, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as EmperorIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as EmperorIP6, 0m as TimeAfterBattleOfYavin, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: key\n columnFilter:\n - key\n - IsDataFake\n - RebelsImprisoned\n - CreditsOnImperialBanks\n - Hex4Emperor\n - Hex8Vader\n - EmperorClones\n - Pi\n - EmperorIP4\n - EmperorIP6\n - TimeAfterBattleOfYavin\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n complexStaticQuery:\n value:\n id:\n creator: galactic_empire\n name: ImperialIntranetActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select eventdate, domain, userid from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - domain\n - userid\n contribution:\n type: add\n requiresDate: false\n simpleStaticS3File:\n value:\n id:\n creator: jedi_order\n name: ForceSensitiveBeings\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT8\n - name: Location\n from: 1\n type: STRING\n - name: Age\n from: 2\n type: FLOAT8\n - name: Species\n from: 3\n type: STRING\n - name: MidiclorianLevel\n from: 4\n type: FLOAT4\n - name: Hex4Age\n from: 5\n type: HEX4\n - name: Hex8Age\n from: 6\n type: HEX8\n - name: CommLinkIP4\n from: 7\n type: IP4\n - name: CommLinkIP6\n from: 8\n type: IP6\n - name: TimeFromDiscovery\n from: 9\n type: DURATION\n - name: EmpireCIDR4\n from: 10\n type: NET4\n - name: EmpireCIDR6\n from: 11\n type: NET6\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n - Age\n - Species\n - MidiclorianLevel\n - Hex4Age\n - Hex8Age\n - CommLinkIP4\n - CommLinkIP6\n - TimeFromDiscovery\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n simpleDynamicQuery:\n value:\n id:\n creator: confederation_of_independent_systems\n name: TotallyNotFakeData\n recipe:\n recipeType: once\n source:\n query: \"select now() as key, false as IsPalpatineLordSidious,\\\n \\ 2147483647 as ClonesImprisoned, 9223372036854775807 as CreditsOnBankingClan,\\\n \\ hex4('fffffff') as Hex4Sidious, hex8('fffffffffffffff')\\\n \\ as Hex8Dooku, 2.718281828459045 as DroidsRandomSeed, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as GrievousIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as DroidekaIP6, 0m as TimeAfterBattleOfGeonosis, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: true\n key:\n type: first-column\n columnFilter:\n - key\n - IsPalpatineLordSidious\n - ClonesImprisoned\n - CreditsOnBankingClan\n - Hex4Sidious\n - Hex8Dooku\n - DroidsRandomSeed\n - Pi\n - GrievousIP4\n - DroidekaIP6\n - TimeAfterBattleOfGeonosis\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n complexDynamicQuery:\n value:\n id:\n creator: galactic_republic\n name: RepublicSenateWebActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select eventdate, sessionid, userEmail from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - sessionid\n - userEmail\n contribution:\n type: add\n requiresDate: false\n refreshMillis: 3600000\n startMillis: 537796640000\n allSubdomainsS3File:\n value:\n id:\n creator: council@jedi_order\n name: JediTempleExits\n visibility:\n type: all-subdomains\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT4\n - name: Location\n from: 1\n type: STRING\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: info-bucket\n keyName: public/data/temple-exits.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n contribution:\n type: add\n requiresDate: false\n required: true\n responses:\n \"200\":\n description: Successful response. The actual deployment is returned.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example: null\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: a58a233b4a27\n code: 400\n context: null\n id: ae34801e-5387-11ed-859a-532f757eb240\n msg: \"Contribution policy values can be 'add', 'del' and 'col'\"\n \"401\":\n description: Unsuccessful response. User unauthorized to update a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-config'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n post:\n summary: Send a lookup creation request (advanced method).\n description: Advanced method to send a request to create a new Lookup. This\n method is valid for both file-based (CSV) and query-based lookups.\n operationId: createLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: shared\n in: query\n description: \"If true, the lookup will be saved as a shared lookup. If unset\\\n \\ or false, it will be saved as a private lookup.\"\n required: false\n style: form\n explode: true\n schema:\n type: boolean\n default: false\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployConfig'\n examples:\n simpleStaticQuery:\n value:\n id:\n creator: rebel_alliance\n name: TotallyNotFakeData\n recipe:\n recipeType: once\n source:\n query: \"select 0 as key, false as IsDataFake, 2147483647 as\\\n \\ RebelsImprisoned, 9223372036854775807 as CreditsOnImperialBanks,\\\n \\ hex4('fffffff') as Hex4Emperor, hex8('fffffffffffffff')\\\n \\ as Hex8Vader, 2.718281828459045 as EmperorClones, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as EmperorIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as EmperorIP6, 0m as TimeAfterBattleOfYavin, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: key\n columnFilter:\n - key\n - IsDataFake\n - RebelsImprisoned\n - CreditsOnImperialBanks\n - Hex4Emperor\n - Hex8Vader\n - EmperorClones\n - Pi\n - EmperorIP4\n - EmperorIP6\n - TimeAfterBattleOfYavin\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n complexStaticQuery:\n value:\n id:\n creator: galactic_empire\n name: ImperialIntranetActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select eventdate, domain, userid from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - domain\n - userid\n contribution:\n type: add\n requiresDate: false\n simpleStaticS3File:\n value:\n id:\n creator: jedi_order\n name: ForceSensitiveBeings\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT8\n - name: Location\n from: 1\n type: STRING\n - name: Age\n from: 2\n type: FLOAT8\n - name: Species\n from: 3\n type: STRING\n - name: MidiclorianLevel\n from: 4\n type: FLOAT4\n - name: Hex4Age\n from: 5\n type: HEX4\n - name: Hex8Age\n from: 6\n type: HEX8\n - name: CommLinkIP4\n from: 7\n type: IP4\n - name: CommLinkIP6\n from: 8\n type: IP6\n - name: TimeFromDiscovery\n from: 9\n type: DURATION\n - name: EmpireCIDR4\n from: 10\n type: NET4\n - name: EmpireCIDR6\n from: 11\n type: NET6\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n - Age\n - Species\n - MidiclorianLevel\n - Hex4Age\n - Hex8Age\n - CommLinkIP4\n - CommLinkIP6\n - TimeFromDiscovery\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n simpleDynamicQuery:\n value:\n id:\n creator: confederation_of_independent_systems\n name: TotallyNotFakeData\n recipe:\n recipeType: periodic\n source:\n query: \"select now() as key, false as IsPalpatineLordSidious,\\\n \\ 2147483647 as ClonesImprisoned, 9223372036854775807 as CreditsOnBankingClan,\\\n \\ hex4('fffffff') as Hex4Sidious, hex8('fffffffffffffff')\\\n \\ as Hex8Dooku, 2.718281828459045 as DroidsRandomSeed, 3.141592653589793\\\n \\ as Pi, 87.219.9.157 as GrievousIP4, ip6('fe80::4492:bc4b:7a53:c0d5')\\\n \\ as DroidekaIP6, 0m as TimeAfterBattleOfGeonosis, net4('128.0.0.0/1')\\\n \\ as EmpireCIDR4, net6('ffff:ffff:ffff:ffff::/64') as EmpireCIDR6\\\n \\ from siem.logtrust.web.navigation where now()-1m < eventdate\\\n \\ < now() limit 1\"\n lookupType:\n type: normal\n append: true\n key:\n type: first-column\n columnFilter:\n - key\n - IsPalpatineLordSidious\n - ClonesImprisoned\n - CreditsOnBankingClan\n - Hex4Sidious\n - Hex8Dooku\n - DroidsRandomSeed\n - Pi\n - GrievousIP4\n - DroidekaIP6\n - TimeAfterBattleOfGeonosis\n - EmpireCIDR4\n - EmpireCIDR6\n contribution:\n type: add\n requiresDate: false\n refreshMillis: 3600000\n startMillis: 537796640000\n complexDynamicQuery:\n value:\n id:\n creator: galactic_republic\n name: RepublicSenateWebActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select eventdate, sessionid, userEmail from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - sessionid\n - userEmail\n contribution:\n type: add\n requiresDate: false\n refreshMillis: 3600000\n startMillis: 537796640000\n allSubdomainsS3File:\n value:\n id:\n creator: council@jedi_order\n name: JediTempleExits\n visibility:\n type: all-subdomains\n recipe:\n recipeType: once\n source:\n columns:\n - name: ID\n from: 0\n type: INT4\n - name: Location\n from: 1\n type: STRING\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n fileProvider:\n bucketName: info-bucket\n keyName: public/data/temple-exits.csv\n transferOwnership: true\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: ID\n columnFilter:\n - ID\n - Location\n contribution:\n type: add\n requiresDate: false\n required: true\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: recipeType values in a Recipe can be 'once' and 'periodic'\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-config'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n \"409\":\n description: Unsuccessful response. Lookup already exists.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 409\n context: null\n id: 9b6b0f0e-b162-11ee-b3ab-77fd619670ef\n msg: Lookup with domain galactic_empire and name destroyed_planets\n already exists\n /lookup/{domain}/{name}/deploy-csv:\n put:\n summary: Send a lookup update request using a CSV\n description: Simplified endpoint to send a request to update an existing lookup.\n Only for CSV lookups.\n operationId: putCsvLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n multipart/form-data:\n schema:\n properties:\n deploy-config:\n $ref: '#/components/schemas/DeployCsv'\n csv:\n type: string\n description: CSV file to upload. Only needed if the file was not\n uploaded to S3.\n format: binary\n application/json:\n schema:\n $ref: '#/components/schemas/DeployCsv'\n examples:\n simpleCsvLookupUpdate:\n value:\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n key:\n type: column\n column: ID\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n contribution:\n type: add\n csvLookupUpdateWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n key:\n type: column\n column: ID\n contribution:\n type: add\n required: true\n responses:\n \"200\":\n description: Successful response. The actual DeployConfig object is returned.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 200\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: key\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: 300000\n startMillis: 1702339200000\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: a58a233b4a27\n code: 400\n context: BAD_REQUEST\n id: ae34801e-5387-11ed-859a-532f757eb240\n msg: Bad Request\n \"401\":\n description: Unsuccessful response. User unauthorized to update a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n post:\n summary: Send a lookup creation request using a CSV\n description: |\n Simplified endpoint to send a request to create a new lookup. Only for CSV lookups.\n It supports:\n - a JSON body with the deploy-csv config with a fileProvider of the lookup file to be used\n - a multipart file body, with a deploy-config .JSON file and a .CSV lookup file\n operationId: createCsvLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n multipart/form-data:\n schema:\n properties:\n deploy-config:\n $ref: '#/components/schemas/DeployCsv'\n csv:\n type: string\n description: CSV file to upload. Only needed if the file was not\n uploaded to S3.\n format: binary\n examples:\n csvLookupCreationWithCsvFiles:\n description: |\n Example of files that can be added. How to add them will depend on what tool you use.\n e.g: with curl:\n ```\n curl\n -X POST https://host/lookup-api/lookup/self/test-upload-csv/deploy-csv\n --header 'Authorization: Bearer abdf37e'\n --form \"deploy-config={'columns': []};type=application/json\"\n --form \"csv=@devo-lookups-qa-stage-csv/all-atomic-types.csv;type=application/csv\"\n ```\n value:\n deploy-config:\n externalValue: https://gitlab.devotools.com/teams/lomaniacos/bruno-collections-lomaniacos/-/blob/main/files/simple-lookup-with-header/deploy-csv.json\n csv:\n externalValue: https://gitlab.devotools.com/teams/lomaniacos/bruno-collections-lomaniacos/-/blob/main/files/simple-lookup-with-header/simple_lookup.csv\n csvLookupCreationWithCsvFileContents:\n description: |\n Example of file contents that can be added. How to add the files will depend on what tool you use.\n e.g: with curl:\n ```\n curl\n -X POST https://host/lookup-api/lookup/self/test-upload-csv/deploy-csv\n --header 'Authorization: Bearer abdf37e'\n --form \"deploy-config={'columns': []};type=application/json\"\n --form \"csv=@devo-lookups-qa-stage-csv/all-atomic-types.csv;type=application/csv\"\n ```\n value:\n deploy-config: |\n {\"columns\": [{\"name\": \"ID\",\"type\": \"INT8\"},{\"name\": \"Location\",\"type\": \"STRING\"},{\"name\": \"Age\",\"type\": \"FLOAT8\"},{\"name\": \"Species\",\"type\": \"STRING\"},{\"name\": \"MidiclorianLevel\",\"type\": \"FLOAT4\"}],\"skipPreface\": null,\"hasHeader\": false,\"skipEmptyLines\": false,\"key\": {\"type\": \"column\",\"column\": \"ID\"}\n csv: |\n ID,Age,Species,MidiclorianLevel\n John Doe,30,Human,85\n Jane Smith,25,Human,90\n encoding:\n csv:\n contentType: text/csv\n style: form\n application/json:\n schema:\n $ref: '#/components/schemas/DeployCsv'\n examples:\n simpleCsvLookupCreation:\n value:\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n key:\n type: column\n column: ID\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n csvLookupCreationWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n key:\n type: column\n column: ID\n keepHistory: false\n columnTimeReference: null\n required: true\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 201\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n columns:\n - name: ID\n type: INT8\n - name: Location\n type: STRING\n - name: Age\n type: FLOAT8\n - name: Species\n type: STRING\n - name: MidiclorianLevel\n type: FLOAT4\n fileProvider:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n skipPreface: null\n hasHeader: false\n skipEmptyLines: false\n lookupType:\n type: historic\n instantPolicy: creation-instant\n append: true\n key:\n type: column\n column: key\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: null\n startMillis: null\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: \"KeyAlgorithm values can be 'first-column', 'column', 'row-hash',\\\n \\ 'col-hash' and 'seq'\"\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n \"409\":\n description: Unsuccessful response. Lookup already exists.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 409\n context: null\n id: 9b6b0f0e-b162-11ee-b3ab-77fd619670ef\n msg: Lookup with domain galactic_empire and name destroyed_planets\n already exists\n /lookup/{domain}/{name}/deploy-periodic-query:\n put:\n summary: Send a lookup update request for periodic queries.\n description: Simplified method to send a request to update an existing lookup\n based on periodic queries.\n operationId: putPeriodicQueryLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployPeriodicQuery'\n examples:\n simplePeriodicQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-5m < eventdate < now()\"\n key:\n type: column\n column: userid\n periodicQueryLookupCreationWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-5m < eventdate < now()\"\n key:\n type: column\n column: userid\n refreshPeriod: 5m\n startDate: now\n append: true\n required: true\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 200\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\\\n \\ where now()-5m < eventdate < now()\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: 300000\n startMillis: 1702339200000\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: Start date format error\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-periodic-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n post:\n summary: Send a lookup creation request for periodic queries.\n description: Simplified method to send a request to create a new lookup based\n on periodic queries.\n operationId: createPeriodicQueryLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployPeriodicQuery'\n examples:\n simplePeriodicQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-5m < eventdate < now()\"\n key:\n type: column\n column: userid\n periodicQueryLookupCreationWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-5m < eventdate < now()\"\n key:\n type: column\n column: userid\n refreshPeriod: 5m\n startDate: 2023-12-12T00:00:00.00Z\n append: true\n keepHistory: false\n columnTimeReference: null\n periodicQueryLookupCreationWithKeepsHistory:\n value:\n query: \"select eventdate, userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-5m < eventdate < now()\"\n key:\n type: column\n column: userid\n keepHistory: true\n columnTimeReference: eventdate\n required: true\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 201\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\\\n \\ where now()-5m < eventdate < now()\"\n lookupType:\n type: historic\n instantPolicy: creation-instant\n append: true\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: 300000\n startMillis: 1702339200000\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: refreshPeriod should be bigger than 1 minute\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-periodic-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n \"409\":\n description: Unsuccessful response. Lookup already exists.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 409\n context: null\n id: 9b6b0f0e-b162-11ee-b3ab-77fd619670ef\n msg: Lookup with domain galactic_empire and name destroyed_planets\n already exists\n /lookup/{domain}/{name}/deploy-sliding-window-query:\n put:\n summary: Send a lookup update request for queries with a sliding window\n description: Simplified method to send a request to update a new lookup based\n on sliding window query\n operationId: updateSlidingWindowQuery\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeploySlidingWindowQuery'\n examples:\n simpleSlidingWindowQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\"\n key:\n type: column\n column: userid\n windowSize: 1d\n refreshPeriod: 10m\n slidingWindowQueryLookupCreationAllOptions:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\"\n key:\n type: column\n column: userid\n windowSize: 1d\n refreshPeriod: 10m\n startDate: 2023-12-12T00:00:00.00Z\n columnTimeReference: eventdate\n responses:\n \"200\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 200\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: 600000\n startMillis: 1702339200000\n slideWindow: 86400000\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: window size should be higher than 1 minute\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-sliding-window-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n post:\n summary: Send a lookup creation request for queries with a sliding window\n description: Simplified method to send a request to create a new lookup based\n on sliding window query\n operationId: createSlidingWindowQuery\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeploySlidingWindowQuery'\n examples:\n simpleSlidingWindowQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\"\n key:\n type: column\n column: userid\n window:\n size: 1d\n refreshPeriod: 10m\n slidingWindowQueryLookupCreationAllOptions:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\"\n key:\n type: column\n column: userid\n windowsize: 1d\n refreshPeriod: 10m\n startDate: 2023-12-12T00:00:00.00Z\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 200\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: periodic\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\"\n lookupType:\n type: normal\n append: true\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n refreshMillis: 600000\n startMillis: 1702339200000\n slideWindow: 86400000\n requiresDate: true\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: window size should be higher than 1 minute\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-sliding-window-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n \"409\":\n description: Unsuccessful response. Lookup already exists.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 409\n context: null\n id: 9b6b0f0e-b162-11ee-b3ab-77fd619670ef\n msg: Lookup with domain galactic_empire and name destroyed_planets\n already exists\n /lookup/{domain}/{name}/deploy-static-query:\n put:\n summary: Send a lookup update request for static queries.\n description: Simplified method to send a request to update an existing lookup\n based on a static query.\n operationId: putStaticQueryLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployStaticQuery'\n examples:\n simpleStaticQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-1d < eventdate < now()\"\n key:\n type: column\n column: userid\n staticQueryLookupCreationWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-1d < eventdate < now()\"\n key:\n type: column\n column: userid\n required: true\n responses:\n \"200\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 200\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\\\n \\ where now()-1d < eventdate < now()\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: \"KeyAlgorithm values can be 'first-column', 'column', 'row-hash',\\\n \\ 'col-hash' and 'seq'\"\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-static-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n post:\n summary: Send a lookup creation request for static queries.\n description: Simplified method to send a request to create a new lookup based\n on a static query.\n operationId: createStaticQueryLookup\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n requestBody:\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/DeployStaticQuery'\n examples:\n simpleStaticQueryLookupCreation:\n value:\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-1d < eventdate < now()\"\n key:\n type: column\n column: userid\n staticQueryLookupCreationWithAllOptionalValues:\n value:\n visibility:\n type: creator-only\n query: \"select userid, domain from siem.logtrust.web.navigation\\\n \\ where now()-1d < eventdate < now()\"\n key:\n type: column\n column: userid\n keepHistory: false\n columnTimeReference: null\n required: true\n responses:\n \"201\":\n description: Successful response. Request was submitted to the Lookups Manager.\n It includes the id of the creation request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationResponse'\n example:\n type: LookupCreationResponse\n cid: d5ce4eb105b2\n code: 201\n context: null\n id: c6b1e939-a57c-11ee-b1a9-a124bba45b9b\n msg: \"Lookup sent to creation. You can check the creation status using\\\n \\ the provided id: /lookup/{domain}/{name}/job/{id}\"\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select userid, domain from siem.logtrust.web.activity\\\n \\ where now()-1d < eventdate < now()\"\n lookupType:\n type: historic\n instantPolicy: creation-instant\n append: false\n key:\n type: column\n column: userid\n columnFilter: null\n contribution:\n type: add\n secondaryIndexes:\n type: none\n notifyStatus: true\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 0cd289fa1b63\n code: 400\n context: null\n id: 9f270aca-5151-11ed-859a-5d2974203ed5\n msg: \"KeyAlgorithm values can be 'first-column', 'column', 'row-hash',\\\n \\ 'col-hash' and 'seq'\"\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-static-query'\n requires valid auth\n cid: 29fda52318ae\n \"403\":\n description: Unsuccessful response. Forbidden access.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 5\n msg: Token invalid or expired\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n \"409\":\n description: Unsuccessful response. Lookup already exists.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupCreationError'\n example:\n type: LookupCreationError\n cid: 68e612d824a5\n code: 409\n context: null\n id: 9b6b0f0e-b162-11ee-b3ab-77fd619670ef\n msg: Lookup with domain galactic_empire and name destroyed_planets\n already exists\n /lookup/{domain}/{name}/job:\n get:\n summary: Query the job uuids of the given lookup.\n description: Query the job uuids of the given lookup by domain and name.\n operationId: getLookupJobsUUIDs\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: \"Successful response. Returns the filtered jobs, sorted ascendingly\\\n \\ by time.\"\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobListResponse'\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobsError'\n example:\n type: LookupJobsError\n cid: 6cde7fd6a1f4\n code: 400\n context: null\n id: e08fef4d-53a2-11ed-859a-33f9a0bb845a\n msg: Unsuccessful response. Bad Request.\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/job'\n requires valid auth\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobsError'\n example:\n type: LookupJobsError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\n /lookup/{domain}/{name}/job/{id}:\n get:\n summary: Query the statuses of a lookup job.\n description: \"Query the statuses of a lookup job for a given domain, name and\\\n \\ job id.\"\n operationId: queryLookupJobStatus\n parameters:\n - name: domain\n in: path\n description: The domain of the lookup.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: name\n in: path\n description: \"Name of the Lookup, unique on the given domain.\"\n required: true\n style: simple\n explode: false\n schema:\n type: string\n - name: id\n in: path\n description: Id of the lookup creation/update/deletion request.\n required: true\n style: simple\n explode: false\n schema:\n type: string\n responses:\n \"200\":\n description: \"Successful response. Returns the filtered jobs' results for\\\n \\ the given lookup with the filters applied. Results are sorted chronologically.\\\n \\ The response can include the following jobs' results: - \\\"Lookup successfully\\\n \\ created\\\": This means the Lookups Manager was able to create the lookup\\\n \\ file with the configuration provided but it was not uploaded to Devo's\\\n \\ platform yet. - \\\"Lookup ready to be executed\\\": This means the Lookups\\\n \\ Manager successfully uploaded the created lookup to Devo's platform\\\n \\ and it is ready to be used in queries. - \\\"Error creating lookup\\\":\\\n \\ This means the Lookups Manager encountered an error creating the lookup\\\n \\ with the provided configuration.\"\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobStatusListResponse'\n \"400\":\n description: Unsuccessful response. Bad Request.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobsError'\n example:\n type: LookupJobsError\n cid: 4d1eb85a908d\n code: 400\n context: null\n id: e9a9baaf-53a4-11ed-859a-2d69d242a54f\n msg: Unsuccessful response. Bad Request.\n \"401\":\n description: Unsuccessful response. User unauthorized to create a Lookup.<\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/AuthError'\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/job/89732b79-a643-11ee-841d-fb670fe91f6e'\n requires valid auth\n cid: 29fda52318ae\n \"404\":\n description: Unsuccessful response. Domain or Lookup not found.\n content:\n application/json:\n schema:\n $ref: '#/components/schemas/LookupJobsError'\n example:\n type: LookupJobsError\n cid: 68e612d824a5\n code: 404\n context: null\n id: 901c6154-b16b-11ee-b3ab-47fc28cf5888\n msg: Domain not found.\ncomponents:\n schemas:\n AuthError:\n type: object\n properties:\n code:\n type: integer\n description: Http error code\n format: int32\n msg:\n type: string\n description: Error message\n cid:\n type: string\n description: Correlation ID of the response\n description: Standard HTTP error response for unauthorized requests.\n example:\n code: 401\n msg: Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire'\n requires valid auth\n cid: 29fda52318ae\n BasicDevoResponse:\n type: object\n properties:\n cid:\n type: string\n description: Correlation ID of the response\n code:\n type: integer\n description: Numerical API Code.\n format: int32\n context:\n type: object\n description: Object containing the context of the response.\n id:\n type: string\n description: Creation ID of the Lookup\n msg:\n type: string\n description: Descriptive message of the response.\n description: Standard HTTP response with the minimal properties.\n example:\n type: BasicDevoResponse\n cid: e42ffbbeb753\n code: 404\n context: HTTP 404 Not Found\n id: 30faa8ae-4fbd-11ed-859a-01f240ca171d\n msg: HTTP 404 Not Found\n discriminator:\n propertyName: type\n Column:\n title: Root Type for a lookup Column.\n required:\n - name\n - type\n type: object\n properties:\n name:\n type: string\n description: Name of the column.\n from:\n type: integer\n description: 0-based index of the column inside the CSV.\n format: int32\n type:\n type: string\n description: |-\n Data type of the column. Possible values are:\n - \"BOOLEAN\"\n - \"STRING\n - \"INT4\"\n - \"INT8\"\n - \"FLOAT4\"\n - \"FLOAT8\"\n - \"HEX4\"\n - \"HEX8\"\n - \"IP4\"\n - \"IP6\"\n - \"TIMESTAMP\"\n - \"DURATION\"\n - \"NET4\"\n - \"NET6\"\n description: Descriptor for a Lookup column on a CSV source.\n example:\n name: key\n from: 0\n type: STRING\n ContributionPolicy:\n title: Root Type for ContributionPolicy\n required:\n - type\n type: object\n properties:\n type:\n type: string\n description: \"Type of the ContributionPolicy. Possible values are \\\"add\\\"\\\n , \\\"del\\\" and \\\"col\\\". \\\"add\\\" by default.\"\n enum:\n - add\n - del\n - col\n default: add\n name:\n type: string\n description: \"The contribution will be extracted from the column with the\\\n \\ given [name]. That column type must be string and its valid values are\\\n \\ 'add' and 'delete'.'\"\n description: \"Defines how to calculate how a row contributes to the final result,\\\n \\ normally used on incremental lookups. For lookup CSV creation operations\\\n \\ it is always of type \\\"add\\\".\"\n example:\n type: add\n DeployConfig:\n required:\n - recipe\n type: object\n properties:\n id:\n $ref: '#/components/schemas/LookupId'\n recipe:\n $ref: '#/components/schemas/Recipe'\n notifyStatus:\n type: boolean\n description: \"If true, a notification will be sent to Devo's web once the\\\n \\ Lookup is executed so that the user is informed about the creation or\\\n \\ update of a lookup.\"\n description: \"Deploy configuration of the Lookup to be created or updated. This\\\n \\ object states the id of the lookup, the recipe which is used to create it,\\\n \\ its visibility and if the user is to receive a notification on it's readiness.\"\n example:\n id:\n creator: galactic_empire\n name: ImperialIntranetActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select eventdate, domain, userid from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: \"false,\"\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - domain\n - userid\n contribution:\n type: add\n requiresDate: false\n allOf:\n - $ref: '#/components/schemas/DeployConfigBase'\n DeployConfigBase:\n type: object\n properties:\n visibility:\n type: object\n description: |-\n Visibility of the lookup. This attribute can be an object of type `Visibility`, or a string. If a string, the supported values are:\n - \"creator-only\": To create a lookup only visible by the user's\n domain\n - \"all-subdomains\": To create a lookup visible by all domains owned\n by a reseller. Can only be used by users with RESELLER_ADMIN\n permissions.\n - \"all-domains\": To create a lookup visible by all domains. It is\n only allowed when the domain of the user is self.\n description: Deploy configuration base\n discriminator:\n propertyName: type\n DeployCsv:\n required:\n - columns\n type: object\n properties:\n columns:\n type: array\n description: Array of Lookup column descriptors.\n items:\n $ref: '#/components/schemas/Column'\n fileProvider:\n $ref: '#/components/schemas/FileProvider'\n key:\n $ref: '#/components/schemas/KeyAlgorithm'\n skipPreface:\n type: string\n description: Enter a regular expression to ignore rows of data in a CSV\n used as source that follow the structure indicated in the regex. Defaults\n to 'null'.\n hasHeader:\n type: boolean\n description: |\n Either if the CSV file of the CSV source has a header row or\n not. Defaults to 'false'.\n skipEmptyLines:\n type: boolean\n description: Either to skip empty lines on the CSV or not. Defaults to 'false'.\n contribution:\n $ref: '#/components/schemas/ContributionPolicy'\n keepHistory:\n type: boolean\n description: |\n If enabled, Lookup Manager will store all historic\n data in the lookup, enabling historic search.\n default: false\n columnTimeReference:\n type: string\n description: |\n If given, the Lookup Manager will use the column specified as\n time instant reference for the data provided.\n append:\n type: boolean\n description: \"If true, when this recipe is evaluated, the content of its\\\n \\ source will be appended to the lookup created on the previous evaluation.\\\n \\ If there is no previous lookup, or if the recipe is updated, this property\\\n \\ is ignored. False by default.\"\n default: false\n description: \"Deploy csv configuration of the Lookup to be created. This object\\\n \\ states the visibility of the created lookup, the \\\"fileProvider\\\" indicating\\\n \\ the CSV file stored in AWS S3, the column descriptors and key. It also includes\\\n \\ metainfo from the CSV such as if it has header.\"\n allOf:\n - $ref: '#/components/schemas/DeployConfigBase'\n DeployPeriodicQuery:\n required:\n - query\n type: object\n properties:\n query:\n type: string\n description: Query to generate the lookup from. It must follow Devo's APIs\n LINQ syntax.\n key:\n $ref: '#/components/schemas/KeyAlgorithm'\n refreshPeriod:\n type: string\n description: |-\n Refresh period of the Lookup. Defaults to grouping period of the\n query in case it is a grouping query, or 5 minutes if not. Accepted\n values are the ones accepted by Devo's Duration type. Minimum value\n accepted is 1 minute.\n startDate:\n type: string\n description: Lookup creation start date. Defaults to the time of the request.\n Can either be an ISO-8601 datetime string or a number of milliseconds\n from EPOCH.\n append:\n type: boolean\n description: \"If true, when this recipe is evaluated, the content of its\\\n \\ source will be appended to the lookup created on the previous evaluation.\\\n \\ If there is no previous lookup, or if the recipe is updated, this property\\\n \\ is ignored. False by default.\"\n default: true\n keepHistory:\n type: boolean\n description: |\n If enabled, Lookup Manager will store all historic\n data in the lookup, enabling historic search.\n default: false\n columnTimeReference:\n type: string\n description: |\n If given, the Lookup Manager will use the column specified as\n time instant reference for the data provided.\n description: \"Deploy static query configuration of the Lookup to be created\\\n \\ or updated. This object states the visibility of the created lookup, the\\\n \\ lookup query and the algorithm to compute the lookup's keys.\"\n allOf:\n - $ref: '#/components/schemas/DeployConfigBase'\n DeploySlidingWindowQuery:\n required:\n - key\n - query\n - refreshPeriod\n - windowSize\n type: object\n properties:\n query:\n type: string\n description: Query to generate the lookup from. It must follow Devo's APIs\n LINQ syntax.\n key:\n $ref: '#/components/schemas/KeyAlgorithm'\n windowSize:\n type: string\n description: |-\n Size of the window. Every time that the query is executed, the\n lookup will contain the size of the window. Accepted values are\n the ones accepted by Devo's Duration type, Minimum value accepted\n is 1 hour.\n refreshPeriod:\n type: string\n description: |-\n Refresh period of the Lookup. Defaults to grouping period of the\n query in case it is a grouping query, or 5 minutes if not. Accepted\n values are the ones accepted by Devo's Duration type. Minimum value\n accepted is 1 minute.\n startDate:\n type: string\n description: Lookup creation start date. Defaults to the time of the request.\n Can either be an ISO-8601 datetime string or a number of milliseconds\n from EPOCH.\n keepHistory:\n type: boolean\n description: |\n If enabled, Lookup Manager will store all historic\n data in the lookup, enabling historic search.\n default: false\n columnTimeReference:\n type: string\n description: |\n If given, the Lookup Manager will use the column specified as\n time instant reference for the data provided.\n description: |-\n Deploy static query configuration of the Lookup to be created\n or updated. This object states the visibility of the created lookup, the\n lookup query and the algorithm to compute the lookup's keys.\n allOf:\n - $ref: '#/components/schemas/DeployConfigBase'\n DeployStaticQuery:\n required:\n - query\n type: object\n properties:\n query:\n type: string\n description: Query to generate the lookup from. It must follow Devo's APIs\n LINQ syntax.\n key:\n $ref: '#/components/schemas/KeyAlgorithm'\n keepHistory:\n type: boolean\n description: |\n If enabled, Lookup Manager will store all historic\n data in the lookup, enabling historic search.\n default: false\n columnTimeReference:\n type: string\n description: |\n If given, the Lookup Manager will use the column specified as\n time instant reference for the data provided.\n append:\n type: boolean\n description: \"If true, when this recipe is evaluated, the content of its\\\n \\ source will be appended to the lookup created on the previous evaluation.\\\n \\ If there is no previous lookup, or if the recipe is updated, this property\\\n \\ is ignored. False by default.\"\n default: false\n description: \"Deploy static query configuration of the Lookup to be created\\\n \\ or updated. This object states the visibility of the created lookup, the\\\n \\ lookup query and the algorithm to compute the lookup's keys.\"\n allOf:\n - $ref: '#/components/schemas/DeployConfigBase'\n FileProvider:\n title: Root Type for fileProvider.\n required:\n - bucketName\n - keyName\n - transferOwnership\n type: object\n properties:\n bucketName:\n type: string\n description: The name of the S3 bucket where the CSV is located.\n keyName:\n type: string\n description: The path of the CSV inside the bucket.\n transferOwnership:\n type: boolean\n description: A boolean that represents whether Lomana should act as the\n owner of the CSV and delete it from the bucket once it has finished creating\n the lookup.\n accessKey:\n type: string\n description: The access key of a customer’s AWS user with permissions to\n access the bucket represented in bucketName. This attribute is not mandatory.\n secretKey:\n type: string\n description: The secret key of a customer’s AWS user with permissions to\n access the bucket represented in bucketName. This attribute is not mandatory.\n host:\n type: string\n description: The S3 bucket host where to find the CSV. This attribute is\n not mandatory.\n port:\n type: integer\n description: The S3 bucket port where to find the CSV. This attribute is\n not mandatory.\n format: int32\n region:\n type: string\n description: The AWS region whether the S3 bucket has been created. This\n attribute is not mandatory.\n description: Info to get the CSV file from S3.\n example:\n bucketName: holocrons-bucket\n keyName: secrets/data/force-sensitive-beings.csv\n transferOwnership: true\n InstantPolicy:\n title: Description of instant policy\n properties:\n instantPolicy:\n type: string\n description: \"Defines how to calculate the instant of each row. Only used\\\n \\ when the generated lookup is historic. Possible values are: - \\\"natural\\\"\\\n : The associated source must be historical and the instant of each row\\\n \\ will be used. This is useful when the source is a historical lookup.\\\n \\ - \\\"const\\\": The instance of all rows will be the supplied constant.\\\n \\ - \\\"column\\\": The instance will be extracted from the column with the\\\n \\ given [name]. That column type must be timestamp.\"\n instant:\n minimum: 0\n type: integer\n description: Only for historic lookups of type \"const\".\n format: int64\n columnName:\n type: string\n description: Only for historic lookups of type \"column\".\n description: defines the instant policy properties\n KeyAlgorithm:\n title: Root Type for KeyAlgorithm.\n required:\n - type\n type: object\n properties:\n columns:\n type: array\n description: Columns to be used to generate the key for the lookup. Only\n used when the type of the KeyAlgorithm object is \"col-hash\".\n items:\n type: string\n column:\n type: string\n description: \"Column to be used as the key for the lookup. Only used with\\\n \\ KeyAlgorithms of type: \\\"column\\\".\"\n type:\n type: string\n description: \"Type of Key Algorithm. Values can be \\\"first-column\\\", \\\"\\\n column\\\", \\\"row-hash\\\", \\\"col-hash\\\" or \\\"seq\\\". \\\"first-column\\\" by default.\"\n enum:\n - first-column\n - column\n - row-hash\n - col-hash\n - seq\n default: first-column\n description: |-\n Algorithm to compute the lookup's keys. Depending on the type of the KeyAlgorithm different strategies apply:\n - \"first-column\": The first column on the lookup is used as key.\n - \"column\": The column stated in the 'column' field of the KeyAlgorithm object is used as key.\n - \"row-hash\": A hash of the elements on the first row on the lookup is used as key.\n - \"col-hash\": A hash of the columns stated on the 'columns' field of the KeyAlgorithm object is used as key.\n - \"seq\": The key of the lookup is generated sequentially.\n\n Defaults to \"first-column\".\n example:\n type: column\n column: key\n KeyType:\n title: Key type of a lookup.\n type: object\n properties:\n type:\n type: string\n description: \"Type of the KeyType. Values can be \\\"first\\\", \\\"seq\\\" or \\\"\\\n hash\\\".\"\n columns:\n type: array\n description: Columns to be hashed to get the key.\n items:\n type: string\n hasher:\n type: object\n properties:\n type:\n type: string\n description: Hash function to be used\n seed:\n type: integer\n description: Seed to be used by the hash function\n format: int64\n description: Hash function to be used to generate the key.\n description: \"Defines how the key of the lookup has been generated. Types can\\\n \\ be \\\"first\\\", meaning the key was generated by the first field on the lookup,\\\n \\ \\\"seq\\\", so it was generated sequentially or \\\"hash\\\", so it was generated\\\n \\ from the hash of a list of fields on the lookup.\"\n example:\n type: murmur\n seed: 1511793612\n LookupActivationError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup enable/disable endpoints.\n example:\n type: LookupActivationError\n cid: 32ac2fdbcc89\n code: 400\n context: null\n id: e111f616-4fbc-11ed-b24b-17bb564344b5\n LookupActivationResponse:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard response for lookup enable/disable endpoints.\n example:\n type: LookupActivationResponse\n cid: f44f458f7c32\n code: 200\n context: null\n id: c8234b9d-5052-11ed-b24b-85c623a0cbd8\n msg: Lookup enabled\n LookupCreationError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup creation endpoints.\n example:\n type: LookupCreationError\n cid: 9a3eda1848d1\n code: 403\n context: FORBIDDEN\n id: 00daba68-5055-11ed-859a-7b524e50491a\n msg: User is not authorized to perform operations in the domain.\n LookupCreationResponse:\n type: object\n properties:\n lookupDeployConfig:\n $ref: '#/components/schemas/DeployConfig'\n description: Standard response for lookup creation endpoints.\n example:\n type: LookupCreationResponse\n cid: d41c91a21d56\n code: 201\n context: null\n id: 5d65ff7d-2201-11ec-b04a-53c6289921cb\n msg: Lookup sent to creation\n lookupDeployConfig:\n id:\n creator: rebel_alliance\n name: GalacticEmpireActivity\n visibility:\n type: creator-only\n recipe:\n recipeType: once\n source:\n query: \"select eventdate, level, domain, userid, sessionid, correlationId\\\n \\ from siem.logtrust.web.activity where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: false\n key:\n type: column\n column: key\n columnFilter:\n - eventdate\n - level\n - domain\n - userid\n - sessionid\n - correlationId\n contribution:\n type: add\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n LookupDeletionError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup deletion endpoints.\n example:\n type: LookupDeletionError\n cid: 32ac2fdbcc89\n code: 400\n context: null\n id: e111f616-4fbc-11ed-b24b-17bb564344b5\n LookupDeletionResponse:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard response for lookup deletion endpoints.\n example:\n type: LookupDeletionResponse\n cid: f44f458f7c32\n code: 200\n context: null\n id: c8234b9d-5052-11ed-b24b-85c623a0cbd8\n msg: Lookup sent to deletion\n LookupField:\n title: Field of a lookup\n type: object\n properties:\n column:\n type: string\n description: Name of the column field's name.\n type:\n type: string\n description: Data type of the lookup field.\n key:\n type: boolean\n description: Whether if the field is or is part of the key of the lookup\n description: Meta information about a lookup field\n example:\n column: ID\n type: ip4\n key: true\n LookupId:\n title: Root Type for LookupId.\n type: object\n properties:\n creator:\n type: string\n description: Domain of the creator of the Lookup.\n name:\n type: string\n description: Name of the Lookup.\n description: Object which identifies a lookup. Formed by the domain of the lookup\n inside the \"creator\" field and the name of the lookup.\n example:\n creator: jedi_order\n name: ForceSensitiveBeings\n LookupJobListResponse:\n required:\n - jobs\n type: object\n properties:\n jobs:\n type: array\n description: List of job uuids.\n items:\n type: string\n description: List of the last N jobs of a lookup.\n example:\n cid: e47f4ab72ded\n code: 200\n context: null\n id: 4d33777c-e37c-11ed-b5ea-0242ac120002\n msg: Lookup job uuids\n jobs:\n - 2b6b312f-c9a2-489c-8794-ea656a19b822\n - 30b6cad0-9714-48a7-9976-73e41523edfd\n - d1e969e6-48a8-46ea-ab22-e0a5458e302b\n - e2c51a3c-ad7e-4fe6-bb43-89f93e629d76\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n LookupJobStatusListResponse:\n required:\n - jobs\n type: object\n properties:\n status:\n type: array\n description: List of statuses.\n items:\n $ref: '#/components/schemas/LookupStatusResponse'\n description: List of the last N statuses of a job.\n example:\n cid: e47f4ab72ded\n code: 200\n context: null\n id: 4d33777c-e37c-11ed-b5ea-0242ac120002\n msg: Lookup job's statuses\n status:\n - eventdate: 2021-09-29T10:18:10.805\n domain: galactic_empire\n lookup: ImperialIntranetActivity\n msg: Lookup successfully created\n code: create.ok\n - eventdate: 2021-09-29T10:18:12.472\n domain: ImperialIntranetActivity\n lookup: test-schedule\n msg: Lookup ready to be executed\n code: deploy.ok\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n LookupJobsError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup jobs endpoints.\n example:\n type: LookupJobsError\n cid: 976559828e9a\n code: 403\n context: FORBIDDEN\n id: 0697ce1e-53a3-11ed-859a-637a8267600a\n msg: User is not authorized to perform operations in the domain.\n LookupMetaInfo:\n title: Meta information of a Lookup.\n type: object\n properties:\n name:\n type: string\n description: Lookup name.\n domain:\n type: string\n description: Lookup domain.\n fileSize:\n type: integer\n description: Size in bytes of the lookup file.\n format: int64\n numEntries:\n type: integer\n description: Number of entries in the lookup.\n format: int64\n creationDate:\n type: string\n description: Creation date of the lookup.\n keyType:\n $ref: '#/components/schemas/KeyType'\n fields:\n type: array\n description: Lookup fields.\n items:\n $ref: '#/components/schemas/LookupField'\n shared:\n type: boolean\n description: Whether the lookup is shared or not.\n owner:\n type: string\n description: Lookup owner's email.\n description: Relevant meta information of a Lookup inside the Devo platform\n example:\n name: CloneTroopersSquads\n domain: galactic_republic\n fileSize: 3600384\n numEntries: 1000\n creationDate: 2020-03-04T15:07:19\n shared: false\n owner: qa.galactic_republoc@devo.com\n keyType:\n type: first\n columns: []\n hasher: null\n fields:\n - column: ID\n type: ip4\n key: true\n - column: NumberOfUnits\n type: ip4\n key: false\n - column: JediGeneralID\n type: ip4\n key: false\n - column: Active\n type: bool\n key: false\n discriminator:\n propertyName: type\n LookupMetaInfoComplete:\n title: Complete Meta information of a Lookup.\n properties:\n deployConfig:\n $ref: '#/components/schemas/DeployConfig'\n lastStatus:\n $ref: '#/components/schemas/LookupStatusResponse'\n enabled:\n type: boolean\n description: Whether the lookup is enabled or not.\n description: \"Relevant meta information of a Lookup inside the Devo platform,\\\n \\ including deploy config, last execution and enabled.\"\n example:\n name: CloneTroopersSquads\n domain: galactic_republic\n fileSize: 3600384\n numEntries: 1000\n creationDate: 2020-03-04T15:07:19\n shared: false\n owner: qa.galactic_republoc@devo.com\n enabled: true\n keyType:\n type: first\n columns: []\n hasher: null\n deployConfig: null\n lastStatus:\n eventdate: 2020-03-04T15:08:02\n domain: galactic_republic\n lookup: CloneTroopersSquads\n msg: Lookup successfully created\n fields:\n - column: ID\n type: ip4\n key: true\n - column: NumberOfUnits\n type: ip4\n key: false\n - column: JediGeneralID\n type: ip4\n key: false\n - column: Active\n type: bool\n key: false\n allOf:\n - $ref: '#/components/schemas/LookupMetaInfo'\n LookupMetaInfoListResponse:\n type: object\n properties:\n lookups:\n type: array\n description: List of lookups.\n items:\n $ref: '#/components/schemas/LookupMetaInfo'\n nextPageToken:\n type: integer\n description: Last page token. Used for pagination.\n format: int32\n description: List of N lookups inside a domain.\n example:\n type: LookupMetaInfoListResponse\n cid: e47f4ab72ded\n code: 200\n context: null\n id: 11a68f01-4fb0-11ed-b24b-99afce214fb8\n msg: galactic_empire lookups.\n lookups:\n - name: DeathStarTroopers\n domain: galactic_empire\n fileSize: 1712128\n numEntries: 10000\n creationDate: 2021-09-29T10:18:10.805\n keyType:\n type: first\n columns: []\n hasher: null\n deployConfig: null\n lastStatus:\n eventdate: 2021-09-29T10:18:10.805\n domain: galactic_empire\n lookup: DeathStarTroopers\n msg: Lookup successfully created\n fields:\n - column: \"ID,\"\n type: ip4\n key: true\n - column: \"Name,\"\n type: str\n key: false\n - column: \"Category,\"\n type: str\n key: false\n - column: \"Age,\"\n type: int4\n key: false\n - column: \"Sector,\"\n type: int4\n key: false\n - column: \"Rank,\"\n type: str\n key: false\n - column: \"BlasterModel,\"\n type: str\n key: false\n shared: true\n owner: qa.lomaniacos@devo.com\n enabled: true\n - name: FugitiveJedis\n domain: galactic_empire\n fileSize: 32768\n numEntries: 50\n creationDate: 2021-10-10T10:00:05.812\n keyType:\n type: hash\n columns: []\n hasher:\n type: murmur\n seed: 1511793612\n deployConfig: null\n lastStatus:\n eventdate: 2021-10-10T10:01:02.001\n domain: galactic_empire\n lookup: FugitiveJedis\n msg: Lookup successfully created\n fields:\n - column: \"Name,\"\n type: str\n key: true\n - column: \"LightsaberColor,\"\n type: str\n key: false\n - column: \"LastKnownLocation,\"\n type: str\n key: false\n - column: \"Species,\"\n type: str\n key: false\n - column: \"PlanetOfOrigin,\"\n type: str\n key: false\n - column: \"ConsideredDangerous,\"\n type: bool\n key: false\n shared: true\n owner: qa.lomaniacos@devo.com\n enabled: true\n nextPageToken: 1\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n LookupMetaInfoResponse:\n type: object\n properties:\n lookupMetaInfo:\n $ref: '#/components/schemas/LookupMetaInfoComplete'\n description: LookupMetaInfo component for LookupMetaInfoResponse\n example:\n type: LookupMetaInfoResponse\n cid: ee5f8fb3e225\n code: 200\n context: null\n id: 23f0e93a-5050-11ed-b24b-3bba2bcd85c3\n msg: galactic_republic/CloneTroopersSquads meta information\n lookupMetaInfo:\n name: CloneTroopersSquads\n domain: galactic_republic\n fileSize: 3600384\n numEntries: 1000\n creationDate: 2020-03-04T15:07:19\n keyType:\n type: first\n columns: []\n hasher: null\n deployConfig: null\n lastStatus:\n eventdate: 2020-03-04T15:08:02\n domain: galactic_republic\n lookup: CloneTroopersSquads\n msg: Lookup successfully created\n fields:\n - column: ID\n type: ip4\n key: true\n - column: NumberOfUnits\n type: ip4\n key: false\n - column: JediGeneralID\n type: ip4\n key: false\n - column: Active\n type: bool\n key: false\n shared: true\n owner: qa.lomaniacos@devo.com\n enabled: true\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n LookupMetaInfoResponseError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup meta info endpoints.\n example:\n type: LookupMetaInfoResponseError\n cid: 35a6a56c8fde\n code: 403\n context: null\n id: 55b9f469-504c-11ed-b24b-c5ffaee961d7\n msg: Forbidden\n LookupNotificationError:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard error response for lookup notifications.\n example:\n type: LookupNotificationError\n cid: 32ac2fdbcc89\n code: 400\n context: null\n id: e111f616-4fbc-11ed-b24b-17bb564344b5\n LookupNotificationResponse:\n allOf:\n - $ref: '#/components/schemas/BasicDevoResponse'\n - type: object\n description: Standard response for lookup notifications.\n example:\n type: LookupActivationResponse\n cid: f44f458f7c32\n code: 200\n context: null\n id: c8234b9d-5052-11ed-b24b-85c623a0cbd8\n msg: Lookup succesfully notified\n LookupStatusResponse:\n type: object\n properties:\n eventdate:\n type: string\n description: Timestamp of the status.\n domain:\n type: string\n description: Domain of the lookup.\n lookup:\n type: string\n description: Name of the lookup.\n msg:\n type: string\n description: Job status description.\n code:\n type: string\n description: Job status code (short name).\n extra:\n type: string\n description: Job status extra information.\n description: Status of the job of a lookup at a given point in time.\n example:\n eventdata: 2021-09-29T10:18:10.805\n domain: galactic_empire\n lookup: ImperialIntranetActivity\n msg: Lookup successfully created\n extra: null\n code: deploy.ok\n LookupType:\n title: Root Type for LookupType.\n required:\n - type\n type: object\n properties:\n type:\n type: string\n description: Valid values are \"normal\" and \"historic\".\n enum:\n - normal\n - historic\n instantPolicy:\n type: string\n description: \"Defines how to calculate the instant of each row. Only used\\\n \\ when the generated lookup is historic. Possible values are: - \\\"const\\\"\\\n : The instance of all rows will be the supplied constant. - \\\"creation-instant\\\"\\\n : The instance of all rows will be the creation instant. - \\\"column\\\"\\\n : The instance will be extracted from the column with the given [name].\\\n \\ That column type must be timestamp.\"\n instant:\n minimum: 0\n type: integer\n description: Only for historic lookups of type \"const\".\n format: int64\n columnName:\n type: string\n description: Only for historic lookups of type \"column\".\n keepHistory:\n type: boolean\n description: |\n If enabled, Lookup Manager will store all historic\n data in the lookup, enabling historic search.\n default: false\n description: \"Defines the type of the lookup. It can be: - normal: Regular old\\\n \\ lookups. - historic: New historic lookups.\"\n example:\n type: normal\n Recipe:\n required:\n - lookupType\n - recipeType\n - source\n type: object\n properties:\n recipeType:\n type: string\n description: Type of the recipe. Possible values are \"once\" for static lookups\n and \"periodic\" for periodic lookups.\n enum:\n - once\n - periodic\n source:\n $ref: '#/components/schemas/Source'\n lookupType:\n $ref: '#/components/schemas/LookupType'\n append:\n type: boolean\n description: \"If true, when this recipe is evaluated, the content of its\\\n \\ source will be appended to the lookup created on the previous evaluation.\\\n \\ If there is no previous lookup, or if the recipe is updated, this property\\\n \\ is ignored. False by default.\"\n default: false\n key:\n $ref: '#/components/schemas/KeyAlgorithm'\n columnFilter:\n type: array\n description: If not null a white list of columns that will be projected.\n All elements of the list must be defined on source. Columns from source\n whose name is not on this list won't be projected.\n items:\n type: string\n contribution:\n $ref: '#/components/schemas/ContributionPolicy'\n secondaryIndexes:\n $ref: '#/components/schemas/SecondaryIndexes'\n refreshMillis:\n minimum: 60000\n type: integer\n description: |-\n Refresh period of the Lookup in milliseconds. Can only be used and\n is required if recipeType is \"periodic\".\n format: int64\n startMillis:\n type: integer\n description: Milliseconds since Epoch. Can only be used and is required\n if recipeType is \"periodic\".\n format: int64\n dataTimeToLive:\n minimum: 300000\n type: integer\n description: |-\n Size of the sliding window in millis used in dynamic queries,\n infinite if not set\n format: int64\n requiresDate:\n type: boolean\n description: \"If true, the source query will be enriched with a closed date\\\n \\ range restriction. The lower bound will be the maximum between startMillis\\\n \\ and the last job instant and the upper bound will be always now(). Can\\\n \\ only be used if recipeType is \\\"periodic\\\". False by default.\"\n description: |-\n Recipe of the lookup to be created. This object states the following data about the lookup: - Whether if it is going to be periodic or not via the \"recipeType\" attribute. - The \"Source\" object which defines the source of the its data. - Its type, rather if it is a normal or a historic lookup. Via the \"lookupType\" attribute. - Whether if the data from the source is to be appended or overriden, using the \"append\" attribute. - The algorithm used to create its key, via the \"key\" attribute. - The columns to be added to it using the \"columnFilter\". - The contribution type of its columns, via the \"contribution\" attribute. - Its secondary indexes. In case the \"lookupType\" is of type \"historic\". - In case it is periodic, some info about its periodicity using the \"refreshMillis\" and \"startMillis\" fields. Optionally, \"dataTimeToLive\" - \"dataTimeToLive\" must be great than 300000 (5 minute) defines the max-age of the data in the lookup. - Whether the source of the query is to be enriched with a closed date\n range restriction, via the \"requiresDate\" attribute.\n example:\n recipeType: once\n source:\n query: \"select eventdate, domain, userid from siem.logtrust.web.navigation\\\n \\ where now()-1m < eventdate < now()\"\n lookupType:\n type: normal\n append: \"false,\"\n key:\n type: column\n column: eventdate\n columnFilter:\n - eventdate\n - domain\n - userid\n contribution:\n type: add\n requiresDate: false\n SecondaryIndexes:\n title: Root Type for SecondaryIndexes.\n required:\n - type\n type: object\n properties:\n type:\n type: string\n description: \"Type of secondary indexes to be applied to the Lookup. Possible\\\n \\ values are \\\"all\\\", \\\"none\\\" and \\\"by-name\\\". \\\"none\\\" by default.\"\n enum:\n - all\n - none\n - by-name\n default: none\n map:\n type: object\n description: Map of column names to be applied as secondary indexes when\n the SecondaryIndexes is of type \"by-name\"\n description: Columns of a Lookup indexed as secondary indexes.\n example:\n type: all\n map:\n v3: SORTED\n Source:\n type: object\n properties:\n columns:\n type: array\n description: |-\n Array of Lookup column descriptors. Can only be used and is\n required if the lookup is to be created through a CSV file, so\n \"fileProvider\" field must be informed and \"query\" not.\n items:\n $ref: '#/components/schemas/Column'\n skipPreface:\n type: string\n description: Enter a regular expression to ignore rows of data in a CSV\n used as source that follow the structure indicated in the regex. Only\n used in CSV sources with \"fileProvider\" field informed and \"query\" not.\n hasHeader:\n type: boolean\n description: |\n Either if the CSV file of the CSV source has a header row or\n not.\n skipEmptyLines:\n type: boolean\n description: Either to skip empty lines on the CSV or not.\n fileProvider:\n $ref: '#/components/schemas/FileProvider'\n query:\n type: string\n description: Query to generate the lookup from. It must follow Devo's APIs\n LINQ syntax.\n description: \"Source used to create the Lookup. This object states if the lookup\\\n \\ is gonna be created through a query to Devo, either by using que \\\"query\\\"\\\n \\ field or through a CSV file stored in AWS S3 using the \\\"fileProvider\\\"\\\n \\ field.\"\n example:\n query: select * from siem.logtrust.web.navigation where now()-1m < eventdate\n < now()\n ValidationError:\n type: object\n properties:\n code:\n type: integer\n description: Error code\n format: int32\n msg:\n type: string\n description: Error message\n cid:\n type: string\n description: Correlation ID of the response\n context:\n type: object\n description: Object containing the context of the response.\n description: Error returned by web server validations.\n example:\n code: 140\n msg: Validation failed.\n cid: 981d4e9056da\n context:\n failures: refreshMillis = 30000 <= must be greater than or equal to 60000\n Visibility:\n required:\n - type\n properties:\n type:\n type: string\n description: |-\n Type of the visibility. Possible values are:\n - \"creator-only\": To create a lookup only visible by the user's\n domain\n - \"all-subdomains\": To create a lookup visible by all domains owned\n by a reseller. Can only be used by users with RESELLER_ADMIN\n permissions.\n - \"all-domains\": To create a lookup visible by all domains. It is\n only allowed when the domain of the user is self.\n - \"regex\": To create a lookup visible by domains for which the\n regular expression applies. If this type is used, a regular\n expression must be placed on the \"regex\" field of this object.\n It is only allowed for self domain admins.\n enum:\n - creator-only\n - all-subdomains\n - all-domains\n - regex\n regex:\n type: string\n description: Regular expression to be applied for the visibility of the\n lookup in case its type is \"regex\".\n description: Visibility of the lookup to be created. This object sets the domains\n which will be able to see the lookup in Devo. Defaults to a visibility object\n of type \"creator-only\".\n"}},"macroMetadata":{"macroId":{"value":"3c55870a-e8f6-4b77-9e77-17a070aa3d21"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://confluence-open-api.herokuapp.com/images/open-api-icon.png"}}],"title":"Open API (Swagger) Documentation"}},"localId":"73fd82a0-e7ae-45db-aab4-9dd9d1f2220c"}},{"type":"paragraph","content":[{"text":"To authorize your requests, add a ","type":"text"},{"text":"standAloneToken","type":"text","marks":[{"type":"code"}]},{"text":" header to your API request that contains a valid token.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can generate this token in the ","type":"text"},{"text":"Administration → Credentials → Authentication tokens","type":"text","marks":[{"type":"strong"}]},{"text":" area of Devo. Click ","type":"text"},{"text":"Create token","type":"text","marks":[{"type":"strong"}]},{"text":" and choose any token type (currently, any type is valid for this API). Give your token a name, enter the authorized user and required target data tables you want to work with, and click ","type":"text"},{"text":"Create ","type":"text","marks":[{"type":"strong"}]},{"text":"to generate it.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Token permissions","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Note that the actions you can perform when you authorize your API access using a token are the ones you can perform according to your ","type":"text"},{"text":"role permissions","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/94763681"}}]},{"text":" in Devo.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can see the role permissions you need for each request type in ","type":"text"},{"text":"Working with the Activeboards API","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1021247580"}}]},{"text":".","type":"text"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":542,"id":"62fae0bc-cc1d-477a-951f-b8a54be1552c","collection":"contentId-1021247536","type":"file","height":531}}]},{"type":"paragraph","content":[{"text":"The generated token will appear in the same area, in the table below. Click its name and copy the token value from the details window that appears.","type":"text"}]},{"type":"paragraph","content":[{"text":"Learn more about tokens in Devo in ","type":"text"},{"text":"Authentication tokens","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/94763821"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Header example","type":"text"}]},{"type":"paragraph","content":[{"text":"The following is a Lookups API request in cURL language authorized with the corresponding header:","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -H \"standAloneToken:YOUR_TOKEN\" -X GET \"https://api-us.devo.com/lookup-api/lookup/myDomain\"","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"}],"version":1}

Browser not supported