{ "info": { "_postman_id": "fd70cebd-0ae0-4b70-aa9a-4b83be54a7a6", "name": "Upwind Management REST API v1 access-management threats API", "description": "Upwind Management REST API \u2014 administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.\n\nContact Support:\n Name: Upwind Support\n Email: support@upwind.io", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "lastUpdatedBy": "35240", "uid": "35240-fd70cebd-0ae0-4b70-aa9a-4b83be54a7a6" }, "item": [ { "name": "v1", "item": [ { "name": "organizations", "item": [ { "name": "{organization-id}", "item": [ { "name": "threat-events", "item": [ { "name": "List events", "id": "c9d523e2-c31d-46ec-b354-6883fd29dd17", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-events?page=1&per-page=100&cloud-account-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=&category=&severity=&upwind-asset-id=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-events" ], "query": [ { "description": "The page number to retrieve. Used for pagination along with the `per-page` parameter.", "key": "page", "value": "1" }, { "description": "Specifies how many results are returned on a page.", "key": "per-page", "value": "100" }, { "description": "Filters by the specified cloud account ID.", "key": "cloud-account-id", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" }, { "description": "Filters events by their category.", "key": "category", "value": "" }, { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters events by the Upwind asset ID.", "key": "upwind-asset-id", "value": "" } ], "variable": [ { "id": "0ff691c6-b83e-4a81-9920-f019800fbd6a", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A `GET` request sent to the endpoint root returns a list of Threat Events objects that are associated with the specified organization. To learn more about Threat Events, refer to the [Events Overview](/threats/events/overview) page." }, "response": [ { "id": "29703e1a-92e8-486c-9208-328dae89f67f", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-events?page=1&per-page=100&cloud-account-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=&category=&severity=&upwind-asset-id=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-events" ], "query": [ { "description": "The page number to retrieve. Used for pagination along with the `per-page` parameter.", "key": "page", "value": "1" }, { "description": "Specifies how many results are returned on a page.", "key": "per-page", "value": "100" }, { "description": "Filters by the specified cloud account ID.", "key": "cloud-account-id", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" }, { "description": "Filters events by their category.", "key": "category", "value": "" }, { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters events by the Upwind asset ID.", "key": "upwind-asset-id", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "[\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n }\n }\n]", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-29703e1a-92e8-486c-9208-328dae89f67f" }, { "id": "e3e41d77-7602-43b1-9bfe-fd3ce3786886", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-events?page=1&per-page=100&cloud-account-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=&category=&severity=&upwind-asset-id=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-events" ], "query": [ { "description": "The page number to retrieve. Used for pagination along with the `per-page` parameter.", "key": "page", "value": "1" }, { "description": "Specifies how many results are returned on a page.", "key": "per-page", "value": "100" }, { "description": "Filters by the specified cloud account ID.", "key": "cloud-account-id", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" }, { "description": "Filters events by their category.", "key": "category", "value": "" }, { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters events by the Upwind asset ID.", "key": "upwind-asset-id", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e3e41d77-7602-43b1-9bfe-fd3ce3786886" }, { "id": "8bfec172-f126-4dde-8428-311882a2f8a9", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-events?page=1&per-page=100&cloud-account-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=&category=&severity=&upwind-asset-id=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-events" ], "query": [ { "description": "The page number to retrieve. Used for pagination along with the `per-page` parameter.", "key": "page", "value": "1" }, { "description": "Specifies how many results are returned on a page.", "key": "per-page", "value": "100" }, { "description": "Filters by the specified cloud account ID.", "key": "cloud-account-id", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" }, { "description": "Filters events by their category.", "key": "category", "value": "" }, { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters events by the Upwind asset ID.", "key": "upwind-asset-id", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8bfec172-f126-4dde-8428-311882a2f8a9" }, { "id": "07d16187-3a8b-48b8-9e12-07cd6645f6ee", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-events?page=1&per-page=100&cloud-account-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=&category=&severity=&upwind-asset-id=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-events" ], "query": [ { "description": "The page number to retrieve. Used for pagination along with the `per-page` parameter.", "key": "page", "value": "1" }, { "description": "Specifies how many results are returned on a page.", "key": "per-page", "value": "100" }, { "description": "Filters by the specified cloud account ID.", "key": "cloud-account-id", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters events by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" }, { "description": "Filters events by their category.", "key": "category", "value": "" }, { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters events by the Upwind asset ID.", "key": "upwind-asset-id", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-07d16187-3a8b-48b8-9e12-07cd6645f6ee" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-c9d523e2-c31d-46ec-b354-6883fd29dd17" } ], "id": "457c382a-2d38-4d1f-8083-da3a86c3ad4b", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-457c382a-2d38-4d1f-8083-da3a86c3ad4b" }, { "name": "threat-detections", "item": [ { "name": "{detection-id}", "item": [ { "name": "Get a detection", "id": "c4073b3c-057b-49fd-bdd2-5c26db8cf244", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "id": "838333a1-3433-4da5-9b4a-b629012b4f1c", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "3440196c-f7eb-4fac-9d96-8329b147cec5", "key": "detection-id", "value": "", "description": "(Required) The unique identifier for this detection." } ] }, "description": "A `GET` request sent to the endpoint root followed by a unique identifier returns detailed information about a specific Threat Detection. This endpoint provides access to comprehensive details such as the triggers (policy violations) and attributes related to the associated resource. To learn more about Threat Detections, refer to the [Detections Overview](/threats/detections/overview) page." }, "response": [ { "id": "0bc939e0-a51d-4df6-bcab-31687f7f59bb", "name": "Received detection by id", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"category\": \"NETWORK\",\n \"description\": \"\",\n \"first_seen_time\": \"\",\n \"id\": \"\",\n \"last_seen_time\": \"\",\n \"mitre_attacks\": [\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n },\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n }\n ],\n \"occurrence_count\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_account_name\": \"\",\n \"cloud_account_tags\": [\n {\n \"key\": \"\",\n \"value\": \"\"\n },\n {\n \"key\": \"\",\n \"value\": \"\"\n }\n ],\n \"cloud_provider\": \"ORACLE\",\n \"cluster_id\": \"\",\n \"external_id\": \"\",\n \"id\": \"\",\n \"internet_exposure\": {\n \"ingress\": {\n \"active_communication\": \"\"\n }\n },\n \"name\": \"\",\n \"namespace\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"type\": \"\",\n \"upwind_asset_id\": \"\"\n },\n \"severity\": \"HIGH\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"triggers\": [\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AZURE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n },\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"ORACLE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AWS\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n }\n ],\n \"type\": \"\"\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-0bc939e0-a51d-4df6-bcab-31687f7f59bb" }, { "id": "095ccddb-0d70-4e94-8b97-b55a11e99e51", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-095ccddb-0d70-4e94-8b97-b55a11e99e51" }, { "id": "b67ade4c-45da-484a-9fcd-aeed8bb42c58", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b67ade4c-45da-484a-9fcd-aeed8bb42c58" }, { "id": "d172c70b-71bf-42c4-b46d-d6ae7fbdf8bd", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-d172c70b-71bf-42c4-b46d-d6ae7fbdf8bd" }, { "id": "8881997d-6308-4699-a513-039ec99fbe56", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8881997d-6308-4699-a513-039ec99fbe56" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-c4073b3c-057b-49fd-bdd2-5c26db8cf244" }, { "name": "Update a detection", "id": "f75a4342-12f2-4c16-b1ac-b6523c9d660e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "id": "333214a9-5f62-4336-bba5-fd5234004fcd", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "d6c6dfe0-5933-4902-a471-0370ab4f1b90", "key": "detection-id", "value": "", "description": "(Required) The unique identifier for this detection." } ] }, "description": "A `PATCH` request sent to the endpoint root followed by a unique identifier allows for updating specific fields of an existing Threat Detection. This endpoint facilitates the modification of attributes such the detection status. To modify a Threat Detection, provide the necessary changes in the request body. To learn more about Threat Detections, refer to the [Detections Overview](/threats/detections/overview) page." }, "response": [ { "id": "8437ece9-84ef-49ab-9fb1-1405b3a2530e", "name": "OK", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"category\": \"NETWORK\",\n \"description\": \"\",\n \"first_seen_time\": \"\",\n \"id\": \"\",\n \"last_seen_time\": \"\",\n \"mitre_attacks\": [\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n },\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n }\n ],\n \"occurrence_count\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_account_name\": \"\",\n \"cloud_account_tags\": [\n {\n \"key\": \"\",\n \"value\": \"\"\n },\n {\n \"key\": \"\",\n \"value\": \"\"\n }\n ],\n \"cloud_provider\": \"ORACLE\",\n \"cluster_id\": \"\",\n \"external_id\": \"\",\n \"id\": \"\",\n \"internet_exposure\": {\n \"ingress\": {\n \"active_communication\": \"\"\n }\n },\n \"name\": \"\",\n \"namespace\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"type\": \"\",\n \"upwind_asset_id\": \"\"\n },\n \"severity\": \"HIGH\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"triggers\": [\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AZURE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n },\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"ORACLE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AWS\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n }\n ],\n \"type\": \"\"\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8437ece9-84ef-49ab-9fb1-1405b3a2530e" }, { "id": "215002d6-5387-4a58-952a-0ca3e7f41a6e", "name": "Unauthorized", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-215002d6-5387-4a58-952a-0ca3e7f41a6e" }, { "id": "6b7f8336-185e-4d3b-b20e-e6ecccf13e53", "name": "Forbidden", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-6b7f8336-185e-4d3b-b20e-e6ecccf13e53" }, { "id": "9cb70785-1a8c-4fdb-b007-391cd59b2e77", "name": "Not Found", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-9cb70785-1a8c-4fdb-b007-391cd59b2e77" }, { "id": "3eff15d1-7ada-44b0-989f-9595deca05e8", "name": "Rate Limit Exceeded", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"status\": \"ARCHIVED\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections/:detection-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections", ":detection-id" ], "variable": [ { "key": "organization-id" }, { "key": "detection-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3eff15d1-7ada-44b0-989f-9595deca05e8" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-f75a4342-12f2-4c16-b1ac-b6523c9d660e" } ], "id": "d389ddf3-b227-4b42-b093-cb83ee00489e", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-d389ddf3-b227-4b42-b093-cb83ee00489e" }, { "name": "List detections", "id": "babb721f-1ba8-40ae-bd8a-09333616aff1", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections?severity=&type=&category=&upwind-asset-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections" ], "query": [ { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters detections by their type.", "key": "type", "value": "" }, { "description": "Filters detections by their category.", "key": "category", "value": "" }, { "description": "Filters detections by their Upwind asset ID.", "key": "upwind-asset-id", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" } ], "variable": [ { "id": "e3a0fd93-621b-4ba3-bcc0-14013c337e66", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A `GET` request sent to the endpoint root returns a list of Threat Detection objects that are associated with the specified organization. To learn more about Threat Detections, refer to the [Detections Overview](/threats/detections/overview) page." }, "response": [ { "id": "4e8c3788-9e2c-4bb3-a1d0-d626e33b040d", "name": "Received list of detections", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections?severity=&type=&category=&upwind-asset-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections" ], "query": [ { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters detections by their type.", "key": "type", "value": "" }, { "description": "Filters detections by their category.", "key": "category", "value": "" }, { "description": "Filters detections by their Upwind asset ID.", "key": "upwind-asset-id", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "[\n {\n \"category\": \"NETWORK\",\n \"description\": \"\",\n \"first_seen_time\": \"\",\n \"id\": \"\",\n \"last_seen_time\": \"\",\n \"mitre_attacks\": [\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n },\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n }\n ],\n \"occurrence_count\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_account_name\": \"\",\n \"cloud_account_tags\": [\n {\n \"key\": \"\",\n \"value\": \"\"\n },\n {\n \"key\": \"\",\n \"value\": \"\"\n }\n ],\n \"cloud_provider\": \"AZURE\",\n \"cluster_id\": \"\",\n \"external_id\": \"\",\n \"id\": \"\",\n \"internet_exposure\": {\n \"ingress\": {\n \"active_communication\": \"\"\n }\n },\n \"name\": \"\",\n \"namespace\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"type\": \"\",\n \"upwind_asset_id\": \"\"\n },\n \"severity\": \"CRITICAL\",\n \"status\": \"OPEN\",\n \"title\": \"\",\n \"triggers\": [\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"GCP\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n },\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AWS\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AZURE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n }\n ],\n \"type\": \"\"\n },\n {\n \"category\": \"CLOUD_LOGS\",\n \"description\": \"\",\n \"first_seen_time\": \"\",\n \"id\": \"\",\n \"last_seen_time\": \"\",\n \"mitre_attacks\": [\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n },\n {\n \"tactic_id\": \"\",\n \"tactic_name\": \"\",\n \"technique_id\": \"\",\n \"technique_name\": \"\"\n }\n ],\n \"occurrence_count\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_account_name\": \"\",\n \"cloud_account_tags\": [\n {\n \"key\": \"\",\n \"value\": \"\"\n },\n {\n \"key\": \"\",\n \"value\": \"\"\n }\n ],\n \"cloud_provider\": \"ORACLE\",\n \"cluster_id\": \"\",\n \"external_id\": \"\",\n \"id\": \"\",\n \"internet_exposure\": {\n \"ingress\": {\n \"active_communication\": \"\"\n }\n },\n \"name\": \"\",\n \"namespace\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"type\": \"\",\n \"upwind_asset_id\": \"\"\n },\n \"severity\": \"MEDIUM\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"triggers\": [\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"ORACLE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AZURE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n },\n {\n \"events\": [\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AZURE\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n },\n {\n \"type\": \"\",\n \"description\": \"\",\n \"event_time\": \"\",\n \"event_type\": \"\",\n \"id\": \"\",\n \"resource\": {\n \"cloud_account_id\": \"\",\n \"cloud_provider\": \"AWS\",\n \"id\": \"\",\n \"name\": \"\",\n \"region\": \"\",\n \"risk_categories\": [\n \"\",\n \"\"\n ],\n \"upwind_asset_id\": \"\"\n },\n \"data\": {\n \"initiator\": {\n \"data\": {\n \"groups\": [\n \"\",\n \"\"\n ],\n \"source_ips\": [\n \"\",\n \"\"\n ],\n \"uid\": \"\",\n \"user_agent\": \"\",\n \"user_name\": \"\"\n },\n \"type\": \"\"\n }\n }\n }\n ],\n \"policy_id\": \"\",\n \"policy_name\": \"\"\n }\n ],\n \"type\": \"\"\n }\n]", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-4e8c3788-9e2c-4bb3-a1d0-d626e33b040d" }, { "id": "e41e8ee5-e53d-4883-9365-6932d76c6083", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections?severity=&type=&category=&upwind-asset-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections" ], "query": [ { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters detections by their type.", "key": "type", "value": "" }, { "description": "Filters detections by their category.", "key": "category", "value": "" }, { "description": "Filters detections by their Upwind asset ID.", "key": "upwind-asset-id", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e41e8ee5-e53d-4883-9365-6932d76c6083" }, { "id": "73a8c556-b0ff-4ca8-bf0c-6c8d39fee66d", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections?severity=&type=&category=&upwind-asset-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections" ], "query": [ { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters detections by their type.", "key": "type", "value": "" }, { "description": "Filters detections by their category.", "key": "category", "value": "" }, { "description": "Filters detections by their Upwind asset ID.", "key": "upwind-asset-id", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-73a8c556-b0ff-4ca8-bf0c-6c8d39fee66d" }, { "id": "377f8d41-f82b-47cb-bd0f-a7de81e453ba", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-detections?severity=&type=&category=&upwind-asset-id=&min-first-seen-time=&max-first-seen-time=&max-last-seen-time=&min-last-seen-time=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-detections" ], "query": [ { "description": "Filters by the level of severity.", "key": "severity", "value": "" }, { "description": "Filters detections by their type.", "key": "type", "value": "" }, { "description": "Filters detections by their category.", "key": "category", "value": "" }, { "description": "Filters detections by their Upwind asset ID.", "key": "upwind-asset-id", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were first seen.", "key": "min-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were first seen.", "key": "max-first-seen-time", "value": "" }, { "description": "Filters detections by the latest timestamp (in ISO8601 format) when they were last seen.", "key": "max-last-seen-time", "value": "" }, { "description": "Filters detections by the earliest timestamp (in ISO8601 format) when they were last seen.", "key": "min-last-seen-time", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-377f8d41-f82b-47cb-bd0f-a7de81e453ba" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-babb721f-1ba8-40ae-bd8a-09333616aff1" } ], "id": "7ea545b6-9ad5-480f-aaf2-48494528adfc", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-7ea545b6-9ad5-480f-aaf2-48494528adfc" }, { "name": "threat-policies", "item": [ { "name": "{policy-id}", "item": [ { "name": "Update a policy", "id": "90c21f13-6b79-4c81-b3db-40d1bf579e60", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "id": "ca07de76-b294-4e37-a5ea-0832e165ceaf", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "02919c69-1770-4bad-8623-9b2db2fbbb09", "key": "policy-id", "value": "", "description": "(Required) The unique identifier for this policy." } ] }, "description": "A `PATCH` request sent to the endpoint root followed by a unique identifier allows for updating specific fields of an existing Threat Policy. This endpoint facilitates the modification of attributes such the enablement status. To modify a Threat Policy, provide the necessary changes in the request body. To learn more about Threat Policies, refer to the [Policies Overview](/threats/policies/overview) page." }, "response": [ { "id": "ac4bb19b-ce01-427f-93f8-ba66cfa3417d", "name": "OK", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"category\": \"PROCESS_EXECUTION\",\n \"display_name\": \"\",\n \"enabled\": \"\",\n \"id\": \"\",\n \"managed_by\": \"UPWIND\",\n \"open_issues\": \"\",\n \"scope\": \"SUBSET\",\n \"severity\": \"LOW\"\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ac4bb19b-ce01-427f-93f8-ba66cfa3417d" }, { "id": "77c640d8-f784-4f03-95b7-2f86017a703e", "name": "Unauthorized", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-77c640d8-f784-4f03-95b7-2f86017a703e" }, { "id": "3d0729db-d2d7-4113-87fb-44f0a5f1570f", "name": "Forbidden", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3d0729db-d2d7-4113-87fb-44f0a5f1570f" }, { "id": "21123bee-5c74-4ba4-978d-7c16f85217bf", "name": "Not Found", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-21123bee-5c74-4ba4-978d-7c16f85217bf" }, { "id": "766c7d69-fd91-4fda-bd85-29a557212193", "name": "Rate Limit Exceeded", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"enabled\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-766c7d69-fd91-4fda-bd85-29a557212193" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-90c21f13-6b79-4c81-b3db-40d1bf579e60" } ], "id": "3127654b-5c5c-423b-9c87-f3cbca078ef4", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-3127654b-5c5c-423b-9c87-f3cbca078ef4" }, { "name": "List policies", "id": "ebc3d83e-ea7a-4c1d-a83a-c0045667788a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies?managed-by=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies" ], "query": [ { "description": "Filters the policy list to include only policies managed by the specified entity.", "key": "managed-by", "value": "" } ], "variable": [ { "id": "99fec40b-f726-47d7-9207-e709241cfdfe", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A `GET` request sent to the endpoint root returns a list of Threat Policy objects that are associated with the specified organization. To learn more about Threat Policies, refer to the [Policies Overview](/threats/policies/overview) page." }, "response": [ { "id": "3c488e94-f99a-4b22-9f8d-4c8a91b63ca1", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies?managed-by=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies" ], "query": [ { "description": "Filters the policy list to include only policies managed by the specified entity.", "key": "managed-by", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "[\n {\n \"category\": \"PROCESS_EXECUTION\",\n \"display_name\": \"\",\n \"enabled\": \"\",\n \"id\": \"\",\n \"managed_by\": \"UPWIND\",\n \"open_issues\": \"\",\n \"scope\": \"SUBSET\",\n \"severity\": \"LOW\"\n },\n {\n \"category\": \"PROCESS_EXECUTION\",\n \"display_name\": \"\",\n \"enabled\": \"\",\n \"id\": \"\",\n \"managed_by\": \"UPWIND\",\n \"open_issues\": \"\",\n \"scope\": \"ALL_RESOURCES\",\n \"severity\": \"MEDIUM\"\n }\n]", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3c488e94-f99a-4b22-9f8d-4c8a91b63ca1" }, { "id": "eb9f3cfb-4413-4c61-9c2f-fc9c0953704d", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies?managed-by=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies" ], "query": [ { "description": "Filters the policy list to include only policies managed by the specified entity.", "key": "managed-by", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-eb9f3cfb-4413-4c61-9c2f-fc9c0953704d" }, { "id": "28e8bffd-a2f4-43eb-b9a1-a0ca6025165b", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies?managed-by=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies" ], "query": [ { "description": "Filters the policy list to include only policies managed by the specified entity.", "key": "managed-by", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-28e8bffd-a2f4-43eb-b9a1-a0ca6025165b" }, { "id": "8565d008-ecff-4ff5-a3cc-493a27050f5e", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v1/organizations/:organization-id/threat-policies?managed-by=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "organizations", ":organization-id", "threat-policies" ], "query": [ { "description": "Filters the policy list to include only policies managed by the specified entity.", "key": "managed-by", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8565d008-ecff-4ff5-a3cc-493a27050f5e" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-ebc3d83e-ea7a-4c1d-a83a-c0045667788a" } ], "id": "ca05fa31-b60f-4490-8f52-34ee3a5961de", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-ca05fa31-b60f-4490-8f52-34ee3a5961de" } ], "id": "deb9c032-2b6a-41f1-a1cd-1cc3bde6be80", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-deb9c032-2b6a-41f1-a1cd-1cc3bde6be80" } ], "id": "bc636385-b82a-43f0-a87b-b41f573c5654", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-bc636385-b82a-43f0-a87b-b41f573c5654" } ], "id": "369547fc-f624-4e20-b5e1-748b72a1c058", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-369547fc-f624-4e20-b5e1-748b72a1c058" }, { "name": "v2", "item": [ { "name": "organizations", "item": [ { "name": "{organization-id}", "item": [ { "name": "threats", "item": [ { "name": "policies", "item": [ { "name": "{policy-id}", "item": [ { "name": "rules", "item": [ { "name": "bulk", "item": [ { "name": "Bulk create policy rules", "id": "41131eb1-9a5d-46f4-90a5-2cf5971f3ea0", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "id": "9fb42fa5-c1ab-49d5-b01a-409aecb8fbb0", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "4cfbe302-34d5-40f8-9ae4-0e43237dcc12", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" } ] }, "description": "A POST request sent to the bulk endpoint attaches multiple rule definitions to the policy. Returns 400 if any rule definition's category is incompatible with the policy source type, or if the rule definition and policy have mismatched management types. If any item in the request fails, no policy rules are created." }, "response": [ { "id": "4e146782-7c18-4757-abe3-e857154e37ae", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"high\",\n \"threat_category\": \"file_events\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"critical\",\n \"threat_category\": \"network_traffic\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-4e146782-7c18-4757-abe3-e857154e37ae" }, { "id": "5f2e9ab8-7f34-4c32-ba14-411299742768", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-5f2e9ab8-7f34-4c32-ba14-411299742768" }, { "id": "e5aeed72-1d21-4236-8477-2bdc71459a04", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e5aeed72-1d21-4236-8477-2bdc71459a04" }, { "id": "f63f9fdd-2d5d-4a8f-a1d1-195c25d29607", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-f63f9fdd-2d5d-4a8f-a1d1-195c25d29607" }, { "id": "b463b1ab-d026-4e77-88c4-8048b788c563", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"rule_definition_id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b463b1ab-d026-4e77-88c4-8048b788c563" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-41131eb1-9a5d-46f4-90a5-2cf5971f3ea0" }, { "name": "Bulk delete policy rules", "id": "e4be2ec9-1cd6-4ac2-a796-2acfb77fe1d9", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "id": "efdb9ee6-e6e1-4303-b9a9-3ad2ae0b7fee", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "631046b1-ccc0-4eee-9581-696d654c4879", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" } ] }, "description": "A DELETE request sent to the bulk endpoint detaches multiple rule definitions from the policy. The rule definitions themselves are not affected. If any ID in the request is invalid, no policy rules are removed." }, "response": [ { "id": "e772c449-3112-438e-a692-6072e2077c3e", "name": "OK", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e772c449-3112-438e-a692-6072e2077c3e" }, { "id": "a3472e18-dbfb-407f-8759-2243cc761aa7", "name": "Unauthorized", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a3472e18-dbfb-407f-8759-2243cc761aa7" }, { "id": "e3c75f3b-3a18-4ebc-908d-31ee3dbf8073", "name": "Forbidden", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e3c75f3b-3a18-4ebc-908d-31ee3dbf8073" }, { "id": "41eb9192-69c6-467c-ae8d-dcd565a6ff6b", "name": "Not Found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-41eb9192-69c6-467c-ae8d-dcd565a6ff6b" }, { "id": "521398e2-a5e3-4e7d-b234-37c6a9bca291", "name": "Rate Limit Exceeded", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rule_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-521398e2-a5e3-4e7d-b234-37c6a9bca291" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-e4be2ec9-1cd6-4ac2-a796-2acfb77fe1d9" }, { "name": "Bulk edit policy rules", "id": "8f2c34ef-dc3d-4040-8b66-123e0f20aea6", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "id": "6c74902b-7024-4a8f-bcac-061756cc5290", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "8e396ad3-2832-4b20-bee3-0763df8d9e4c", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" } ] }, "description": "A PATCH request sent to the bulk endpoint updates multiple policy rules. Each item must include id plus at least one of severity, scope, or is_enabled. If any item in the request is not found or fails validation, no updates are applied." }, "response": [ { "id": "931eedd0-6b63-44fc-b321-fd8c1283d2ac", "name": "OK", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"high\",\n \"threat_category\": \"file_events\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"critical\",\n \"threat_category\": \"network_traffic\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-931eedd0-6b63-44fc-b321-fd8c1283d2ac" }, { "id": "ff9fb5e9-37f3-42e7-a9d2-cdf514a9fd7f", "name": "Unauthorized", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ff9fb5e9-37f3-42e7-a9d2-cdf514a9fd7f" }, { "id": "7db1271c-183a-41c9-b978-9b467d6a35a4", "name": "Forbidden", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-7db1271c-183a-41c9-b978-9b467d6a35a4" }, { "id": "b4af0e0c-84d9-4e32-b6ce-971f853afbaf", "name": "Not Found", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b4af0e0c-84d9-4e32-b6ce-971f853afbaf" }, { "id": "7c64eb24-95d8-4c86-9a02-6fc7cff91753", "name": "Rate Limit Exceeded", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_rules\": [\n {\n \"id\": \"\",\n \"is_enabled\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "bulk" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-7c64eb24-95d8-4c86-9a02-6fc7cff91753" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-8f2c34ef-dc3d-4040-8b66-123e0f20aea6" } ], "id": "328ede61-15a8-4b22-bb72-eb7e505f123a", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-328ede61-15a8-4b22-bb72-eb7e505f123a" }, { "name": "{policy-rule-id}", "item": [ { "name": "Get a policy rule", "id": "8bde735b-e944-4f6b-9e64-91898108f3f8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "id": "460da9d9-1350-44aa-a43e-1724c3f06f0c", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "788c8f62-1f42-4698-9723-983709a734b7", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" }, { "id": "eed5e5df-34ca-4259-97f6-6c1c25de5d67", "key": "policy-rule-id", "value": "", "description": "(Required) The unique identifier of the policy rule" } ] }, "description": "A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific policy rule." }, "response": [ { "id": "a4c83fef-caad-4f35-ae11-6d65f6fdd848", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" }, { "key": "policy-rule-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"high\",\n \"threat_category\": \"file_events\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"rule_scope\",\n \"severity\": \"critical\",\n \"threat_category\": \"network_traffic\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a4c83fef-caad-4f35-ae11-6d65f6fdd848" }, { "id": "314083f6-3521-45cf-ac10-731951ac5d66", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" }, { "key": "policy-rule-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-314083f6-3521-45cf-ac10-731951ac5d66" }, { "id": "b982ce41-c0ef-4bc8-a47b-507fa7a1fc7d", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" }, { "key": "policy-rule-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b982ce41-c0ef-4bc8-a47b-507fa7a1fc7d" }, { "id": "b8cd517e-c531-4808-aa80-559b2ae6e1e2", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" }, { "key": "policy-rule-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b8cd517e-c531-4808-aa80-559b2ae6e1e2" }, { "id": "ca954f70-aa8b-4419-8b56-151ca2d8c355", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/:policy-rule-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", ":policy-rule-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" }, { "key": "policy-rule-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ca954f70-aa8b-4419-8b56-151ca2d8c355" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-8bde735b-e944-4f6b-9e64-91898108f3f8" } ], "id": "1b9c99bb-398f-481c-8114-09af432e0c55", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-1b9c99bb-398f-481c-8114-09af432e0c55" }, { "name": "search", "item": [ { "name": "Search policy rules", "id": "77971d3f-9a2b-4498-8797-c919bcc70b56", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "id": "d9950078-b3e5-46e4-8215-ecbb0b3fe7ce", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "cf2ada1d-cfe1-4833-87df-b0cb937a0103", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" } ] }, "description": "A POST request sent to the search endpoint returns a filtered list of policy rule objects for the specified policy, based on the given search criteria." }, "response": [ { "id": "7e9cc202-1149-434b-8358-5ce045b721aa", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"no_scope\",\n \"severity\": \"low\",\n \"threat_category\": \"cloud_trail_logs\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"\"\n },\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_rule_id\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_definition_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"no_scope\",\n \"severity\": \"critical\",\n \"threat_category\": \"cloud_trail_logs\",\n \"update_time\": \"\"\n }\n ],\n \"metadata\": {\n \"limit\": \"\",\n \"next_cursor\": \"\",\n \"previous_cursor\": \"\"\n }\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-7e9cc202-1149-434b-8358-5ce045b721aa" }, { "id": "508fd1bf-01e1-443f-9b52-c44606f0fc63", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-508fd1bf-01e1-443f-9b52-c44606f0fc63" }, { "id": "ecf189b8-d00b-4f07-8573-b5df15d81b10", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ecf189b8-d00b-4f07-8573-b5df15d81b10" }, { "id": "53ff38b9-4391-4c6d-9fcd-8b178fdd87bc", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-53ff38b9-4391-4c6d-9fcd-8b178fdd87bc" }, { "id": "a68eeca0-0d1d-439a-be43-3ebb23bafe6a", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"creator_id\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"last_modifier_id\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id/rules/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id", "rules", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a68eeca0-0d1d-439a-be43-3ebb23bafe6a" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-77971d3f-9a2b-4498-8797-c919bcc70b56" } ], "id": "805852c9-f15a-46a7-a9eb-5892c31dcb76", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-805852c9-f15a-46a7-a9eb-5892c31dcb76" } ], "id": "239973e6-27c4-4c6f-916b-83bb708aac1d", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-239973e6-27c4-4c6f-916b-83bb708aac1d" }, { "name": "Get a policy", "id": "9c48778d-2404-4d5e-8105-f56675f18bc5", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "id": "4be11f10-0f85-49a4-b656-59b2b5eda866", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "37325826-6bd7-4917-bffd-7fa4976f9544", "key": "policy-id", "value": "", "description": "(Required) The unique identifier of the policy" } ] }, "description": "A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific policy." }, "response": [ { "id": "b9970421-d1aa-4419-a873-9ec11ee1709d", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b9970421-d1aa-4419-a873-9ec11ee1709d" }, { "id": "3ece13cc-1c18-480c-90f0-23489a38113d", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3ece13cc-1c18-480c-90f0-23489a38113d" }, { "id": "df23baea-0c67-4b62-9ce0-3b7b63113fb8", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-df23baea-0c67-4b62-9ce0-3b7b63113fb8" }, { "id": "b8836a3c-76cf-415e-a733-cc5c0632f4b6", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b8836a3c-76cf-415e-a733-cc5c0632f4b6" }, { "id": "132481e1-59fa-4744-a715-8618457309d7", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/:policy-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", ":policy-id" ], "variable": [ { "key": "organization-id" }, { "key": "policy-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-132481e1-59fa-4744-a715-8618457309d7" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-9c48778d-2404-4d5e-8105-f56675f18bc5" } ], "id": "cf277850-81e8-4bc8-b2bc-18873af930d1", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-cf277850-81e8-4bc8-b2bc-18873af930d1" }, { "name": "bulk", "item": [ { "name": "Bulk create policies", "id": "08c1895d-d46a-4335-b7ed-d5702ed4d1e2", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "id": "4aa5468b-2bcc-4583-b7ed-c2b7df46223c", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A POST request sent to the bulk endpoint creates multiple policies. If any policy in the request fails validation, no policies are created." }, "response": [ { "id": "c5f6092d-e41f-4598-95a3-debc57a26b68", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-c5f6092d-e41f-4598-95a3-debc57a26b68" }, { "id": "c573fdda-5bc0-4835-abe6-4889f0bcce81", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-c573fdda-5bc0-4835-abe6-4889f0bcce81" }, { "id": "1825c418-3206-4b33-aed8-b450f83d2d9f", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-1825c418-3206-4b33-aed8-b450f83d2d9f" }, { "id": "36835961-e411-4cf6-b5ab-289b4cbfaf7e", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-36835961-e411-4cf6-b5ab-289b4cbfaf7e" }, { "id": "233f8312-5584-40b4-902f-ffc4453a33cc", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"default_severity\": \"low\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"source_type\": \"sensor\",\n \"is_enabled\": true,\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-233f8312-5584-40b4-902f-ffc4453a33cc" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-08c1895d-d46a-4335-b7ed-d5702ed4d1e2" }, { "name": "Bulk delete policies", "id": "4086b26d-5e47-4a95-9a26-ae663fe99267", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "id": "bfd14f52-a701-4f19-8ad0-fdb1278c1d69", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A DELETE request sent to the bulk endpoint removes multiple policies and their rule attachments. If any ID in the request is invalid, no policies are removed." }, "response": [ { "id": "c4a4c7e9-3304-4dda-b137-d59074e17e1e", "name": "OK", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-c4a4c7e9-3304-4dda-b137-d59074e17e1e" }, { "id": "e7c97355-78de-4709-8dcf-8858ef03e250", "name": "Unauthorized", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e7c97355-78de-4709-8dcf-8858ef03e250" }, { "id": "fe6a9fdf-f7fd-47f5-858d-590862121b69", "name": "Forbidden", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-fe6a9fdf-f7fd-47f5-858d-590862121b69" }, { "id": "c8cf5c44-bd07-4a05-a7c5-96a45b7a9512", "name": "Not Found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-c8cf5c44-bd07-4a05-a7c5-96a45b7a9512" }, { "id": "849ee3b6-3cb8-444c-83b0-b13b31c25454", "name": "Rate Limit Exceeded", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policy_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-849ee3b6-3cb8-444c-83b0-b13b31c25454" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-4086b26d-5e47-4a95-9a26-ae663fe99267" }, { "name": "Bulk edit policies", "id": "db827503-8c19-4c59-bd5f-042231ae8f40", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "id": "c96be146-a86c-4608-8fc5-01bc8a7d91dc", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A PATCH request sent to the bulk endpoint updates multiple policies. If any policy in the request is not found or fails validation, no updates are applied." }, "response": [ { "id": "9abb53c6-06f1-4091-9f31-cadbd8ed428a", "name": "OK", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"low\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-9abb53c6-06f1-4091-9f31-cadbd8ed428a" }, { "id": "a5da72bf-48c5-46bf-ad69-b18b05aaf14f", "name": "Unauthorized", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a5da72bf-48c5-46bf-ad69-b18b05aaf14f" }, { "id": "40ffb9bc-1b79-405a-affb-af3955860612", "name": "Forbidden", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-40ffb9bc-1b79-405a-affb-af3955860612" }, { "id": "e7807521-7218-4ca0-8f96-311221b6d06e", "name": "Not Found", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e7807521-7218-4ca0-8f96-311221b6d06e" }, { "id": "be55ee62-feae-4048-bece-e953d6996144", "name": "Rate Limit Exceeded", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"policies\": [\n {\n \"id\": \"\",\n \"default_severity\": \"medium\",\n \"is_enabled\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n }\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-be55ee62-feae-4048-bece-e953d6996144" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-db827503-8c19-4c59-bd5f-042231ae8f40" } ], "id": "3689fc06-b3ce-431d-bf8e-d156ed70f9f5", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-3689fc06-b3ce-431d-bf8e-d156ed70f9f5" }, { "name": "search", "item": [ { "name": "Search policies", "id": "241e6588-9f63-46de-815d-990ef5ce80c7", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "id": "71870948-dfaf-4219-b319-777dcdc271a0", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A POST request sent to the search endpoint returns a filtered list of policy objects that are associated with the specified organization based on the specified search criteria." }, "response": [ { "id": "4bba1119-c55c-44e2-b597-6b85793b6024", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"high\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"default_values\": {\n \"is_enabled\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"medium\"\n },\n \"is_enabled\": \"\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\"\n },\n \"name\": \"\",\n \"policy_id\": \"\",\n \"resource_scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"severity\": \"critical\",\n \"source_type\": \"cloud_logs\",\n \"update_time\": \"\"\n }\n ],\n \"metadata\": {\n \"limit\": \"\",\n \"next_cursor\": \"\",\n \"previous_cursor\": \"\"\n }\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-4bba1119-c55c-44e2-b597-6b85793b6024" }, { "id": "1c4afa07-7ff6-4a16-8652-725105e3eae9", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-1c4afa07-7ff6-4a16-8652-725105e3eae9" }, { "id": "6633c5de-22e0-46c3-871d-5bc9ceffe64a", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-6633c5de-22e0-46c3-871d-5bc9ceffe64a" }, { "id": "5ca973ef-1192-4acf-b38f-caf444b3d085", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-5ca973ef-1192-4acf-b38f-caf444b3d085" }, { "id": "a2419c84-ca84-4b54-9f71-69903c0b47ac", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"eq\",\n \"value\": [],\n \"field\": \"update_time\"\n },\n {\n \"operator\": \"gte\",\n \"value\": [],\n \"field\": \"source_type\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/policies/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "policies", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `severity`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a2419c84-ca84-4b54-9f71-69903c0b47ac" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-241e6588-9f63-46de-815d-990ef5ce80c7" } ], "id": "f64470e2-cb48-49c6-91f6-64fd99deacbd", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-f64470e2-cb48-49c6-91f6-64fd99deacbd" } ], "id": "f0a20685-f2be-4bb7-99a7-375b635df18d", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-f0a20685-f2be-4bb7-99a7-375b635df18d" }, { "name": "rule-definitions", "item": [ { "name": "bulk", "item": [ { "name": "Bulk create rule definitions", "id": "94fd9b3f-7752-448d-a9c5-4cf4b308862b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "id": "da426517-34f5-4218-ab07-1411434ce2ea", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A POST request sent to the bulk endpoint creates multiple rule definitions. If any rule definition in the request fails validation, no rule definitions are created." }, "response": [ { "id": "4d0670cc-8557-4357-aa42-390b033919cb", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"files\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"network_baseline\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-4d0670cc-8557-4357-aa42-390b033919cb" }, { "id": "451690fe-82b2-4212-b0f6-d449f2657565", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-451690fe-82b2-4212-b0f6-d449f2657565" }, { "id": "6c8310d5-0e0e-435e-87d8-8bb1421da4fb", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-6c8310d5-0e0e-435e-87d8-8bb1421da4fb" }, { "id": "3d111288-3508-4bd3-91f2-9055d023ea4b", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3d111288-3508-4bd3-91f2-9055d023ea4b" }, { "id": "44be79c8-6000-4061-b990-d514c239f733", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"engine\": \"rego\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"azure_activity_logs\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-44be79c8-6000-4061-b990-d514c239f733" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-94fd9b3f-7752-448d-a9c5-4cf4b308862b" }, { "name": "Bulk delete rule definitions", "id": "28e42ec8-c13d-4d28-81ed-a24a10ae3e26", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "id": "af889ce4-8c36-4748-bf69-9716cfd77060", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A DELETE request sent to the bulk endpoint removes multiple rule definitions and their policy attachments. If any ID in the request is invalid, no rule definitions are removed." }, "response": [ { "id": "e456e8c5-dd8f-49fe-9d0e-30db5715c6fd", "name": "OK", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e456e8c5-dd8f-49fe-9d0e-30db5715c6fd" }, { "id": "f2fe5876-f288-432d-89ed-1dcff794bef3", "name": "Unauthorized", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-f2fe5876-f288-432d-89ed-1dcff794bef3" }, { "id": "e7f63864-7d7c-4a06-9715-e2a312af1d0b", "name": "Forbidden", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e7f63864-7d7c-4a06-9715-e2a312af1d0b" }, { "id": "3ef665d0-973b-4d58-884a-d3dc3a835771", "name": "Not Found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3ef665d0-973b-4d58-884a-d3dc3a835771" }, { "id": "0e654e66-26bf-48ee-a0ce-d6c937d0f063", "name": "Rate Limit Exceeded", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definition_ids\": [\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-0e654e66-26bf-48ee-a0ce-d6c937d0f063" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-28e42ec8-c13d-4d28-81ed-a24a10ae3e26" }, { "name": "Bulk edit rule definitions", "id": "293de2de-9df6-4c39-a568-284bee81da75", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "id": "1c850866-6855-4a5e-be70-7041a8d93602", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A PATCH request sent to the bulk endpoint updates multiple rule definitions. If any rule definition in the request is not found or fails validation, no updates are applied." }, "response": [ { "id": "e8dcc70e-0cee-4f0f-bc70-75969568ee1c", "name": "OK", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"files\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"network_baseline\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e8dcc70e-0cee-4f0f-bc70-75969568ee1c" }, { "id": "f461f5dd-bf61-487c-8588-34750c5dd51f", "name": "Unauthorized", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-f461f5dd-bf61-487c-8588-34750c5dd51f" }, { "id": "99700b13-4b4f-4fdb-8c8d-d038a1484a5b", "name": "Forbidden", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-99700b13-4b4f-4fdb-8c8d-d038a1484a5b" }, { "id": "a10cedba-c627-4eb8-a5b8-7e2e84eb985b", "name": "Not Found", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-a10cedba-c627-4eb8-a5b8-7e2e84eb985b" }, { "id": "32964842-c9ed-4ea3-8f14-917934bc39e2", "name": "Rate Limit Exceeded", "originalRequest": { "method": "PATCH", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"rule_definitions\": [\n {\n \"id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_expression\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/bulk", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "bulk" ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-32964842-c9ed-4ea3-8f14-917934bc39e2" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-293de2de-9df6-4c39-a568-284bee81da75" } ], "id": "312bbe2e-d57e-4084-bcdb-b0c2d21cb493", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-312bbe2e-d57e-4084-bcdb-b0c2d21cb493" }, { "name": "{rule-definition-id}", "item": [ { "name": "policies", "item": [ { "name": "Get the policies a rule definition is attached to", "id": "13bb3d0e-55ab-45e3-8583-fea6bcf586d8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "id": "64ca1693-f136-4544-9941-4622251d95af", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "3b2cb27b-b7d4-4dab-a354-b65005312613", "key": "rule-definition-id", "value": "", "description": "(Required) The unique identifier of the rule definition" } ] }, "description": "Returns the list of policies this rule definition is attached to, with per-attachment effective values (severity, scope, scope_type, is_enabled, is_suspended). An unknown or unattached rule-definition ID returns an empty items list with 200 OK, not 404 \u2014 the upstream service does not validate ID existence on this route." }, "response": [ { "id": "23783618-ece4-4269-a0cf-503fcd4114aa", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"not_equals\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"no_scope\",\n \"severity\": \"low\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"is_enabled\": \"\",\n \"is_suspended\": \"\",\n \"last_modifier_id\": \"\",\n \"policy_id\": \"\",\n \"policy_name\": \"\",\n \"scope\": {\n \"condition\": {\n \"field\": \"\",\n \"operator\": \"in\",\n \"type\": \"\",\n \"value\": [\n \"\"\n ]\n }\n },\n \"scope_type\": \"no_scope\",\n \"severity\": \"high\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-23783618-ece4-4269-a0cf-503fcd4114aa" }, { "id": "45c9b547-5523-457b-af66-81d50e8e1579", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-45c9b547-5523-457b-af66-81d50e8e1579" }, { "id": "9cc00888-8637-493b-aa16-b139962fcb28", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-9cc00888-8637-493b-aa16-b139962fcb28" }, { "id": "b02a45f6-48bc-4dfa-90bb-77d4c2b6d624", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b02a45f6-48bc-4dfa-90bb-77d4c2b6d624" }, { "id": "e6010e67-b049-46bb-b6bc-06663b2b815b", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id/policies", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id", "policies" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-e6010e67-b049-46bb-b6bc-06663b2b815b" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-13bb3d0e-55ab-45e3-8583-fea6bcf586d8" } ], "id": "f9bdf677-c0bf-45db-a35b-2dc25c86c7bc", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-f9bdf677-c0bf-45db-a35b-2dc25c86c7bc" }, { "name": "Get a rule definition", "id": "146c2b1d-8c98-4c27-a13c-f1daddb37ef7", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "id": "55cee4a8-bf22-4b17-a5d3-736c10230d55", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "71a332b9-8b95-4e2d-8db4-0f491647ee30", "key": "rule-definition-id", "value": "", "description": "(Required) The unique identifier of the rule definition" } ] }, "description": "A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific rule definition." }, "response": [ { "id": "6bffbd2d-1607-4d31-b9c6-e19ee4944f48", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"files\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"network_baseline\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-6bffbd2d-1607-4d31-b9c6-e19ee4944f48" }, { "id": "8b4cd67a-3236-4b00-b023-236730412bad", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8b4cd67a-3236-4b00-b023-236730412bad" }, { "id": "36091305-2726-461b-a699-a508a6662e0f", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-36091305-2726-461b-a699-a508a6662e0f" }, { "id": "d3529dbd-1727-4af5-9b7b-dc2c38e5c4ef", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-d3529dbd-1727-4af5-9b7b-dc2c38e5c4ef" }, { "id": "2a060e05-71de-4e71-8516-bb3301804575", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/:rule-definition-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", ":rule-definition-id" ], "variable": [ { "key": "organization-id" }, { "key": "rule-definition-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-2a060e05-71de-4e71-8516-bb3301804575" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-146c2b1d-8c98-4c27-a13c-f1daddb37ef7" } ], "id": "fdb0a4e2-2719-4add-8e37-3b3fd09780e9", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-fdb0a4e2-2719-4add-8e37-3b3fd09780e9" }, { "name": "search", "item": [ { "name": "Search rule definitions", "id": "3f7043e5-2ec9-43c3-9634-6da5dd91604a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "id": "4f0bc1d5-0431-4933-ba22-eed64618b9ea", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A POST request sent to the search endpoint returns a filtered list of rule definition objects that are associated with the specified organization based on the specified search criteria." }, "response": [ { "id": "f779f700-82e1-4d92-8dd4-6c87d1a827de", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"network_traffic\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"creator_id\": \"\",\n \"engine\": \"rego\",\n \"last_modifier_id\": \"\",\n \"metadata\": {\n \"detection_description\": \"\",\n \"detection_title\": \"\",\n \"mitre_tactic_code\": \"\",\n \"mitre_tactic_name\": \"\",\n \"mitre_technique_code\": \"\",\n \"mitre_technique_name\": \"\"\n },\n \"name\": \"\",\n \"rule_definition_id\": \"\",\n \"rule_expression\": \"\",\n \"threat_category\": \"gcp_audit_logs\",\n \"update_time\": \"\"\n }\n ],\n \"metadata\": {\n \"limit\": \"\",\n \"next_cursor\": \"\",\n \"previous_cursor\": \"\"\n }\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-f779f700-82e1-4d92-8dd4-6c87d1a827de" }, { "id": "6ff719eb-784f-4629-95ba-ab52960b4557", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-6ff719eb-784f-4629-95ba-ab52960b4557" }, { "id": "420744d1-39f3-49d9-a3c1-89544f4484cb", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-420744d1-39f3-49d9-a3c1-89544f4484cb" }, { "id": "344e96ae-f0f0-4932-ad6d-6300d9e14f06", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-344e96ae-f0f0-4932-ad6d-6300d9e14f06" }, { "id": "b3d1040e-bf02-4610-9272-6618e2b029e1", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/rule-definitions/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "rule-definitions", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `name`, `create_time`, `update_time`. Default: `create_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-b3d1040e-bf02-4610-9272-6618e2b029e1" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-3f7043e5-2ec9-43c3-9634-6da5dd91604a" } ], "id": "eb17061d-dad7-4741-a553-a7e0b447c82a", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-eb17061d-dad7-4741-a553-a7e0b447c82a" } ], "id": "e9e7dfa2-96a4-4761-b510-4d1546ea1d20", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-e9e7dfa2-96a4-4761-b510-4d1546ea1d20" }, { "name": "stories", "item": [ { "name": "{story-id}", "item": [ { "name": "Get a story", "id": "5d1ea178-19d4-452c-8cc1-9f993fdad750", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "id": "d87e47e1-ab67-4eda-a6f9-8bb7c11da412", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." }, { "id": "9b1ccf73-5f0e-434d-aff4-e35a59203a98", "key": "story-id", "value": "", "description": "(Required) The unique identifier of the story" } ] }, "description": "A GET request sent to the endpoint root followed by a unique identifier returns detailed information about a specific story." }, "response": [ { "id": "ee4b43e8-a820-406a-9945-7f85d93657ed", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "key": "organization-id" }, { "key": "story-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"description\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"LOW\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"description\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"INFO\",\n \"status\": \"OPEN\",\n \"title\": \"\",\n \"update_time\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ee4b43e8-a820-406a-9945-7f85d93657ed" }, { "id": "dbf19074-525d-46fd-9399-dd61bd30555d", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "key": "organization-id" }, { "key": "story-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-dbf19074-525d-46fd-9399-dd61bd30555d" }, { "id": "d3dc4dd0-242a-499e-a46f-3e5b930de670", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "key": "organization-id" }, { "key": "story-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-d3dc4dd0-242a-499e-a46f-3e5b930de670" }, { "id": "3423e970-30fa-4cdf-a15b-9239e94858b7", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "key": "organization-id" }, { "key": "story-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-3423e970-30fa-4cdf-a15b-9239e94858b7" }, { "id": "8bb6f23a-5843-4529-bf9a-bb21d222d4a0", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/:story-id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", ":story-id" ], "variable": [ { "key": "organization-id" }, { "key": "story-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8bb6f23a-5843-4529-bf9a-bb21d222d4a0" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-5d1ea178-19d4-452c-8cc1-9f993fdad750" } ], "id": "00688af9-59a6-425e-b9ac-fbbfd1935bca", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-00688af9-59a6-425e-b9ac-fbbfd1935bca" }, { "name": "search", "item": [ { "name": "Search stories", "id": "e1275d04-acf7-48a3-a0b9-2c9c363bb1d3", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "id": "ac3b6018-5a7f-4d41-9468-1fada0782438", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A POST request sent to the search endpoint returns a filtered list of threat stories objects that are associated with the specified organization based on the specified search criteria." }, "response": [ { "id": "5fc1c6f9-3c43-48a4-ab9b-44fccd247ada", "name": "OK", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"LOW\",\n \"status\": \"OPEN\",\n \"title\": \"\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"MEDIUM\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"update_time\": \"\"\n }\n ],\n \"metadata\": {\n \"limit\": \"\",\n \"next_cursor\": \"\",\n \"previous_cursor\": \"\"\n }\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-5fc1c6f9-3c43-48a4-ab9b-44fccd247ada" }, { "id": "8d89ea4d-f821-416a-b3aa-2e32307c6ec2", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-8d89ea4d-f821-416a-b3aa-2e32307c6ec2" }, { "id": "ce405556-3904-4f32-ada1-ebc6bb2f15fd", "name": "Forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-ce405556-3904-4f32-ada1-ebc6bb2f15fd" }, { "id": "44075de2-5562-493f-b89a-d621e7812997", "name": "Not Found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-44075de2-5562-493f-b89a-d621e7812997" }, { "id": "5289b629-d867-4237-83f5-c36dd5d3b92d", "name": "Rate Limit Exceeded", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"conditions\": [\n {\n \"operator\": \"lte\",\n \"value\": [],\n \"field\": \"create_time\"\n },\n {\n \"operator\": \"in\",\n \"value\": [],\n \"field\": \"update_time\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories/search?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories", "search" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-5289b629-d867-4237-83f5-c36dd5d3b92d" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-e1275d04-acf7-48a3-a0b9-2c9c363bb1d3" } ], "id": "6c713e8a-becd-4611-b9e1-cbd2f9d14294", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-6c713e8a-becd-4611-b9e1-cbd2f9d14294" }, { "name": "List stories", "id": "e6dc92a8-0373-455c-aaaa-276ce34a143b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "id": "2596330d-0f79-4b25-8688-a88aa291160b", "key": "organization-id", "value": "", "description": "(Required) The unique identifier for the Upwind organization." } ] }, "description": "A GET request sent to the endpoint root returns a list of threat stories objects that are associated with the specified organization." }, "response": [ { "id": "c374c323-8060-4bfc-8e6b-0de664759126", "name": "OK", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"items\": [\n {\n \"create_time\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"LOW\",\n \"status\": \"OPEN\",\n \"title\": \"\",\n \"update_time\": \"\"\n },\n {\n \"create_time\": \"\",\n \"detection_ids\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"severity\": \"MEDIUM\",\n \"status\": \"ARCHIVED\",\n \"title\": \"\",\n \"update_time\": \"\"\n }\n ],\n \"metadata\": {\n \"limit\": \"\",\n \"next_cursor\": \"\",\n \"previous_cursor\": \"\"\n }\n}", "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-c374c323-8060-4bfc-8e6b-0de664759126" }, { "id": "5eca88d7-5374-4e73-916a-6fae2c9a0575", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-5eca88d7-5374-4e73-916a-6fae2c9a0575" }, { "id": "518ee0cc-6aa3-422c-b545-8f17ad532351", "name": "Forbidden", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-518ee0cc-6aa3-422c-b545-8f17ad532351" }, { "id": "d2cd4fe2-360e-45e5-9bc1-d8053151119a", "name": "Not Found", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-d2cd4fe2-360e-45e5-9bc1-d8053151119a" }, { "id": "91a4d280-6cae-46b1-8b40-b6b178daf0c6", "name": "Rate Limit Exceeded", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: oauth2", "key": "Authorization", "value": "" } ], "url": { "raw": "{{baseUrl}}/v2/organizations/:organization-id/threats/stories?limit=50&cursor=&sort=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "organizations", ":organization-id", "threats", "stories" ], "query": [ { "description": "Specifies the maximum number of items to be returned.", "key": "limit", "value": "50" }, { "description": "A cursor for pagination to retrieve the next set of results.", "key": "cursor", "value": "" }, { "description": "Sort results by one or more fields. Format: `field` or `field:asc` or `field:desc`. Multiple fields: `field1,field2:desc`. Allowed fields: `update_time`, `create_time`. Default: `update_time:asc`.", "key": "sort", "value": "" } ], "variable": [ { "key": "organization-id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T03:25:55.000Z", "updatedAt": "2026-07-28T03:25:55.000Z", "uid": "35240-91a4d280-6cae-46b1-8b40-b6b178daf0c6" } ], "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-e6dc92a8-0373-455c-aaaa-276ce34a143b" } ], "id": "b18f5114-d4e9-46c2-b16a-ba59bc336d09", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-b18f5114-d4e9-46c2-b16a-ba59bc336d09" } ], "id": "d81a3c4e-db50-4e7d-9ecd-c65b7915d9db", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-d81a3c4e-db50-4e7d-9ecd-c65b7915d9db" } ], "id": "3b953f8e-3d27-48cf-a596-01d5cd850a50", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-3b953f8e-3d27-48cf-a596-01d5cd850a50" } ], "id": "3e5a4d0b-0e11-4092-bf3b-4bf12b733b83", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-3e5a4d0b-0e11-4092-bf3b-4bf12b733b83" } ], "id": "54606a1d-909e-432c-a1ff-251c96cf583a", "createdAt": "2026-07-28T03:25:54.000Z", "updatedAt": "2026-07-28T03:25:54.000Z", "uid": "35240-54606a1d-909e-432c-a1ff-251c96cf583a" } ], "auth": { "type": "oauth2", "oauth2": [ { "key": "accessTokenUrl", "value": "https://auth.upwind.io/oauth/token", "type": "string" }, { "key": "grant_type", "value": "client_credentials", "type": "string" } ] }, "variable": [ { "key": "baseUrl", "value": "https://api.upwind.io" } ] }