{"openapi": "3.0.3", "info": {"title": "Imunify360", "description": "", "version": "8.14.0-1"}, "servers": [{"url": "/api"}], "components": {"securitySchemes": {"bearerAuth": {"type": "http", "scheme": "bearer", "bearerFormat": "JWT"}}}, "security": [{"bearerAuth": []}], "tags": [{"name": "analyst-cleanup", "description": null}, {"name": "auth-cloud", "description": null}, {"name": "billing", "description": null}, {"name": "config", "description": "Allows to update and show the configuration file via CLI"}, {"name": "conflicts", "description": null}, {"name": "control-panel", "description": null}, {"name": "domain-reputation-management", "description": "Domain reputation monitoring. Imunify regularly checks hosted domain names against reputation engines - it helps detect issues like phishing and other infections."}, {"name": "eula", "description": "Allows to show and accept the end-user license agreement to automate installation"}, {"name": "feature-management", "description": "Allows to manage Imunify360 features available for users."}, {"name": "features", "description": "Manage additional Imunify360 features"}, {"name": "firewall", "description": "Firewall options endpoint group"}, {"name": "imunify-patch-subscriptions", "description": null}, {"name": "l7-protection", "description": "Layer 7 protection managing endpoint group"}, {"name": "login", "description": "Allows to get a token which can be used for authentication in Imunify360 API."}, {"name": "malware", "description": "Antivirus operations endpoint group"}, {"name": "malware-generic-event", "description": null}, {"name": "malware-send-files", "description": null}, {"name": "package-versions", "description": null}, {"name": "proactive", "description": "Allows to manage Proactive Defense feature"}, {"name": "registration", "description": "License operations endpoint group"}, {"name": "support", "description": "Allows to contact support team of Imunify360"}, {"name": "uam", "description": null}, {"name": "version", "description": "Package version endpoint"}, {"name": "vulnerabilities", "description": null}, {"name": "wordpress", "description": null}, {"name": "wp-disabled-rules", "description": null}, {"name": "wp-waf", "description": null}], "paths": {"/malware/malicious/restore-from-backup": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Try to restore files from backup", "description": "Try to restore files from backup", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"ids": {"type": "array", "items": {"type": "integer"}, "description": "IDs from the malicious list"}, "items": {"type": "string"}, "user": {"type": "string"}}}}}}}}}}, "/malware/history/list": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the log of Malware Scanner events and performed actions", "description": "Show the log of Malware Scanner events and performed actions", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show events after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show events before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path."}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see the events relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"ctime-\",\"initiator+\"]` would order by event timestamp descending and event `initiator` ascending.\n"}]}}, "/malware/on-demand/list": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the list of on-demand scans", "description": "Show the list of on-demand scans", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show scans started after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show scans started before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"total_malicious-\",\"started-\"]` would order by `total_malicious` and `started` descending.\n"}]}}, "/malware/on-demand/stop": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Stop the last on-demand scan", "description": "Stop the last on-demand scan", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"all": {"type": "boolean", "description": "Stop all the scans", "default": false}}}}}}}}}}, "/malware/on-demand/status": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the status of the running on-demand scan", "description": "Show the status of the running on-demand scan"}}, "/malware/on-demand/start-user": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Scan a user's home directory", "description": "Scan a user's home directory", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"user": {"type": "string", "description": "Username to scan"}}}}}}}}}}, "/malware/on-demand/stop-user": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Stop a user's on-demand scan", "description": "Stop a user's on-demand scan", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"user": {"type": "string", "description": "Username"}}}}}}}}}}, "/malware/on-demand/status-user": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Check the status of the user's on-demand scan", "description": "Check the status of the user's on-demand scan", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Username"}]}}, "/malware/on-demand/list-user": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "List scans of a specific user.", "description": "List scans of a specific user.\nThis request can be performed by any user, not just admins.\n", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Username"}, {"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show scans started after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show scans started before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"started-\"]` would order by `started` descending.\n"}]}}, "/malware/read": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the contents of a malicious file", "description": "Show the contents of a malicious file", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"path": {"type": "string", "description": "Path to the file"}, "limit": {"type": "integer", "description": "Maximum number of bytes to read", "default": 102400}, "offset": {"type": "integer", "description": "Offset in bytes", "default": 0}, "user": null}}}}}}}}}, "/malware/on-demand/queue/put": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Queue on-demand scans for the selected paths", "description": "Queue on-demand scans for the selected paths", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"paths": {"type": "array", "items": {"type": "string"}, "description": "Paths to add to the queue"}, "prioritize": {"type": "boolean", "description": "Put the scans on top of the queue", "default": false}, "detect_elf": {"type": "boolean", "description": "Treat ELF binaries in home directories as malware.", "default": false}, "file_mask": {"type": "string", "description": "Several patterns can be added with \", \" delimiter.\nExample: `*.js, *.php`\n"}, "ignore_mask": {"type": "string", "description": "Several patterns can be added with \", \" delimiter.\nExample: `*.log, *.tmp`\n"}, "intensity": {"type": "string", "description": "Scan intensity, simplified.\nOverrides `intensity_cpu`, `intensity_io` and `intensity_ram`.\n"}, "intensity_cpu": {"type": "integer", "description": "CPU usage allowed for the scan - from minimal, to 1 cpu core.\nThe method depends on the system: lve, cgroups, nice.\nThe default value can be configured in `MALWARE_SCAN_INTENSITY.cpu` config option.\n"}, "intensity_io": {"type": "integer", "description": "Disk usage allowed for the scan.\nThe default value can be configured in `MALWARE_SCAN_INTENSITY.io` config option.\n"}, "intensity_ram": {"type": "integer", "description": "RAM usage allowed for the scan, in MB.\nThe default value can be configured in `MALWARE_SCAN_INTENSITY.ram` config option.\n"}, "follow_symlinks": {"type": "boolean", "description": "If true, the scanner may traverse outside of the initial directory.", "default": false}, "scan_file": {"type": "boolean", "description": "Scan files in set path.", "default": true}, "scan_db": {"type": "boolean", "description": "Scan databases of applications found in set path.", "default": null}}}}}}}}}}, "/malware/on-demand/queue/remove": {"delete": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Remove on-demand scans from the queue", "description": "Remove on-demand scans from the queue", "parameters": [{"in": "query", "name": "scan_ids", "schema": {"type": "array", "items": {"type": "string"}}, "required": false, "description": "IDs obtained via `malware on-demand list`"}]}}, "/malware/send/files": {"post": {"tags": ["malware-send-files"], "responses": {"200": {"description": ""}}, "summary": "Upload given files to MRS", "description": "Upload given files to MRS", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"reason": {"type": "string"}, "files": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/malware/rebuild/patterns": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Update ignore patterns for realtime scan", "description": "Update ignore patterns for realtime scan\nSee https://docs.imunify360.com/faq_and_known_issues/#_21-how-to-edit-watched-and-excluded-patterns-for-malware-scanner for details\n"}}, "/submit/false-positive": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Submit a legitimate file detected by scanner as malicious/infected to Imunify team for analysis.", "description": "Submit a legitimate file detected by scanner as malicious/infected to Imunify team for analysis.", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"filename": {"type": "string", "description": "Path to the file on the server."}, "scanner": null, "reason": {"type": "string", "description": "Any additional info/comment about the file."}}}}}}}}}}, "/submit/false-negative": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Submit a malicious file not yet detected by scanner to Imunify team for analysis.", "description": "Submit a malicious file not yet detected by scanner to Imunify team for analysis.", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"filename": {"type": "string", "description": "Path to the file on the server."}}}}}}}}}}, "/malware/user/list": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the list of users in the system and their infection status", "description": "Show the list of users in the system and their infection status", "parameters": [{"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by user name."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 100}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"scan_status+\",\"scan_date-\"]` would order by `scan_status` ascending and `scan_date` descending.\n"}, {"in": "query", "name": "user", "schema": {"type": "string"}}, {"in": "query", "name": "ids", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List exact usernames to return. Incompatible with `search` and ignores `order_by`.\n"}]}}, "/malware/user/scan": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Queue on-demand scans for each user on the server", "description": "Queue on-demand scans for each user on the server", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"background": null, "follow_symlinks": {"type": "boolean", "description": "If true, the scanner may traverse outside of the users' home directories.", "default": false}, "detect_elf": {"type": "boolean", "description": "Treat ELF binaries in home directories as malware.", "default": false}, "scan_file": {"type": "boolean", "description": "Whether or not to scan users' files.", "default": true}, "scan_db": {"type": "boolean", "description": "Whether or not to scan users' databases.", "default": null}}}}}}}}}}, "/malware/ignore/list": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show malware ignore list", "description": "Show malware ignore list", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show entries added after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show entries added before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path."}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see the paths relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"resource_type+\",\"added_date-\"]` would order by `resource_type` ascending and `added_date` descending.\n"}]}}, "/malware/ignore/add": {"put": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Add paths to malware ignore list", "description": "Add paths to malware ignore list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"resource_type": {"type": "string", "description": "Type of resource to ignore.\nPossible values: `file`, `db`.\n", "default": "file"}, "paths": {"type": "array", "items": {"type": "string"}, "description": "Paths to add to ignore list"}, "items": null, "user": null}}}}}}}}}, "/malware/ignore/delete": {"delete": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Remove paths from malware ignore list", "description": "Remove paths from malware ignore list", "parameters": [{"in": "query", "name": "ids", "schema": {"type": "array", "items": {"type": "integer"}}, "required": true, "description": "Entries to remove. The IDs can be obtained via `malware ignore list`."}, {"in": "query", "name": "skip_rescan", "schema": {"type": "boolean", "default": false}, "description": "Skip rescanning the files that were removed from the ignore list.\nBy default, every path that is removed from the ignore list is immediately rescanned.\n"}]}}, "/vulnerabilities/file/list": {"get": {"tags": ["vulnerabilities"], "responses": {"200": {"description": ""}}, "summary": "Show the list of vulnerabilities files", "description": "Show the list of vulnerabilities files", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show files found after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show files found before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path and owner username.\n"}, {"in": "query", "name": "by_scan_id", "schema": {"type": "string"}, "description": "Search by scan id.\nCan be obtained via `malware on-demand list` or `malware on-demand list-user`.\n"}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see their own files.\n"}, {"in": "query", "name": "by_status", "schema": {"type": "array", "items": {"type": "string"}}, "description": "Filter by status.\nPossible values: `vulnerable`, `patched`, `vulnerable_patch_reverted`.\n"}, {"in": "query", "name": "ids", "schema": {"type": "array", "items": {"type": "integer"}}, "description": "List specific files by ID.\nIDs be obtained via `vulnerabilities file list`.\nConflicts with other filters and `order_by`.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"status+\",\"scanid.started-\"]` would order by `status` ascending and `scanid.started` descending.\n"}]}}, "/vulnerabilities/file/patch": {"patch": {"tags": ["vulnerabilities"], "responses": {"200": {"description": ""}}, "summary": "Patch vulnerable files", "description": "Patch vulnerable files", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"paths": {"type": "array", "items": {"type": "string"}, "description": "Paths to apply a patch"}, "user": null}}}}}}}}}, "/vulnerabilities/file/revert": {"post": {"tags": ["vulnerabilities"], "responses": {"200": {"description": ""}}, "summary": "Restore the original copy that was created before a patch attempt", "description": "Restore the original copy that was created before a patch attempt", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"paths": {"type": "array", "items": {"type": "string"}, "description": "Paths to revert patches"}, "user": null}}}}}}}}}, "/vulnerabilities/user/list": {"get": {"tags": ["vulnerabilities"], "responses": {"200": {"description": ""}}, "summary": "Show the list of users with summary vulnerabilities info", "description": "Show the list of users with summary vulnerabilities info", "parameters": [{"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by user name."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 100}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "user", "schema": {"type": "string"}}]}}, "/imunify-patch/subscriptions/refresh": {"patch": {"tags": ["imunify-patch-subscriptions"], "responses": {"200": {"description": ""}}, "summary": "Refresh Imunify Patch subscriptions for all users", "description": "Refresh Imunify Patch subscriptions for all users"}}, "/malware/malicious/list": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the list of malicious files", "description": "Show the list of malicious files", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show files found after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show files found before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path and owner username.\n"}, {"in": "query", "name": "site_search", "schema": {"type": "string"}, "description": "Search by site path and owner username.\n"}, {"in": "query", "name": "by_scan_id", "schema": {"type": "string"}, "description": "Search by scan id.\nCan be obtained via `malware on-demand list` or `malware on-demand list-user`.\n"}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see their own files.\n"}, {"in": "query", "name": "by_status", "schema": {"type": "array", "items": {"type": "string"}}, "description": "Filter by status.\nPossible values: `found`, `cleanup_pending`, `cleanup_started`, `cleanup_done`, `cleanup_removed`, `cleanup_requires_myimunify_protection`, `cleanup_restore_pending`, `cleanup_restore_started`, `restore_from_backup_started`, `restored_from_backup`.\n"}, {"in": "query", "name": "ids", "schema": {"type": "array", "items": {"type": "integer"}}, "description": "List specific files by ID.\nIDs be obtained via `malware malicious list`.\nConflicts with other filters and `order_by`.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"status+\",\"scanid.started-\"]` would order by `status` ascending and `scanid.started` descending.\n"}]}}, "/malware/malicious/summary": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show malicious file counts grouped by status", "description": "Show malicious file counts grouped by status", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"since": {"type": "integer", "description": "Count files found after this unix timestamp.", "default": 0}, "to": {"type": "integer", "description": "Count files found before this unix timestamp."}, "user": {"type": "string", "description": "Admins can filter results by user.\nUsers can only see their own files.\n"}}}}}}}}}}, "/malware/malicious/remove-from-list": {"delete": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Remove entries from the list of malicious files without removing the files", "description": "Remove entries from the list of malicious files without removing the files", "parameters": [{"in": "query", "name": "ids", "schema": {"type": "array", "items": {"type": "integer"}}, "required": true, "description": "List of file IDs to remove.\nIDs be obtained via `malware malicious list`.\n"}]}}, "/malware/malicious/move-to-ignore": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Move files to ignore list", "description": "Move files to ignore list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"ids": {"type": "array", "items": {"type": "integer"}, "description": "List of file IDs to move.\nIDs be obtained via `malware malicious list`.\n"}, "items": null, "user": null}}}}}}}}}, "/malware/malicious/cleanup": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Cleanup malicious files", "description": "Cleanup malicious files", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"ids": {"type": "array", "items": {"type": "integer"}, "description": "List of file IDs to cleanup.\nIDs be obtained via `malware malicious list`.\n"}, "items": null, "user": null, "standard_only": null}}}}}}}}}, "/malware/malicious/restore-original": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Restore the original copy that was created before a cleanup attempt", "description": "Restore the original copy that was created before a cleanup attempt", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"ids": {"type": "array", "items": {"type": "integer"}, "description": "List of file IDs to restore.\nIDs be obtained via `malware malicious list`.\n"}, "items": null, "user": null}}}}}}}}}, "/malware/malicious/diff": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Get difference between infected and cleaned file", "description": "Get difference between infected and cleaned file", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"id": {"type": "integer", "description": "Specific file by ID.\nIDs be obtained via `malware malicious list`.\nConflicts with other filters and `order_by`.\n"}, "user": {"type": "string", "description": "Admins can filter results by user.\nUsers can only see their own files.\n"}}}}}}}}}}, "/malware/malicious/cleanup-all": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Cleanup all malicious files", "description": "Cleanup all malicious files", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"user": null, "standard_only": null}}}}}}}}}, "/malware/cleanup/status": {"get": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Show the status of running cleanup", "description": "Show the status of running cleanup"}}, "/malware/user/cleanup": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Cleanup all files of a specific user", "description": "Cleanup all files of a specific user", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"user": {"type": "array", "items": {"type": "string"}, "description": "Admins can cleanup files of any user.\nUsers can only cleanup their own files.\n"}, "standard_only": null}}}}}}}}}, "/malware/user/restore-original": {"post": {"tags": ["malware"], "responses": {"200": {"description": ""}}, "summary": "Restore the original (infected) copy of all cleaned files of a specific user", "description": "Restore the original (infected) copy of all cleaned files of a specific user", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"user": {"type": "array", "items": {"type": "string"}, "description": "Admins can restore files of any user.\nUsers can only restore their own files.\n"}}}}}}}}}}, "/login/pam": {"post": {"tags": ["login"], "responses": {"200": {"description": ""}}, "summary": "Uses PAM to check the provided credential and returns a token for USERNAME if PASSWORD is correct", "description": "Uses PAM to check the provided credential and returns a token for USERNAME if PASSWORD is correct", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"username": {"type": "string"}, "password": {"type": "string"}}}}}}}}}}, "/login/get": {"get": {"tags": ["login"], "responses": {"200": {"description": ""}}, "summary": "Returns a token for USERNAME (must be executed by admin)", "description": "Returns a token for USERNAME (must be executed by admin)", "parameters": [{"in": "query", "name": "username", "schema": {"type": "string"}, "required": true}]}}, "/infected-domains": {"get": {"tags": ["domain-reputation-management"], "responses": {"200": {"description": ""}}, "summary": "Returns infected domain list", "description": "Returns infected domain list", "parameters": [{"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "offset for pagination"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "limit for pagination"}]}}, "/check-domains": {"post": {"tags": ["domain-reputation-management"], "responses": {"200": {"description": ""}}, "summary": "Send domain list check", "description": "Send domain list check"}}, "/rstatus": {"get": {"tags": ["registration"], "responses": {"200": {"description": ""}}, "summary": "Get registration status", "description": "Get registration status", "parameters": [{"in": "query", "name": "paid", "schema": {"type": "boolean", "default": false}}]}}, "/register": {"post": {"tags": ["registration"], "responses": {"200": {"description": ""}}, "summary": "Register the agent", "description": "Register the agent", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"regkey": {"type": "string", "description": "Registration key or 'IPL' word (if you registered by IP)", "default": "IPL"}}}}}}}}}}, "/unregister": {"post": {"tags": ["registration"], "responses": {"200": {"description": ""}}, "summary": "Unregister the agent", "description": "Unregister the agent"}}, "/update-license": {"post": {"tags": ["registration"], "responses": {"200": {"description": ""}}, "summary": "Force update license", "description": "Force update license"}}, "/wordpress-plugin/rules/list-disabled": {"put": {"tags": ["wp-disabled-rules"], "responses": {"200": {"description": ""}}, "summary": "List disabled WordPress protection rules with metadata.", "description": "List disabled WordPress protection rules with metadata.", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"limit": {"type": "integer", "description": "Maximum number of rules to return.", "default": 50}, "offset": {"type": "integer", "description": "Number of rules to skip.", "default": 0}, "domains": {"type": "array", "items": {"type": "string"}, "description": "Filter by specific domains."}, "user": {"type": "string", "description": "Filter rules visible to this user (shows only rules for user's domains)."}}}}}}}}}}, "/wordpress-plugin/rules/disable": {"put": {"tags": ["wp-disabled-rules"], "responses": {"200": {"description": ""}}, "summary": "Disable a WordPress protection rule globally or for specific domains.", "description": "Disable a WordPress protection rule globally or for specific domains.", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"rule": {"type": "string", "description": "The rule ID to disable (e.g., CVE-2025-001)."}, "domains": {"type": "array", "items": {"type": "string"}, "description": "List of domains to disable the rule for. If omitted, disables globally."}, "user": null}}}}}}}}}, "/wordpress-plugin/rules/enable": {"put": {"tags": ["wp-disabled-rules"], "responses": {"200": {"description": ""}}, "summary": "Re-enable a WordPress protection rule globally or for specific domains.", "description": "Re-enable a WordPress protection rule globally or for specific domains.", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"rule": {"type": "string", "description": "The rule ID to enable (e.g., CVE-2025-001)."}, "domains": {"type": "array", "items": {"type": "string"}, "description": "List of domains to enable the rule for. If omitted, enables globally."}, "user": null}}}}}}}}}, "/analyst-cleanup/request": {"post": {"tags": ["analyst-cleanup"], "responses": {"200": {"description": ""}}, "summary": "Send request to malware remediation team of imunify360", "description": "Send request to malware remediation team of imunify360", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"email": {"type": "string"}, "username": {"type": "string"}, "message": {"type": "string"}}}}}}}}}}, "/analyst-cleanup/get-requests": {"get": {"tags": ["analyst-cleanup"], "responses": {"200": {"description": ""}}, "summary": "Get analyst-cleanup requests for provided username or all if username isn't provided", "description": "Get analyst-cleanup requests for provided username or all if username isn't provided", "parameters": [{"in": "query", "name": "username", "schema": {"type": "string"}, "required": false}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}]}}, "/analyst-cleanup/is-allowed": {"post": {"tags": ["analyst-cleanup"], "responses": {"200": {"description": ""}}, "summary": "Send request imunify360 API and shows is analyst-cleanup allowed", "description": "Send request imunify360 API and shows is analyst-cleanup allowed"}}, "/support/send": {"post": {"tags": ["support"], "responses": {"200": {"description": ""}}, "summary": "Contact support team of imunify360", "description": "Contact support team of imunify360", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"email": {"type": "string"}, "subject": {"type": "string"}, "description": {"type": "string"}, "cln": {"type": "string"}, "attachments": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/3rdparty/conflicts": {"post": {"tags": ["conflicts"], "responses": {"200": {"description": ""}}, "summary": "Shows conflicts with other software", "description": "Shows conflicts with other software"}}, "/version": {"post": {"tags": ["version"], "responses": {"200": {"description": ""}}, "summary": "Get Imunify Agent version", "description": "Get Imunify Agent version"}}, "/wakeup": {"post": {"tags": ["version"], "responses": {"200": {"description": ""}}, "summary": "Wake up Imunify Agent", "description": "Wake up Imunify Agent"}}, "/wordpress-plugin/waf/set": {"post": {"tags": ["wp-waf"], "responses": {"200": {"description": ""}}, "summary": "Bulk enable or disable WAF for hosting users.", "description": "Bulk enable or disable WAF for hosting users.\n\nExamples:\n imunify360-agent wordpress-plugin waf set --status enabled --all-users\n imunify360-agent wordpress-plugin waf set --status disabled --users alice bob carol\n", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"status": {"type": "string", "description": "Target WAF state for the selected users."}, "all_users": {"type": "boolean", "description": "Apply to every hosting user on the server.", "default": false}, "users": {"type": "array", "items": {"type": "string"}, "description": "Apply to a space-separated list of hosting users (e.g. --users alice bob carol)."}}}}}}}}}}, "/wordpress-plugin/waf/status": {"get": {"tags": ["wp-waf"], "responses": {"200": {"description": ""}}, "summary": "Report effective WAF status and its source for every hosting account.", "description": "Report effective WAF status and its source for every hosting account.\n\nExamples:\n imunify360-agent wordpress-plugin waf status\n imunify360-agent wordpress-plugin waf status --status disabled --json\n imunify360-agent wordpress-plugin waf status --user alice\n", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Show only this hosting account."}, {"in": "query", "name": "status", "schema": {"type": "string"}, "description": "Filter by effective WAF status."}, {"in": "query", "name": "source", "schema": {"type": "string"}, "description": "Filter by status source (default or per-account override)."}, {"in": "query", "name": "limit", "schema": {"type": "integer"}, "description": "Maximum number of accounts to return (capped at 500)."}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Number of accounts to skip."}]}}, "/config/patch": {"patch": {"tags": ["config"], "responses": {"200": {"description": ""}}, "summary": "Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).", "description": "Update Imunify configuration (`/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`).\n", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"data": {"type": "object", "description": "Config options to update.\nNote: it doesn't have to be a full config, only the options that need to be updated.\nExample: `{\"MALWARE_SCAN\": {\"enabled\": true}}`\n"}, "user": {"type": "string", "description": "Admins can specify a user to update the config for.\nIf not specified, and executed by admin, the config will be updated for root.\nIf not specified, and executed by user, the config will be updated for that user.\n"}}}}}}}}}}, "/config/patch-many": {"patch": {"tags": ["config"], "responses": {"200": {"description": ""}}, "summary": "Update Imunify configuration for multiple users.", "description": "Update Imunify configuration for multiple users.\n", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"data": {"type": "object", "description": "Config options to update.\nNote: it doesn't have to be a full config, only the options that need to be updated.\nExample: `{\"MALWARE_SCAN\": {\"enabled\": true}}`\n"}, "users": {"type": "array", "items": {"type": "string"}, "description": "List of users to update the config for.\nExample: `[\"user1\", \"user2\", \"root\"]`\n"}}}}}}}}}}, "/config/get-many": {"get": {"tags": ["config"], "responses": {"200": {"description": ""}}, "summary": "Get Imunify configuration for multiple users.", "description": "Get Imunify configuration for multiple users.\n", "parameters": [{"in": "query", "name": "users", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of users to get the config for.\nExample: `\"user1\", \"user2\", \"root\"`\n"}]}}, "/config/show": {"get": {"tags": ["config"], "responses": {"200": {"description": ""}}, "summary": "Get Imunify configuration.", "description": "Get Imunify configuration.\nThis is the result of merging all config files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory.\n", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can specify whose config to get.\nIf not specified, and executed by admin, returns the root config.\nIf not specified, and executed by user, returns the config of that user.\n"}]}}, "/config/show/defaults": {"get": {"tags": ["config"], "responses": {"200": {"description": ""}}, "summary": "Get details on how the config is merged:", "description": "Get details on how the config is merged:\n - `mutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory before `90-local.config`. They can be overridden via API.\n - `local_config` - `/etc/sysconfig/imunify360/imunify360.config.d/90-local.config`, controlled by API.\n - `immutable_config` - all files in `/etc/sysconfig/imunify360/imunify360.config.d/` directory after `90-local.config`. They cannot be overridden via API.\n"}}, "/wordpress-plugin/install-on-new-sites": {"post": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "Install Imunify Security plugin for WordPress on new WordPress sites.", "description": "Install Imunify Security plugin for WordPress on new WordPress sites."}}, "/wordpress-plugin/tidy-up": {"post": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "Tidy-up on WordPress sites where the Imunify Security plugin for WordPress was manually removed.", "description": "Tidy-up on WordPress sites where the Imunify Security plugin for WordPress was manually removed."}}, "/wordpress-plugin/update": {"post": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "Updates Imunify Security plugin for WordPress to the latest version on all WordPress sites where it's already installed.", "description": "Updates Imunify Security plugin for WordPress to the latest version on all WordPress sites where it's already installed."}}, "/wordpress-plugin/install-and-update": {"post": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "Install Imunify Security plugin for WordPress on new sites, tidy-up manually deleted plugins, and update existing installations. This combines install-on-new-sites, tidy-up, and update in a single atomic operation.", "description": "Install Imunify Security plugin for WordPress on new sites, tidy-up manually deleted plugins, and update existing installations. This combines install-on-new-sites, tidy-up, and update in a single atomic operation."}}, "/wordpress-plugin/list-incidents": {"get": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "List WordPress incidents", "description": "List WordPress incidents", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}}, {"in": "query", "name": "site_search", "schema": {"type": "string"}, "description": "Filter by site path\n"}, {"in": "query", "name": "by_abuser_ip", "schema": {"type": "string"}, "description": "Filter by abuser IP address\n"}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}, "description": "Filter by country code\n"}, {"in": "query", "name": "by_domain", "schema": {"type": "string"}, "description": "Filter by domain\n"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by IP address, name, description\n"}, {"in": "query", "name": "since", "schema": {"type": "integer"}, "description": "Show incidents after this unix timestamp (inclusive)\n"}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show incidents before this unix timestamp (inclusive)\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nSupported fields: timestamp, severity, domain, abuser.\nE.g. `[\"timestamp-\",\"severity-\"]` would order by timestamp descending and severity descending.\n"}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}]}}, "/wordpress-plugin/list-sites": {"get": {"tags": ["wordpress"], "responses": {"200": {"description": ""}}, "summary": "List WordPress sites with Imunify Security plugin installed.", "description": "List WordPress sites with Imunify Security plugin installed.", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see the sites relevant to them.\n"}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Maximum number of items to return."}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Number of items to skip."}]}}, "/eula/accept": {"post": {"tags": ["eula"], "responses": {"200": {"description": ""}}, "summary": "Accept EULA", "description": "Accept EULA"}}, "/eula/show": {"get": {"tags": ["eula"], "responses": {"200": {"description": ""}}, "summary": "Get EULA", "description": "Get EULA"}}, "/auth-cloud": {"post": {"tags": ["auth-cloud"], "responses": {"200": {"description": ""}}, "summary": "Get independent agent ID token", "description": "Get independent agent ID token"}}, "/auth-cloud-refresh-token": {"post": {"tags": ["auth-cloud"], "responses": {"200": {"description": ""}}, "summary": "Refresh the independent agent ID token", "description": "Refresh the independent agent ID token"}}, "/feature-management/list": {"get": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "List all available features", "description": "List all available features"}}, "/feature-management/defaults": {"post": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "Get the default state of all features for new users", "description": "Get the default state of all features for new users"}}, "/feature-management/show": {"get": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "List the state of all features for all users", "description": "List the state of all features for all users", "parameters": [{"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search specific users by name."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 100}, "description": "Limits the output with specified number of incidents."}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Offset for pagination."}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to sort the results by."}]}}, "/feature-management/get": {"get": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "Get the state of all features for a specific user", "description": "Get the state of all features for a specific user", "parameters": [{"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Specifies a user name to obtain the status of features for"}]}}, "/feature-management/enable": {"put": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "Enable a feature for specified users or all new ones (set defaults)", "description": "Enable a feature for specified users or all new ones (set defaults)", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"feature": {"type": "string", "description": "Allowed values: `av` for Malware Cleanup, `proactive` for Proactive Defense"}, "users": {"type": "array", "items": {"type": "string"}, "description": "List of users to enable the feature for. If not specified, the feature will be enabled by default for all new users."}}}}}}}}}}, "/feature-management/disable": {"put": {"tags": ["feature-management"], "responses": {"200": {"description": ""}}, "summary": "Disable a feature for specified users or all new ones (set defaults)", "description": "Disable a feature for specified users or all new ones (set defaults)", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"feature": {"type": "string", "description": "Allowed values: `av` for Malware Cleanup, `proactive` for Proactive Defense"}, "users": {"type": "array", "items": {"type": "string"}, "description": "List of users to disable the feature for. If not specified, the feature will be disabled by default for all new users."}}}}}}}}}}, "/rules/disable": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Add a new rule to the disabled rules list", "description": "Add a new rule to the disabled rules list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"id": {"type": "string", "description": "ID number of the rule provided by the firewall plugin."}, "plugin": {"type": "string", "description": "Firewall plugin name. Can be one of the following [modsec | ossec | lfd]"}, "domains": {"type": "array", "items": {"type": "string"}, "description": "List of domains to disable a rule for. Can only be used with modsec type."}, "name": {"type": "string", "description": "Name of the added rule or details of the rule from ModSecurity or OSSEC."}}}}}}}}}}, "/rules/enable": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Remove a rule from the disabled rules list", "description": "Remove a rule from the disabled rules list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"id": {"type": "string", "description": "ID number of the rule provided by the firewall plugin."}, "plugin": {"type": "string", "description": "Firewall plugin name. Can be one of the following [modsec | ossec | lfd]"}}}}}}}}}}, "/rules/list-disabled": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Display the list of the disabled rules", "description": "Display the list of the disabled rules", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"limit": {"type": "integer", "default": 100}, "offset": {"type": "integer", "default": 0}, "order_by": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/rules/update-app-specific-rules": {"post": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Allows to update WAF ruleset configurator immediately (generally, executed by cron)", "description": "Allows to update WAF ruleset configurator immediately (generally, executed by cron)"}}, "/rules/update-shared-disabled-rules": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Force reload modsec disabled rules config", "description": "Force reload modsec disabled rules config"}}, "/proactive/list": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "List Proactive Defense events", "description": "List Proactive Defense events", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show events after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show events before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path, rule name, IP address, or hostname."}, {"in": "query", "name": "site_search", "schema": {"type": "string"}, "description": "Search by site path and owner username.\n"}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see the events relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\n"}]}}, "/proactive/details": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Show Proactive Defense event details", "description": "Show Proactive Defense event details", "parameters": [{"in": "query", "name": "id", "schema": {"type": "integer"}, "required": true, "description": "Proactive Defense event ID, can be obtained from `proactive list` endpoint."}]}}, "/proactive/ignore/list": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "List ignored paths", "description": "List ignored paths", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show entries added after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show entries added before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path."}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see entries relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\n"}]}}, "/proactive/ignore/add": {"put": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Ignore events by path, and, optionally, by rule ID", "description": "Ignore events by path, and, optionally, by rule ID", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"path": {"type": "string", "description": "Path to ignore"}, "rule_id": {"type": "integer", "description": "Only ignore events from this rule ID"}, "rule_name": null, "user": null}}}}}}}}}, "/proactive/ignore/addmany": {"put": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Ignore events by path, and, optionally, by rule ID", "description": "Ignore events by path, and, optionally, by rule ID", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "object"}}, "user": null}}}}}}}}}, "/proactive/ignore/delete/path": {"delete": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Remove paths from ignore list", "description": "Remove paths from ignore list", "parameters": [{"in": "query", "name": "paths", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "Paths to remove from ignore list"}]}}, "/proactive/ignore/delete/rule": {"delete": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Remove a specific path + rule ID combination from ignore list", "description": "Remove a specific path + rule ID combination from ignore list", "parameters": [{"in": "query", "name": "path", "schema": {"type": "string"}, "required": true, "description": "Path to remove from ignore list"}, {"in": "query", "name": "id", "schema": {"type": "integer"}, "required": true, "description": "Rule ID to remove from ignore list"}]}}, "/malware/generic/event": {"post": {"tags": ["malware-generic-event"], "responses": {"200": {"description": ""}}, "summary": "Events from generic socket", "description": "Events from generic socket"}}, "/uam/add": {"put": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Activate Under Attack Mode on a domain you own", "description": "Activate Under Attack Mode on a domain you own"}}, "/uam/delete": {"delete": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Delete one of your Under Attack Mode rules", "description": "Delete one of your Under Attack Mode rules"}}, "/uam/edit": {"patch": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Edit one of your Under Attack Mode rules", "description": "Edit one of your Under Attack Mode rules"}}, "/uam/list": {"get": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "List Under Attack Mode rules", "description": "List Under Attack Mode rules"}}, "/uam/counters": {"post": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Under Attack Mode rule details and challenge counters", "description": "Under Attack Mode rule details and challenge counters"}}, "/uam/test": {"post": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Test whether a URL matches an active Under Attack Mode rule", "description": "Test whether a URL matches an active Under Attack Mode rule"}}, "/uam/domains": {"post": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "List domains Under Attack Mode rules can be created for", "description": "List domains Under Attack Mode rules can be created for"}}, "/uam/service/settings/get": {"get": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Show the Under Attack Mode service enabled flag", "description": "Show the Under Attack Mode service enabled flag"}}, "/uam/service/settings/set": {"post": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Enable or disable the Under Attack Mode service", "description": "Enable or disable the Under Attack Mode service", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"enabled": {"type": "boolean", "description": "Whether the Under Attack Mode service is enabled"}}}}}}}}}}, "/uam/service/visibility/get": {"get": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Show whether Under Attack Mode is visible to unprivileged users", "description": "Show whether Under Attack Mode is visible to unprivileged users"}}, "/uam/service/visibility/set": {"post": {"tags": ["uam"], "responses": {"200": {"description": ""}}, "summary": "Set whether Under Attack Mode is visible to unprivileged users", "description": "Set whether Under Attack Mode is visible to unprivileged users", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"allowed_for_users": {"type": "boolean", "description": "Whether Under Attack Mode is exposed to unprivileged users in the Web UI"}}}}}}}}}}, "/features/list": {"get": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Get list of available additional features", "description": "Get list of available additional features"}}, "/features/status": {"get": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Get status of opted feature", "description": "Get status of opted feature", "parameters": [{"in": "query", "name": "name", "schema": {"type": "string"}}]}}, "/features/remove": {"delete": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Remove opted feature", "description": "Remove opted feature", "parameters": [{"in": "query", "name": "name", "schema": {"type": "string"}}, {"in": "query", "name": "force", "schema": {"type": "boolean", "default": false}, "description": "Remove alt-php packages even when there is no record of Imunify360 having installed them"}]}}, "/features/install": {"post": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Install opted feature", "description": "Install opted feature", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"name": {"type": "string"}}}}}}}}}}, "/3rdparty/list": {"get": {"tags": ["conflicts"], "responses": {"200": {"description": ""}}, "summary": "List other IDS those might be running concurrently with imunify360", "description": "List other IDS those might be running concurrently with imunify360"}}, "/reload-lists": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Reload custom black and white lists", "description": "Reload custom black and white lists"}}, "/remote-proxy/list": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List of manually added trusted proxies", "description": "List of manually added trusted proxies", "parameters": [{"in": "query", "name": "by_group", "schema": {"type": "string"}}, {"in": "query", "name": "by_source", "schema": {"type": "string"}}]}}, "/remote-proxy/add": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Add proxy subnet in CIDR notation", "description": "Add proxy subnet in CIDR notation", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"name": {"type": "string"}, "networks": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/remote-proxy/delete": {"delete": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Delete proxy subnet in CIDR notation", "description": "Delete proxy subnet in CIDR notation", "parameters": [{"in": "query", "name": "networks", "schema": {"type": "array", "items": {"type": "string"}}, "required": true}]}}, "/whitelist/domain/add": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Whitelist domain", "description": "Whitelist domain", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"domain": {"type": "string"}}}}}}}}}}, "/whitelist/domain/delete": {"delete": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Remove from whitelisted", "description": "Remove from whitelisted", "parameters": [{"in": "query", "name": "domain", "schema": {"type": "string"}}]}}, "/whitelist/domain/list": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List whitelisted domains", "description": "List whitelisted domains"}}, "/whitelist/domain/reset-to": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Replace whitelisted domains with a new list", "description": "Replace whitelisted domains with a new list", "parameters": [{"in": "query", "name": "domains", "schema": {"type": "array", "items": {"type": "string"}}}]}}, "/get": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List incidents", "description": "List incidents\n", "parameters": [{"in": "query", "name": "by_abuser_ip", "schema": {"type": "string"}, "description": "Filter by abuser IP address\n"}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}, "description": "Filter by country code\n"}, {"in": "query", "name": "by_panel_user", "schema": {"type": "string"}, "description": "Filter by panel user domains\n"}, {"in": "query", "name": "by_plugin", "schema": {"type": "string"}, "description": "Filter by plugin name (e.g., modsec, ossec, etc.)\n"}, {"in": "query", "name": "severity", "schema": {"type": "integer"}, "description": "Filter by minimum severity (1-15).\nSee https://www.ossec.net/docs/manual/rules-decoders/rule-levels.html for details on severity levels.\n"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by IP address, name, description.\n"}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "since", "schema": {"type": "integer"}, "description": "Show incidents after this unix timestamp.\n"}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show incidents before this unix timestamp.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"severity+\",\"timestamp-\"]` would order by event severity ascending and timestamp descending.\n"}]}}, "/smtp-blocking/sync": {"post": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Synchronise SMTP blocking rules with Imunify360 configuration.", "description": "Synchronise SMTP blocking rules with Imunify360 configuration."}}, "/smtp-blocking/reset": {"post": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove Imunify360 SMTP blocking rules from iptables.", "description": "Remove Imunify360 SMTP blocking rules from iptables."}}, "/create-rbl-whitelist": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Create whitelist for RBL", "description": "Create whitelist for RBL"}}, "/blocked-port-ip/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add IPs to a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Add IPs to a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}}, "ips": {"type": "array", "items": {"type": "string"}}, "comment": {"type": "string"}}}}}}}}}}, "/blocked-port-ip/edit": {"patch": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Edit comment on an item in the blocked ports Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Edit comment on an item in the blocked ports Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}}, "ips": {"type": "array", "items": {"type": "string"}}, "comment": {"type": "string"}}}}}}}}}}, "/blocked-port-ip/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove IPs from a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Remove IPs from a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}}, {"in": "query", "name": "ips", "schema": {"type": "array", "items": {"type": "string"}}}]}}, "/blocked-port/list": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "List blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "List blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}, {"in": "query", "name": "by_ip", "schema": {"type": "string"}}, {"in": "query", "name": "by_comment", "schema": {"type": "string"}}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}}]}}, "/blocked-port/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add item(-s) to blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Add item(-s) to blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "The format should be a port-protocol item. Example 8080:tcp"}, "comment": {"type": "string"}, "ips": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/blocked-port/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove item(-s) from blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Remove item(-s) from blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "The format should be a port-protocol item. Example 8080:tcp"}]}}, "/blocked-port/edit": {"patch": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Edit comment on item in the blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Edit comment on item in the blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "The format should be a port-protocol item. Example 8080:tcp"}, "comment": {"type": "string"}}}}}}}}}}, "/ip-list/local/list": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "List item(-s) in local ip-list", "description": "List item(-s) in local ip-list", "parameters": [{"in": "query", "name": "by_ip", "schema": {"type": "string"}, "description": "Filters output by abuser's IP or by subnet in CIDR notation. Example --by-ip 1.2.3.0/24."}, {"in": "query", "name": "purpose", "schema": {"type": "array", "items": {"type": "string"}}, "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}, "description": "Filters output by country code. Requires valid country code as argument. Find valid country codes here www.nationsonline.org/oneworld/country_code_list.htm in column ISO ALPHA-2 CODE."}, {"in": "query", "name": "by_comment", "schema": {"type": "string"}, "description": "Filters output by comment."}, {"in": "query", "name": "manual", "schema": {"type": "boolean"}, "description": "Show only items that have been added manually."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "limits the output with specified number of incidents. Must be a number greater than zero."}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Offset for pagination."}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to sort the results by. Each field must be followed by \"+\" for descending order or \"-\" for ascending order (e.g., --order-by ip+ or --order-by purpose-)"}, {"in": "query", "name": "by_type", "schema": {"type": "string"}, "description": "Filters output by item tipe [country | ip]"}]}}, "/ip-list/local/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add item(-s) from local ip-list", "description": "Add item(-s) from local ip-list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "IP which would be provided to opted list"}, "purpose": {"type": "string", "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}, "expiration": {"type": "integer", "description": "allows specifying expiration time for the listed IP (in seconds since epoch)", "default": 0}, "comment": {"type": "string", "description": "allows to add comment to the item"}, "scope": {"type": "string", "description": "Allows to set the scope to Global/Local. Accepts two values local (a default value, means \"add IP on this server only\") and group (means \"add IP for the whole group in which this server is\")."}, "full_access": {"type": "boolean", "description": "Allow access to all blocked ports as well"}}}}}}}}}}, "/ip-list/local/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove item(-s) from local ip-list", "description": "Remove item(-s) from local ip-list", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "IP which would be removed from opted list"}, {"in": "query", "name": "purpose", "schema": {"type": "string"}, "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}]}}, "/ip-list/synced": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "parameters": [{"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}, {"in": "query", "name": "by_ip", "schema": {"type": "string"}}, {"in": "query", "name": "purpose", "schema": {"type": "string"}}]}}}}