How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Upwind Security

Upwind Security threats API

The Threats resource offers a range of methods for listing, retrieving, and deleting threat detections.

Documentation Provider Profile APIs.io OpenAPI GitHub

Upwind Security threats API is one of 12 APIs that Upwind Security publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Threats. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 25 operations across 18 paths, and defines 80 schemas. It is described by OpenAPI 3.1.0, at version 1.0.

Requests are made against 3 base URLs: https://api.upwind.io, https://api.eu.upwind.io, https://api.me.upwind.io.

25 operations 18 paths 80 schemas 3 DELETE10 GET5 PATCH7 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.1.0
API Version
1.0
Base URL
https://api.upwind.io
Resource Areas
1

Paths & Operations 25

Across 18 paths, the API surfaces 25 operations — 3 DELETE, 10 GET, 5 PATCH, 7 POST. Each is listed below with its method, path, parameters, and response codes.

threats 25

The Threats resource offers a range of methods for listing, retrieving, and deleting threat detections.

GET
/v1/organizations/{organization-id}/threat-detections
List detections
list-threat-detections 9 params → 200401403429
GET
/v1/organizations/{organization-id}/threat-detections/{detection-id}
Get a detection
get-threat-detection 2 params → 200401403404429
PATCH
/v1/organizations/{organization-id}/threat-detections/{detection-id}
Update a detection
update-threat-detection 2 params body → 200401403404429
GET
/v1/organizations/{organization-id}/threat-events
List events
getEventsList 11 params → 200401403429
GET
/v1/organizations/{organization-id}/threat-policies
List policies
list-threat-policies 2 params → 200401403429
PATCH
/v1/organizations/{organization-id}/threat-policies/{policy-id}
Update a policy
updateThreatPolicy 2 params body → 200401403404429
GET
/v2/organizations/{organization-id}/threats/policies/{policy-id}
Get a policy
getPolicy 2 params → 200401403404429
GET
/v2/organizations/{organization-id}/threats/policies/{policy-id}/rules/{policy-rule-id}
Get a policy rule
getPolicyRule 3 params → 200401403404429
GET
/v2/organizations/{organization-id}/threats/rule-definitions/{rule-definition-id}
Get a rule definition
getRuleDefinition 2 params → 200401403404429
GET
/v2/organizations/{organization-id}/threats/stories
List stories
listStories 4 params → 200401403404429
POST
/v2/organizations/{organization-id}/threats/policies/search
Search policies
searchPolicies 4 params body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/policies/{policy-id}/rules/search
Search policy rules
searchPolicyRules 5 params body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/rule-definitions/search
Search rule definitions
searchRuleDefinitions 4 params body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/stories/search
Search stories
searchStories 4 params body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/policies/bulk
Bulk create policies
bulkCreatePolicies 1 param body → 200401403404429
PATCH
/v2/organizations/{organization-id}/threats/policies/bulk
Bulk edit policies
bulkEditPolicies 1 param body → 200401403404429
DELETE
/v2/organizations/{organization-id}/threats/policies/bulk
Bulk delete policies
bulkDeletePolicies 1 param body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/policies/{policy-id}/rules/bulk
Bulk create policy rules
bulkAttachRuleDefinitions 2 params body → 200401403404429
PATCH
/v2/organizations/{organization-id}/threats/policies/{policy-id}/rules/bulk
Bulk edit policy rules
bulkEditPolicyRules 2 params body → 200401403404429
DELETE
/v2/organizations/{organization-id}/threats/policies/{policy-id}/rules/bulk
Bulk delete policy rules
bulkDeletePolicyRules 2 params body → 200401403404429
POST
/v2/organizations/{organization-id}/threats/rule-definitions/bulk
Bulk create rule definitions
bulkCreateRuleDefinitions 1 param body → 200401403404429
PATCH
/v2/organizations/{organization-id}/threats/rule-definitions/bulk
Bulk edit rule definitions
bulkEditRuleDefinitions 1 param body → 200401403404429
DELETE
/v2/organizations/{organization-id}/threats/rule-definitions/bulk
Bulk delete rule definitions
bulkDeleteRuleDefinitions 1 param body → 200401403404429
GET
/v2/organizations/{organization-id}/threats/stories/{story-id}
Get a story
getStory 2 params → 200401403404429
GET
/v2/organizations/{organization-id}/threats/rule-definitions/{rule-definition-id}/policies
Get the policies a rule definition is attached to
getAttachedPolicies 2 params → 200401403404429

Schemas 80

The contract defines 80 schemas that model the data the API accepts and returns. The most detailed are ApiPolicyRule (15 properties), DetectionResource (14 properties), ThreatDetection (13 properties), ApiPolicy (12 properties). Each schema is shown below with its type and property counts.

ApiCreateRuleDefinitionsRequest
object
A bulk threat rule definition create request object.
1 property 1 required
EventSummary
object
Base schema for threat events
6 properties 1 required
ThreatPolicy
object
8 properties
ApiCreatePolicyRulesRequest
object
A bulk policy rule create request object.
1 property 1 required
ApiLabelScopeCondition
A condition that matches resources by label.
3 required
ApiEditPolicyMetadata
object
Partial display detection metadata for editing a policy.
2 properties
ApiEditRuleDefinitionsRequest
object
A bulk threat rule definition edit request object.
1 property 1 required
DetectionAwsCloudtrailInitiatorDetails
object
8 properties
ApiScopeTag
object
A tag value used in tag-based scope conditions.
2 properties
ApiEditPoliciesRequest
object
A bulk threat policy edit request object.
1 property 1 required
DetectionAwsCloudtrailInitiatorSessionAttributes
object
2 properties
ThreatDetection
object
13 properties
ProcessExecutionSummary
ApiCreatePolicy
object
A threat policy create request object.
6 properties 4 required
ApiCreatePolicyMetadata
object
The display metadata of this policy.
2 properties 2 required
RestApiPaginatedResponseApiListStoryItem
object
Successful paginated API response containing items and pagination metadata
2 properties
Initiator
object
2 properties
ApiScopeCondition
object
A scope condition. The type field determines the structure.
1 property 1 required
ApiPolicyRule
object
A policy rule object.
15 properties
Tag
object
2 properties
ApiRuleDefinition
object
A threat rule definition object.
10 properties
ProcessExecutionData
object
9 properties
ApiPolicyDefaultValues
object
The default (pre-override) values of a threat policy.
3 properties
ApiRuleDefinitionMetadata
object
The display and MITRE ATT&CK metadata of a rule definition.
6 properties
RestApiPaginatedResponseApiRuleDefinition
object
Successful paginated API response containing items and pagination metadata
2 properties
ApiEditPolicyRulesRequest
object
A bulk policy rule edit request object.
1 property
DetectionAwsCloudtrailInitiatorSessionContextDetails
object
2 properties
RestApiResponseApiPolicy
object
Successful API response containing items
1 property
ApiCloudAccountScopeCondition
A condition that matches cloud accounts by ID.
3 required
ApiCreateRuleDefinition
object
A threat rule definition create request object.
5 properties 5 required
ApiTagScopeCondition
A condition that matches resources by tag.
3 required
ApiCreatePolicyRuleItem
object
A policy rule create request item.
4 properties 1 required
InitiatorData
object
5 properties
ApiAttachedPolicy
object
A policy that a rule definition is attached to, with effective values per policy rule.
11 properties
RestApiResponseApiAttachedPolicy
object
Successful API response containing items
1 property
ThreatPolicyUpdateRequest
object
1 property
FileSummaryData
object
5 properties
ApiCloudAccountOUScopeCondition
A condition that matches cloud accounts by organizational unit.
3 required
ApiScopeConditionFilter
A composite condition that combines multiple sub-conditions.
2 required
AuditLogData
object
1 property
ApiEditRuleDefinition
object
A threat rule definition edit request object. All fields except id are optional; at least one mutable field must be present.
4 properties 1 required
ApiDeletePolicyRulesRequest
object
A bulk policy rule delete request object.
1 property
ApiPolicyMetadata
object
The display metadata of a threat policy.
2 properties
InternetExposureDetails
object
1 property
ProcessTreeData
object
6 properties
RestApiResponseApiRuleDefinition
object
Successful API response containing items
1 property
EventSummaryList
object
3 properties
RestApiResponseApiGetStoryItem
object
Successful API response containing items
1 property
EventResource
object
7 properties
BadReputationIpsData
object
5 properties
ApiResourceNameScopeCondition
A condition that matches resources by name.
3 required
InternetExposure
object
1 property
ApiCreateRuleDefinitionMetadata
object
The display and MITRE ATT&CK metadata of a rule definition create request.
6 properties 2 required
ApiPolicyRuleDefaultValues
object
A default values object containing the Upwind-managed values overridden on this policy rule.
4 properties
FileSummary
DetectionResource
object
14 properties
RestApiResponseApiPolicyRule
object
Successful API response containing items
1 property
ApiCloudAccountOrganizationScopeCondition
A condition that matches cloud accounts by organization.
3 required
MitreAttackDetails
object
4 properties
ApiEditRuleDefinitionMetadata
object
Partial display and MITRE ATT&CK metadata for editing a rule definition.
6 properties
ApiEditPolicyRuleItem
object
A policy rule edit request item. All fields except id are optional; at least one mutable field must be present.
4 properties 1 required
ApiPaginationMetadata
object
Pagination metadata for navigating through result pages
3 properties
ApiResourceKindScopeCondition
A condition that matches resources by kind.
3 required
AuditLogSummary
ApiDeletePoliciesRequest
object
A bulk threat policy delete request object.
1 property
UpdateDetectionRequest
object
1 property
ApiDeleteRuleDefinitionsRequest
object
A bulk threat rule definition delete request object.
1 property
ApiResourceIdScopeCondition
A condition that matches resources by ID.
3 required
ApiPolicy
object
A threat policy object.
12 properties
ApiGetStoryItem
object
A threat story object with full details
8 properties
RestApiPaginatedResponseApiPolicy
object
Successful paginated API response containing items and pagination metadata
2 properties
BadReputationIpsDataList
object
1 property
ApiResourceScope
object
The resource scope defining which cloud resources this policy applies to.
1 property
ApiListStoryItem
object
A threat story object
7 properties
NetworkActivitySummary
RestApiPaginatedResponseApiPolicyRule
object
Successful paginated API response containing items and pagination metadata
2 properties
DetectionAwsCloudtrailInitiatorSessionIssuer
object
5 properties
ApiEditPolicy
object
A threat policy edit request object. All fields except id are optional; at least one mutable field must be present.
6 properties 1 required
AwsCloudtrailSummary
ApiCreatePoliciesRequest
object
A bulk threat policy create request object.
1 property 1 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

upwind-security-threats-api-openapi.yml Raw ↑

Other APIs Upwind Security publishes across the network.

Upwind Security access-management API
AE Profile APIs.io
Upwind Security api-security API
AE Profile APIs.io
Upwind Security cloud-accounts API
AE Profile APIs.io
Upwind Security configurations API
AE Profile APIs.io
Upwind Security events API
AE Profile APIs.io
Upwind Security integrations API
AE Profile APIs.io
Upwind Security inventory API
AE Profile APIs.io
Upwind Security packages API
AE Profile APIs.io
Upwind Security shiftleft API
AE Profile APIs.io
Upwind Security vulnerabilities API
AE Profile APIs.io
Upwind Security workflows API
AE Profile APIs.io
#Threats
← Back to U APIs
API Details
ID
upwind-security:upwind-security-threats-api
Base URL
https://api.upwind.io
Docs
https://docs.upwind.io/restapi/v2/introduction
Provider
Upwind Security
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=upwind-security-threats-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/upwind-security-threats-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Upwind Security threats API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.