{"openapi": "3.0.3", "info": {"title": "Imunify360", "description": "", "version": "8.6.1-2"}, "servers": [{"url": "/api"}], "components": {"securitySchemes": {"bearerAuth": {"type": "http", "scheme": "bearer", "bearerFormat": "JWT"}}}, "security": [{"bearerAuth": []}], "tags": [{"name": "conflicts", "description": null}, {"name": "control-panel", "description": null}, {"name": "features", "description": "Manage additional Imunify360 features"}, {"name": "firewall", "description": "Firewall options endpoint group"}, {"name": "l7-protection", "description": "Layer 7 protection managing endpoint group"}, {"name": "malware-generic-event", "description": null}, {"name": "proactive", "description": "Allows to manage Proactive Defense feature"}], "paths": {"/rules/disable": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Add a new rule to the disabled rules list", "description": "Add a new rule to the disabled rules list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"id": {"type": "string", "description": "ID number of the rule provided by the firewall plugin."}, "plugin": {"type": "string", "description": "Firewall plugin name. Can be one of the following [modsec | ossec | lfd]"}, "domains": {"type": "array", "items": {"type": "string"}, "description": "List of domains to disable a rule for. Can only be used with modsec type."}, "name": {"type": "string", "description": "Name of the added rule or details of the rule from ModSecurity or OSSEC."}}}}}}}}}}, "/rules/enable": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Remove a rule from the disabled rules list", "description": "Remove a rule from the disabled rules list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"id": {"type": "string", "description": "ID number of the rule provided by the firewall plugin."}, "plugin": {"type": "string", "description": "Firewall plugin name. Can be one of the following [modsec | ossec | lfd]"}}}}}}}}}}, "/rules/list-disabled": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Display the list of the disabled rules", "description": "Display the list of the disabled rules", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"limit": {"type": "integer", "default": 100}, "offset": {"type": "integer", "default": 0}, "order_by": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/rules/update-app-specific-rules": {"post": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Allows to update WAF ruleset configurator immediately (generally, executed by cron)", "description": "Allows to update WAF ruleset configurator immediately (generally, executed by cron)"}}, "/rules/update-shared-disabled-rules": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Force reload modsec disabled rules config", "description": "Force reload modsec disabled rules config"}}, "/smtp-blocking/sync": {"post": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Synchronise SMTP blocking rules with Imunify360 configuration.", "description": "Synchronise SMTP blocking rules with Imunify360 configuration."}}, "/smtp-blocking/reset": {"post": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove Imunify360 SMTP blocking rules from iptables.", "description": "Remove Imunify360 SMTP blocking rules from iptables."}}, "/malware/generic/event": {"post": {"tags": ["malware-generic-event"], "responses": {"200": {"description": ""}}, "summary": "Events from generic socket", "description": "Events from generic socket"}}, "/features/list": {"get": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Get list of available additional features", "description": "Get list of available additional features"}}, "/features/status": {"get": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Get status of opted feature", "description": "Get status of opted feature", "parameters": [{"in": "query", "name": "name", "schema": {"type": "string"}}]}}, "/features/remove": {"delete": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Remove opted feature", "description": "Remove opted feature", "parameters": [{"in": "query", "name": "name", "schema": {"type": "string"}}]}}, "/features/install": {"post": {"tags": ["features"], "responses": {"200": {"description": ""}}, "summary": "Install opted feature", "description": "Install opted feature", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"name": {"type": "string"}}}}}}}}}}, "/proactive/list": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "List Proactive Defense events", "description": "List Proactive Defense events", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show events after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show events before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path, rule name, IP address, or hostname."}, {"in": "query", "name": "site_search", "schema": {"type": "string"}, "description": "Search by site path and owner username.\n"}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see the events relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\n"}]}}, "/proactive/details": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Show Proactive Defense event details", "description": "Show Proactive Defense event details", "parameters": [{"in": "query", "name": "id", "schema": {"type": "integer"}, "required": true, "description": "Proactive Defense event ID, can be obtained from `proactive list` endpoint."}]}}, "/proactive/ignore/list": {"get": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "List ignored paths", "description": "List ignored paths", "parameters": [{"in": "query", "name": "since", "schema": {"type": "integer", "default": 0}, "description": "Show entries added after this unix timestamp."}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show entries added before this unix timestamp."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by file path."}, {"in": "query", "name": "user", "schema": {"type": "string"}, "description": "Admins can filter results by user.\nUsers can only see entries relevant to them.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\n"}]}}, "/proactive/ignore/add": {"put": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Ignore events by path, and, optionally, by rule ID", "description": "Ignore events by path, and, optionally, by rule ID", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"path": {"type": "string", "description": "Path to ignore"}, "rule_id": {"type": "integer", "description": "Only ignore events from this rule ID"}, "rule_name": null, "user": null}}}}}}}}}, "/proactive/ignore/addmany": {"put": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Ignore events by path, and, optionally, by rule ID", "description": "Ignore events by path, and, optionally, by rule ID", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "object"}}, "user": null}}}}}}}}}, "/proactive/ignore/delete/path": {"delete": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Remove paths from ignore list", "description": "Remove paths from ignore list", "parameters": [{"in": "query", "name": "paths", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "Paths to remove from ignore list"}]}}, "/proactive/ignore/delete/rule": {"delete": {"tags": ["proactive"], "responses": {"200": {"description": ""}}, "summary": "Remove a specific path + rule ID combination from ignore list", "description": "Remove a specific path + rule ID combination from ignore list", "parameters": [{"in": "query", "name": "path", "schema": {"type": "string"}, "required": true, "description": "Path to remove from ignore list"}, {"in": "query", "name": "id", "schema": {"type": "integer"}, "required": true, "description": "Rule ID to remove from ignore list"}]}}, "/reload-lists": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Reload custom black and white lists", "description": "Reload custom black and white lists"}}, "/whitelist/domain/add": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Whitelist domain", "description": "Whitelist domain", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"domain": {"type": "string"}}}}}}}}}}, "/whitelist/domain/delete": {"delete": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Remove from whitelisted", "description": "Remove from whitelisted", "parameters": [{"in": "query", "name": "domain", "schema": {"type": "string"}}]}}, "/whitelist/domain/list": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List whitelisted domains", "description": "List whitelisted domains"}}, "/whitelist/domain/reset-to": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Replace whitelisted domains with a new list", "description": "Replace whitelisted domains with a new list", "parameters": [{"in": "query", "name": "domains", "schema": {"type": "array", "items": {"type": "string"}}}]}}, "/create-rbl-whitelist": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Create whitelist for RBL", "description": "Create whitelist for RBL"}}, "/get": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List incidents", "description": "List incidents\n", "parameters": [{"in": "query", "name": "by_abuser_ip", "schema": {"type": "string"}, "description": "Filter by abuser IP address\n"}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}, "description": "Filter by country code\n"}, {"in": "query", "name": "by_panel_user", "schema": {"type": "string"}, "description": "Filter by panel user domains\n"}, {"in": "query", "name": "severity", "schema": {"type": "integer"}, "description": "Filter by minimum severity (1-15).\nSee https://www.ossec.net/docs/manual/rules-decoders/rule-levels.html for details on severity levels.\n"}, {"in": "query", "name": "search", "schema": {"type": "string"}, "description": "Search by IP address, name, description.\n"}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "Page size"}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Page offset"}, {"in": "query", "name": "since", "schema": {"type": "integer"}, "description": "Show incidents after this unix timestamp.\n"}, {"in": "query", "name": "to", "schema": {"type": "integer"}, "description": "Show incidents before this unix timestamp.\n"}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to order by, each followed by a `+` (ascending) or `-` (descending).\nE.g. `[\"severity+\",\"timestamp-\"]` would order by event severity ascending and timestamp descending.\n"}]}}, "/remote-proxy/list": {"get": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "List of manually added trusted proxies", "description": "List of manually added trusted proxies", "parameters": [{"in": "query", "name": "by_group", "schema": {"type": "string"}}, {"in": "query", "name": "by_source", "schema": {"type": "string"}}]}}, "/remote-proxy/add": {"put": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Add proxy subnet in CIDR notation", "description": "Add proxy subnet in CIDR notation", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"name": {"type": "string"}, "networks": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/remote-proxy/delete": {"delete": {"tags": ["l7-protection"], "responses": {"200": {"description": ""}}, "summary": "Delete proxy subnet in CIDR notation", "description": "Delete proxy subnet in CIDR notation", "parameters": [{"in": "query", "name": "networks", "schema": {"type": "array", "items": {"type": "string"}}, "required": true}]}}, "/3rdparty/conflicts": {"post": {"tags": ["conflicts"], "responses": {"200": {"description": ""}}, "summary": "Shows conflicts with other software", "description": "Shows conflicts with other software"}}, "/3rdparty/list": {"get": {"tags": ["conflicts"], "responses": {"200": {"description": ""}}, "summary": "List other IDS those might be running concurrently with imunify360", "description": "List other IDS those might be running concurrently with imunify360"}}, "/blocked-port/list": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "List blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "List blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}, {"in": "query", "name": "by_ip", "schema": {"type": "string"}}, {"in": "query", "name": "by_comment", "schema": {"type": "string"}}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}}]}}, "/blocked-port/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add item(-s) to blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Add item(-s) to blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "The format should be a port-protocol item. Example 8080:tcp"}, "comment": {"type": "string"}, "ips": {"type": "array", "items": {"type": "string"}}}}}}}}}}}, "/blocked-port/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove item(-s) from blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Remove item(-s) from blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "The format should be a port-protocol item. Example 8080:tcp"}]}}, "/blocked-port/edit": {"patch": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Edit comment on item in the blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Edit comment on item in the blocked ports. Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "The format should be a port-protocol item. Example 8080:tcp"}, "comment": {"type": "string"}}}}}}}}}}, "/blocked-port-ip/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add IPs to a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Add IPs to a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}}, "ips": {"type": "array", "items": {"type": "string"}}, "comment": {"type": "string"}}}}}}}}}}, "/blocked-port-ip/edit": {"patch": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Edit comment on an item in the blocked ports Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Edit comment on an item in the blocked ports Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}}, "ips": {"type": "array", "items": {"type": "string"}}, "comment": {"type": "string"}}}}}}}}}}, "/blocked-port-ip/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove IPs from a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "description": "Remove IPs from a blocked port Only applicable if the FIREWALL.port_blocking_mode config option is set to ALLOW (allow access to all ports by default).", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}}, {"in": "query", "name": "ips", "schema": {"type": "array", "items": {"type": "string"}}}]}}, "/ip-list/local/list": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "List item(-s) in local ip-list", "description": "List item(-s) in local ip-list", "parameters": [{"in": "query", "name": "by_ip", "schema": {"type": "string"}, "description": "Filters output by abuser's IP or by subnet in CIDR notation. Example --by-ip 1.2.3.0/24."}, {"in": "query", "name": "purpose", "schema": {"type": "array", "items": {"type": "string"}}, "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}, {"in": "query", "name": "by_country_code", "schema": {"type": "string"}, "description": "Filters output by country code. Requires valid country code as argument. Find valid country codes here www.nationsonline.org/oneworld/country_code_list.htm in column ISO ALPHA-2 CODE."}, {"in": "query", "name": "by_comment", "schema": {"type": "string"}, "description": "Filters output by comment."}, {"in": "query", "name": "manual", "schema": {"type": "boolean"}, "description": "Show only items that have been added manually."}, {"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}, "description": "limits the output with specified number of incidents. Must be a number greater than zero."}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}, "description": "Offset for pagination."}, {"in": "query", "name": "order_by", "schema": {"type": "array", "items": {"type": "string"}}, "description": "List of fields to sort the results by. Each field must be followed by \"+\" for descending order or \"-\" for ascending order (e.g., --order-by ip+ or --order-by purpose-)"}, {"in": "query", "name": "by_type", "schema": {"type": "string"}, "description": "Filters output by item tipe [country | ip]"}]}}, "/ip-list/local/add": {"put": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Add item(-s) from local ip-list", "description": "Add item(-s) from local ip-list", "requestBody": {"content": {"application/json": {"schema": {"type": "object", "properties": {"params": {"type": "object", "properties": {"items": {"type": "array", "items": {"type": "string"}, "description": "IP which would be provided to opted list"}, "purpose": {"type": "string", "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}, "expiration": {"type": "integer", "description": "allows specifying expiration time for the listed IP (in seconds since epoch)", "default": 0}, "comment": {"type": "string", "description": "allows to add comment to the item"}, "scope": {"type": "string", "description": "Allows to set the scope to Global/Local. Accepts two values local (a default value, means \"add IP on this server only\") and group (means \"add IP for the whole group in which this server is\")."}, "full_access": {"type": "boolean", "description": "Allow access to all blocked ports as well"}}}}}}}}}}, "/ip-list/local/delete": {"delete": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "summary": "Remove item(-s) from local ip-list", "description": "Remove item(-s) from local ip-list", "parameters": [{"in": "query", "name": "items", "schema": {"type": "array", "items": {"type": "string"}}, "required": true, "description": "IP which would be removed from opted list"}, {"in": "query", "name": "purpose", "schema": {"type": "string"}, "description": "IP List purpose can be `white` - do not block these IPs. `drop` - deny access on the network level (DROP packets via iptables, and respond with 403 on web ports even when the request comes through a proxy). `captcha` - deny access on the network level for all non-web ports, show a Splash Screen challenge page on web ports. `splashscreen` - check the visitor's browser before allowing access to websites."}]}}, "/ip-list/synced": {"get": {"tags": ["firewall"], "responses": {"200": {"description": ""}}, "parameters": [{"in": "query", "name": "limit", "schema": {"type": "integer", "default": 50}}, {"in": "query", "name": "offset", "schema": {"type": "integer", "default": 0}}, {"in": "query", "name": "by_ip", "schema": {"type": "string"}}, {"in": "query", "name": "purpose", "schema": {"type": "string"}}]}}}}