openapi: 3.0.3
info:
  title: SIEMatic REST API
  version: 1.0.0
  description: REST endpoints for event ingestion and saved searches.
paths:
  /api-token-auth/:
    post:
      operationId: api_token_auth_create
      tags:
      - api-token-auth
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthToken'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/AuthToken'
          application/json:
            schema:
              $ref: '#/components/schemas/AuthToken'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthToken'
          description: ''
  /api/events/:
    get:
      operationId: api_events_list
      description: |-
        ViewSet for Event model operations.

        Provides CRUD operations for events with filtering, searching, and bulk creation support.
      parameters:
      - in: query
        name: created
        schema:
          type: string
          format: date-time
      - in: query
        name: host
        schema:
          type: string
      - in: query
        name: index
        schema:
          type: string
      - name: search
        required: false
        in: query
        description: A search term.
        schema:
          type: string
      - in: query
        name: source
        schema:
          type: string
      - in: query
        name: sourcetype
        schema:
          type: string
      - in: query
        name: updated
        schema:
          type: string
          format: date-time
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Event'
          description: ''
    post:
      operationId: api_events_create
      description: |-
        Create one or more events.

        Handles both single and bulk event creation.

        Args:
            request: The HTTP request.

        Returns:
            Response with created event data.
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Event'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Event'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Event'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
          description: ''
  /api/events/{id}/:
    get:
      operationId: api_events_retrieve
      description: |-
        ViewSet for Event model operations.

        Provides CRUD operations for events with filtering, searching, and bulk creation support.
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this event.
        required: true
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
          description: ''
    put:
      operationId: api_events_update
      description: |-
        ViewSet for Event model operations.

        Provides CRUD operations for events with filtering, searching, and bulk creation support.
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this event.
        required: true
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Event'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Event'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Event'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
          description: ''
    patch:
      operationId: api_events_partial_update
      description: |-
        ViewSet for Event model operations.

        Provides CRUD operations for events with filtering, searching, and bulk creation support.
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this event.
        required: true
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedEvent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedEvent'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedEvent'
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
          description: ''
    delete:
      operationId: api_events_destroy
      description: |-
        ViewSet for Event model operations.

        Provides CRUD operations for events with filtering, searching, and bulk creation support.
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this event.
        required: true
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '204':
          description: No response body
  /api/savedsearches/:
    get:
      operationId: api_savedsearches_list
      parameters:
      - name: search
        required: false
        in: query
        description: A search term.
        schema:
          type: string
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SavedSearch'
          description: ''
    post:
      operationId: api_savedsearches_create
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/SavedSearch'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/SavedSearch'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
          description: ''
  /api/savedsearches/{id}/:
    get:
      operationId: api_savedsearches_retrieve
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this saved search.
        required: true
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
          description: ''
    put:
      operationId: api_savedsearches_update
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this saved search.
        required: true
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/SavedSearch'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/SavedSearch'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
          description: ''
    patch:
      operationId: api_savedsearches_partial_update
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this saved search.
        required: true
      tags:
      - api
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedSavedSearch'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedSavedSearch'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedSavedSearch'
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
          description: ''
    delete:
      operationId: api_savedsearches_destroy
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this saved search.
        required: true
      tags:
      - api
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '204':
          description: No response body
  /search2/api/run/:
    post:
      operationId: search2_api_run_create
      tags:
      - search2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchRunRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/SearchRunRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/SearchRunRequest'
        required: true
      security:
      - basicAuth: []
      - cookieAuth: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchRunResponse'
          description: ''
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchRunError'
          description: ''
components:
  schemas:
    AuthToken:
      type: object
      properties:
        username:
          type: string
          writeOnly: true
        password:
          type: string
          writeOnly: true
        token:
          type: string
          readOnly: true
      required:
      - password
      - token
      - username
    Event:
      type: object
      description: |-
        Serializer for individual Event instances.

        Handles serialization and creation of single events.
      properties:
        id:
          type: integer
          readOnly: true
        index:
          type: string
          maxLength: 255
        sourcetype:
          type: string
          maxLength: 255
        source:
          type: string
          maxLength: 255
        host:
          type: string
          maxLength: 255
        data:
          type: string
        created:
          type: string
          format: date-time
          readOnly: true
        updated:
          type: string
          format: date-time
          readOnly: true
        extracted_fields:
          nullable: true
      required:
      - created
      - data
      - id
      - updated
    PatchedEvent:
      type: object
      description: |-
        Serializer for individual Event instances.

        Handles serialization and creation of single events.
      properties:
        id:
          type: integer
          readOnly: true
        index:
          type: string
          maxLength: 255
        sourcetype:
          type: string
          maxLength: 255
        source:
          type: string
          maxLength: 255
        host:
          type: string
          maxLength: 255
        data:
          type: string
        created:
          type: string
          format: date-time
          readOnly: true
        updated:
          type: string
          format: date-time
          readOnly: true
        extracted_fields:
          nullable: true
    PatchedSavedSearch:
      type: object
      properties:
        id:
          type: integer
          readOnly: true
        name:
          type: string
          maxLength: 255
        query:
          type: string
        shared_with:
          type: array
          items:
            type: integer
        is_public:
          type: boolean
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
    SavedSearch:
      type: object
      properties:
        id:
          type: integer
          readOnly: true
        name:
          type: string
          maxLength: 255
        query:
          type: string
        shared_with:
          type: array
          items:
            type: integer
        is_public:
          type: boolean
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
      required:
      - created_at
      - id
      - name
      - query
      - updated_at
    SearchRunError:
      type: object
      properties:
        error:
          type: string
      required:
      - error
    SearchRunMeta:
      type: object
      properties:
        count:
          type: integer
      required:
      - count
    SearchRunRequest:
      type: object
      properties:
        query:
          type: string
      required:
      - query
    SearchRunResponse:
      type: object
      properties:
        rows:
          type: array
          items:
            type: object
            additionalProperties: {}
        meta:
          $ref: '#/components/schemas/SearchRunMeta'
      required:
      - meta
      - rows
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    cookieAuth:
      type: apiKey
      in: cookie
      name: sessionid