synoti logosynoti logo
API Documentation Introduction

Introduction

Unified Security Stack SIEM and SOAR delivers a REST API for programmatic access to alerts, log data, incidents, and system management. OpenSearch serves as the API's underlying search engine (API endpoints are prefixed with /api/elasticsearch/ due to historical reasons, though OpenSearch is the backend). Note that this API documentation does not cover the Unified Security Stack Vulnerability Scanner.

Base URL format: https://<your-synoti-instance>

All examples in this document use {{baseUrl}} as a placeholder for your instance URL and {{apiKey}} as a stand-in for your API key.

Postman collection

You may use the following postman collection to simplify your work with the Unified Security Stack API.

Get the postman collection from this link.

Open API file.

You can use the OpenAPI file to create processes programmatically.

Retrieve the OpenAPI file by downloading it.

Important notes:

  • If your instance uses a self-signed SSL certificate, add -k for curl commands to bypass certificate verification.

  • All search/filter endpoints that accept a request body use POST method with Content-Type: application/json.

  • Pagination information is returned in response headers (X-Total-Count, Link).