This is the Coro Cybersecurity platform API specification reference.
This section provides a complete reference listing for the Coro Cybersecurity REST API resource model.
This reference lists all the resources available through the Coro REST API.
Each section relates to a specific resource and provides its name, description, unique URI path, and the list of operations you can perform on it.
For each operation, you can find:
The portal also provides code samples and examples for making requests in a number of programming languages, together with samples of the possible response bodies.
In addition to this, Coro provides a Try It feature where you can interact with the API directly through the portal. To use Try It, you'll need to first obtain Client ID and Secret credentials; for more information, see Authentication.
https://docs.coro.net/_mock/api/api-docs/
https://api.secure.coro.net/
https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions
https://api.secure.coro.net/v1/tickets/{id}/actions
curl -i -X GET \
'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions' \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Workspace: corodevonmicrosoftcom_TX7T_u'A ticket action, corresponding to an appropriate EventAction to trigger.
Additional data required for executing certain ticket actions. This is a key-value object, where the value format depends on the specific action type.
Ticket actions that require metadata:
key: selectedSubEventTriggersvalue: a list of data types aggregated by the event. These values correspond to one or more entries from the /tickets API response, under the ticketDetails.violatedDataTypes path.https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions
https://api.secure.coro.net/v1/tickets/{id}/actions
curl -i -X POST \
'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions' \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Content-Type: application/json' \
-H 'Workspace: corodevonmicrosoftcom_TX7T_u' \
-d '{
"eventAction": "markAsProcessed",
"metadata": {
"selectedSubEventTriggers": [
"dlpPersonalData"
]
}
}'{ "ticketActionsStatus": {} }
https://docs.coro.net/_mock/api/api-docs/v1/tickets
https://api.secure.coro.net/v1/tickets
curl -i -X GET \
'https://docs.coro.net/_mock/api/api-docs/v1/tickets?fromTime=0&page=0&pageSize=50&processed=true&ticketIds=string&ticketTriggers=malwareInCloudDrive&toTime=0' \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Workspace: corodevonmicrosoftcom_TX7T_u'{ "items": [ { … } ], "totalElements": 0, "_links": { "autoRemediatedAuditLogs": { … } } }
https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}
https://api.secure.coro.net/v1/tickets/{id}
curl -i -X GET \
'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}' \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Workspace: corodevonmicrosoftcom_TX7T_u'Success
The type of open ticket.
Indicates whether the ticket was processed/manually actioned/closed by an operator or by Coro
UNIX timestamp in milliseconds for the time when the ticket was created in Coro
UNIX timestamp in milliseconds for when the threat was detected
UNIX timestamp in milliseconds for when the ticket was processed
UNIX timestamp in milliseconds for the last event time
Extra details about the ticket
Extra details about the ticket
{ "id": "GYDU-1212", "ticketTrigger": "malwareInCloudDrive", "processed": true, "creationTime": 1662052343274, "threatTime": 1662052343274, "processedTime": 1662052343274, "lastEventTime": 16620523284720, "parentWorkspaceId": "coroparent_123", "ticketDetails": { "deviceMetadata": { … }, "emailMetadata": { … }, "filesMetadata": [ … ], "location": [ … ], "malwareMetadata": { … }, "affectedUser": "test@example.com", "service": "Microsoft 365", "violationDirection": "access", "violatedDataTypes": [ … ] }, "workspaceId": "corotest_123", "_links": { "autoRemediatedAuditLogs": { … } } }