Coro Cybersecurity Public API (v1)

This is the Coro Cybersecurity platform API specification reference.

This section provides a complete reference listing for the Coro Cybersecurity REST API resource model.

About the resource reference

This reference lists all the resources available through the Coro REST API.

Each section relates to a specific resource and provides its name, description, unique URI path, and the list of operations you can perform on it.

For each operation, you can find:

A complete description of the action
Request parameters
A list of potential responses
Security (authentication) requirements

The portal also provides code samples and examples for making requests in a number of programming languages, together with samples of the possible response bodies.

In addition to this, Coro provides a Try It feature where you can interact with the API directly through the portal. To use Try It, you'll need to first obtain Client ID and Secret credentials; for more information, see Authentication.

Download OpenAPI description

View and download the Coro API JSON specification

Overview

URL

https://support.coro.net

E-mail

support@coro.net

Servers

Coro mock API server

https://docs.coro.net/_mock/api/api-docs

Coro US API server target URL

https://api.secure.coro.net

audit-logs

This is the audit log resource.

Operations

authentication

This is the resource for API authentication requests.

Use this resource to validate your identify and to obtain a bearer token to use when accessing other API resources.

Operations

devices

This is the Devices resource.

Use this resource to get details of all protected devices for a particular workspace.

Operations

portal-users

This is the portal user resource.

Use this resource to get details of all portal users added to the specified workspace.

Operations

subscriptions

This is the subscriptions resource.

Use this resource to view and manage workspace subscriptions.

Operations

tickets

This is the Tickets resource.

Use this resource to get details of all tickets stored in the Coro platform for a particular workspace.

Operations

Get the comments of a ticket

Request

Get the comments of a ticket, most recent first. Comments marked as confidential are not returned to workspace credentials.

This call supports pagination; default page size includes 20 comments.

Security

JWT

Path

idstringrequired

Query

pagestring>= 0

API responses use pagination to reduce loading time. Return a specific page of results, using a zero-based page index (0..N).

Default "0"

Example: page=0

pageSizestring[ 10 .. 500 ]

API responses use pagination to reduce loading time. Return a maximum of this many items per page.

Default "20"

Example: pageSize=50

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

curl -i -X GET \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/comments?page=0&pageSize=50' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u'

Responses

Success

Bodyapplication/json

itemsArray of objects(TicketCommentResponse)

totalElementsinteger(int64)

The total number of records that exist for the request.

Response

application/json

{
  "items": [
    { … }
  ],
  "totalElements": 0
}

Add a comment to a ticket

Request

Add a comment to a ticket, and notify the chosen recipients about it.

The comment is attributed to the administrator who generated the API credentials used for the call.

Security

JWT

Path

idstringrequired

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

Bodyapplication/jsonrequired

messagestringrequired

The text of the comment.

Example: "Reviewed with the customer, no further action required."

confidentialboolean

Marks the comment as confidential. Confidential comments are visible only to Coro administrators and are never returned to workspace credentials.

Requires globally authorised API credentials. When true, the only notification option that may be set is notifyCustomRecipients, and every custom recipient must be a Coro administrator.

Default false

includeTicketDetailsboolean

Includes the details of the ticket in the notifications sent for this comment.

Default false

notifyAffectedUsersboolean

Notifies the users affected by the ticket. Not available for device tickets, or when the comment is confidential.

Default false

notifyAllWorkspaceAdminsboolean

Notifies every administrator of the workspace. Not available when the comment is confidential.

Default false

notifySocContactsboolean

Notifies the managed service contacts of the workspace. Available only for tickets handled by the managed service, and not when the comment is confidential.

Default false

notifyCustomRecipientsboolean

Notifies the addresses listed in customRecipients.

Default false

customRecipientsArray of strings

The addresses to notify. Required when notifyCustomRecipients is true, and ignored otherwise. Addresses that cannot receive mail are rejected.

Example: ["security@example.com"]

curl -i -X POST \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/comments' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u' \
  -d '{
    "message": "Reviewed with the customer, no further action required.",
    "confidential": false,
    "includeTicketDetails": false,
    "notifyAffectedUsers": false,
    "notifyAllWorkspaceAdmins": false,
    "notifySocContacts": false,
    "notifyCustomRecipients": false,
    "customRecipients": [
      "security@example.com"
    ]
  }'

Responses

Created

Response

No content

Get ticket actions

Request

Get the list of actions currently available for a ticket, by ticket id.

The returned list is dynamic: it reflects the ticket's current state and changes as actions are performed. For example, an open ticket returns markAsProcessed, while a ticket that is already closed returns markAsUnprocessed instead. Always call this endpoint before triggering an action and only trigger actions present in the response; triggering an action that is not in the list fails with a validation error.

Each returned value can be passed as eventAction to POST /v1/tickets/{id}/actions (Trigger a ticket action).

Security

JWT

Path

idstringrequired

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

curl -i -X GET \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u'

Responses

A JSON array of action identifiers (eventAction values) currently available for the ticket. The schema lists all possible values; a given ticket returns only the subset applicable to its type and current state. Empty if no actions are currently applicable.

Bodyapplication/jsonArray [

Any of:

string

Enum"treatFileAsSafe""treatFileAsMalicious""excludeFolderFromScan""excludeCertificateFromScan""excludeFilePathAndCertificateFromScan""excludeFilePathAndFileHashFromScan""approveProcessGroup""enableFirewall""remoteScan""stopRemoteScan"

]

Response

application/json

[
  "suspendFromAll",
  "signInToAll",
  "signInToService",
  "suspendFromService",
  "contactUser",
  "markAsProcessed"
]

Trigger a ticket action

Request

Trigger a ticket action by ticket id.

The set of applicable actions is dynamic and depends on the ticket's current state. Always call GET /v1/tickets/{id}/actions (Get ticket actions) before triggering an action and only trigger actions present in its response; triggering an action that is not in the list fails with a validation error.

Most actions require only eventAction. Three actions accept a metadata object; refer to the request schema and the provided examples.

Security

JWT

Path

idstringrequired

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

Bodyapplication/jsonrequired

eventActionstring(EventAction)required

A ticket action, corresponding to an appropriate EventAction to trigger.

Example: "markAsProcessed"

Any of:

string

metadataobject

Additional data required for executing certain ticket actions. This is a key-value object; the keys depend on the action.

The following actions read metadata:

contactUser - metadata is required; the call fails without it:

contactMessage (string): the message sent to the users
recipients (array of strings): user emails to contact
includeEventDetails (boolean): whether to include the ticket's event details in the message
workspaceDisplayName (string): workspace name shown to the recipients

addToDataGovernancePermissions - required:

selectedSubEventTriggers (array of strings): the data types to grant permissions for. Values must come from ticketDetails.violatedDataTypes in the GET /tickets response for this ticket; values not present on the ticket are ignored.

approveEmail - optional:

recipients (array of strings): release the quarantined email only to this subset of the original recipients. When omitted, the email is released to all original recipients.

All other actions: omit metadata entirely; the action takes all required context from the ticket itself.

Example: {"selectedSubEventTriggers":["dlpPersonalData"]}

curl -i -X POST \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}/actions' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u' \
  -d '{
    "eventAction": "markAsProcessed"
  }'

Responses

The action was performed successfully. The response body is empty.

Response

No content

Get a list of all tickets

Request

Get a list of all tickets in the specified workspace. This call supports pagination; default page size includes 20 tickets.

Security

JWT

Query

ticketIdsArray of stringsunique

ticketTriggersArray of strings(EventTriggerDto)unique

processedboolean

Search by processed flag

fromTimenumber

Search for tickets that were occurred after this timestamp in milliseconds

toTimenumber

Search for tickets that were occurred before this timestamp in milliseconds

pagestring>= 0

API responses use pagination to reduce loading time. Return a specific page of results, using a zero-based page index (0..N).

Default "0"

Example: page=0

pageSizestring[ 10 .. 500 ]

API responses use pagination to reduce loading time. Return a maximum of this many items per page.

Default "20"

Example: pageSize=50

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

curl -i -X GET \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets?ticketIds=string&ticketTriggers=malwareInCloudDrive&processed=true&fromTime=0&toTime=0&page=0&pageSize=50' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u'

Responses

Success

Bodyapplication/json

itemsArray of objects(TicketResponse)

totalElementsinteger(int64)

The total number of records that exist for the request.

_linksobject(TicketLinkDoc)

Response

application/json

{
  "items": [
    { … }
  ],
  "totalElements": 0,
  "_links": {
    "autoRemediatedAuditLogs": { … }
  }
}

Get a ticket

Request

Get a ticket by ticket id.

Security

JWT

Path

idstringrequired

Headers

Workspacestringrequired

The workspace identifier, which isolates API requests inside the provided workspace scope.

Example: corodevonmicrosoftcom_TX7T_u

curl -i -X GET \
  'https://docs.coro.net/_mock/api/api-docs/v1/tickets/{id}' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Workspace: corodevonmicrosoftcom_TX7T_u'

Responses

Success

Bodyapplication/json

idstring

The unique identifier for the ticket

Example: "GYDU-1212"

ticketTriggerstring(EventTriggerDto)

The type of open ticket.

One of:

string

Enum"malwareInCloudDrive""abnormalAdminActivity""accessRestrictionsViolation""blockedIpLogin""suspectedIdentityCompromise""malwareOnEndpoint""infectedProcess""vssBackupProtection""isUnencrypted""missingPinAndPasswordProtection"

processedboolean

Indicates whether the ticket was processed/manually actioned/closed by an operator or by Coro

creationTimeinteger(int64)

UNIX timestamp in milliseconds for the time when the ticket was created in Coro

Example: 1662052343274

threatTimeinteger(int64)

UNIX timestamp in milliseconds for when the threat was detected

Example: 1662052343274

processedTimeinteger(int64)

UNIX timestamp in milliseconds for when the ticket was processed

Example: 1662052343274

lastEventTimeinteger(int64)

UNIX timestamp in milliseconds for the last event time

Example: 16620523284720

parentWorkspaceIdstring

The unique identifier of the parent workspace.

Example: "coroparent_123"

ticketDetailsTicketDetails (object)(TicketDetails)

Extra details about the ticket

One of:

Extra details about the ticket

object TicketDetails Recursive

workspaceIdstring

The unique identifier of the workspace.

Example: "corotest_123"

descriptionstring

A human-readable description of what Coro detected for this ticket

Example: "Coro detected 3 login(s) from blocked IP address 192.0.2.10 (Israel) for user@example.com in Google Workspace, starting on Sep 1, 2026 10:15 AM. For more information, see Full Details."

consoleUrlstring

A link to this ticket in the Coro console

Example: "https://secure.coro.net/portal/tickets?search=GYDU-1212"

_linksobject(TicketLinkDoc)

Response

application/json

{
  "id": "GYDU-1212",
  "ticketTrigger": "malwareInCloudDrive",
  "processed": true,
  "creationTime": 1662052343274,
  "threatTime": 1662052343274,
  "processedTime": 1662052343274,
  "lastEventTime": 16620523284720,
  "parentWorkspaceId": "coroparent_123",
  "ticketDetails": {
    "deviceMetadata": { … },
    "emailMetadata": { … },
    "filesMetadata": [ … ],
    "location": [ … ],
    "malwareMetadata": { … },
    "affectedUser": "test@example.com",
    "service": "Microsoft 365",
    "violationDirection": "access",
    "violatedDataTypes": [ … ]
  },
  "workspaceId": "corotest_123",
  "description": "Coro detected 3 login(s) from blocked IP address 192.0.2.10 (Israel) for user@example.com in Google Workspace, starting on Sep 1, 2026 10:15 AM. For more information, see Full Details.",
  "consoleUrl": "https://secure.coro.net/portal/tickets?search=GYDU-1212",
  "_links": {
    "autoRemediatedAuditLogs": { … }
  }
}

tickets-summary

This is the Tickets Summary resource.

Use this resource to get details of tickets for a particular workspace, grouped by protection component.

Operations

usage

This is the resource for Coro usage.

Use this resource to obtain information about usage

Operations

users

This is the protected user resource.

Use this resource to get details of all protected users added to the specified workspace.

Operations

webhook-configuration

Use this resource to manage or view details of existing webhooks configurations, or to create new webhook configurations.

Operations

workspaces

Use this resource to view details of provisioned workspaces, or to create new workspaces.

Operations

Coro Cybersecurity Public API (v1)

About the resource reference

audit-logs

authentication

devices

portal-users

subscriptions

tickets

Get the comments of a ticket

Request

Responses

Was this helpful?

Add a comment to a ticket

Request

Responses

Was this helpful?

Get ticket actions

Request

Responses

Was this helpful?

Trigger a ticket action

Request

Responses

Was this helpful?

Get a list of all tickets

Request

Responses

Was this helpful?

Get a ticket

Request

Responses

Was this helpful?

tickets-summary

usage

users

webhook-configuration

workspaces

Coro Cybersecurity Public API (v1)

About the resource reference

audit-logs

authentication

devices

portal-users

subscriptions

tickets

Get the comments of a ticket

Request

Responses

Was this helpful?

Add a comment to a ticket

Request

Responses

Was this helpful?

Get ticket actions

Request

Responses

Was this helpful?

Trigger a ticket action

RequestExpand all

Responses

Was this helpful?

Get a list of all tickets

RequestExpand all

Responses

Was this helpful?

Get a ticket

Request

Responses

Was this helpful?

tickets-summary

usage

users

webhook-configuration

workspaces

Request

Request