@lap v0.3
# Machine-readable API spec. Each @endpoint block is one API call.
@api Amazon Detective
@version 2018-10-26
@auth AWS SigV4
@endpoints 29
@hint download_for_search
@toc invitation(2), graph(10), membership(2), orgs(5), investigations(5), graphs(1), invitations(1), tags(3)

@group invitation
@endpoint PUT /invitation
@required {GraphArn: str}

@endgroup

@group graph
@endpoint POST /graph/datasources/get
@required {GraphArn: str, AccountIds: [str]}
@returns(200) {MemberDatasources: [MembershipDatasources]?, UnprocessedAccounts: [UnprocessedAccount]?}

@endgroup

@group membership
@endpoint POST /membership/datasources/get
@required {GraphArns: [str]}
@returns(200) {MembershipDatasources: [MembershipDatasources]?, UnprocessedGraphs: [UnprocessedGraph]?}

@endgroup

@group graph
@endpoint POST /graph
@optional {Tags: map<str,str>}
@returns(200) {GraphArn: str?}

@endpoint POST /graph/members
@required {GraphArn: str, Accounts: [Account]}
@optional {Message: str, DisableEmailNotification: bool}
@returns(200) {Members: [MemberDetail]?, UnprocessedAccounts: [UnprocessedAccount]?}

@endpoint POST /graph/removal
@required {GraphArn: str}

@endpoint POST /graph/members/removal
@required {GraphArn: str, AccountIds: [str]}
@returns(200) {AccountIds: [str]?, UnprocessedAccounts: [UnprocessedAccount]?}

@endgroup

@group orgs
@endpoint POST /orgs/describeOrganizationConfiguration
@required {GraphArn: str}
@returns(200) {AutoEnable: bool?}

@endpoint POST /orgs/disableAdminAccount

@endgroup

@group membership
@endpoint POST /membership/removal
@required {GraphArn: str}

@endgroup

@group orgs
@endpoint POST /orgs/enableAdminAccount
@required {AccountId: str}

@endgroup

@group investigations
@endpoint POST /investigations/getInvestigation
@required {GraphArn: str, InvestigationId: str}
@returns(200) {GraphArn: str?, InvestigationId: str?, EntityArn: str?, EntityType: str?, CreatedTime: str(timestamp)?, ScopeStartTime: str(timestamp)?, ScopeEndTime: str(timestamp)?, Status: str?, Severity: str?, State: str?}

@endgroup

@group graph
@endpoint POST /graph/members/get
@required {GraphArn: str, AccountIds: [str]}
@returns(200) {MemberDetails: [MemberDetail]?, UnprocessedAccounts: [UnprocessedAccount]?}

@endpoint POST /graph/datasources/list
@required {GraphArn: str}
@optional {NextToken: str, MaxResults: int}
@returns(200) {DatasourcePackages: map<str,DatasourcePackageIngestDetail>?, NextToken: str?}

@endgroup

@group graphs
@endpoint POST /graphs/list
@optional {NextToken: str, MaxResults: int}
@returns(200) {GraphList: [Graph]?, NextToken: str?}

@endgroup

@group investigations
@endpoint POST /investigations/listIndicators
@required {GraphArn: str, InvestigationId: str}
@optional {IndicatorType: str, NextToken: str, MaxResults: int}
@returns(200) {GraphArn: str?, InvestigationId: str?, NextToken: str?, Indicators: [Indicator]?}

@endpoint POST /investigations/listInvestigations
@required {GraphArn: str}
@optional {NextToken: str, MaxResults: int, FilterCriteria: FilterCriteria, SortCriteria: SortCriteria}
@returns(200) {InvestigationDetails: [InvestigationDetail]?, NextToken: str?}

@endgroup

@group invitations
@endpoint POST /invitations/list
@optional {NextToken: str, MaxResults: int}
@returns(200) {Invitations: [MemberDetail]?, NextToken: str?}

@endgroup

@group graph
@endpoint POST /graph/members/list
@required {GraphArn: str}
@optional {NextToken: str, MaxResults: int}
@returns(200) {MemberDetails: [MemberDetail]?, NextToken: str?}

@endgroup

@group orgs
@endpoint POST /orgs/adminAccountslist
@optional {NextToken: str, MaxResults: int}
@returns(200) {Administrators: [Administrator]?, NextToken: str?}

@endgroup

@group tags
@endpoint GET /tags/{ResourceArn}
@required {ResourceArn: str}
@returns(200) {Tags: map<str,str>?}

@endgroup

@group invitation
@endpoint POST /invitation/removal
@required {GraphArn: str}

@endgroup

@group investigations
@endpoint POST /investigations/startInvestigation
@required {GraphArn: str, EntityArn: str, ScopeStartTime: str(timestamp), ScopeEndTime: str(timestamp)}
@returns(200) {InvestigationId: str?}

@endgroup

@group graph
@endpoint POST /graph/member/monitoringstate
@required {GraphArn: str, AccountId: str}

@endgroup

@group tags
@endpoint POST /tags/{ResourceArn}
@required {ResourceArn: str, Tags: map<str,str>}

@endpoint DELETE /tags/{ResourceArn}
@required {ResourceArn: str, tagKeys: [str]}

@endgroup

@group graph
@endpoint POST /graph/datasources/update
@required {GraphArn: str, DatasourcePackages: [str]}

@endgroup

@group investigations
@endpoint POST /investigations/updateInvestigationState
@required {GraphArn: str, InvestigationId: str, State: str}

@endgroup

@group orgs
@endpoint POST /orgs/updateOrganizationConfiguration
@required {GraphArn: str}
@optional {AutoEnable: bool}

@endgroup

@end