---
title: "Update Alert Channels"
method: PATCH
path: "/api/v2/AlertChannels/{intgGuid}"
tags: ["AlertChannels"]
---

# Update Alert Channels

`PATCH /api/v2/AlertChannels/{intgGuid}`

Update an alert channel by specifying parameters in the request body  when invoking the following endpoint: 

  > `PATCH https://YourAccount.lacework.net/api/v2/AlertChannels/{intgGuid}` 

  In the request body, only specify the parameter(s) that you want to update, for example, `{ "enabled" : 0 }`.

## Path parameters

- `intgGuid` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Request body

- union
  - AlertChannelsAwsS3UpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'AwsS3' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `s3CrossAccountCredentials` object
        - `externalId` string
        - `roleArn` string
        - `bucketArn` string
  - AlertChannelsCiscoSparkWebhookUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'CiscoSparkWebhook' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `webhook` string — The URL of your incoming webhook.
  - AlertChannelsCloudwatchEbUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'CloudwatchEb' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing `Events` results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple events being created, one for each resource. See [Create an Amazon CloudWatch Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSEventBridge).
      - `eventBusArn` string — The ARN of your Amazon CloudWatch event bus, which uses the following format: <br />`arn:aws:events:<REGION>:<YOUR-ACCOUNT-ID>:event-bus/<YOUR-EVENT-BUS-NAME>` <br />Replace `REGION` , `YOUR-ACCOUNT-ID` and `YOUR-EVENT-BUS-NAME` with your values.
  - AlertChannelsDatadogUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'Datadog' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `datadogType` 'Logs Detail' | 'Logs Summary' | 'Events Summary' — The Datadog service to use in the alert channel such as Logs Detail, Logs Summary, or Events Summary.
      - `datadogSite` 'com' | 'eu' | 'us' | 'us3' | 'us5' | 'us1-fed' — The Datadog site you want to store your logs, either the US or Europe.
      - `apiKey` string, password — YourApiKey
  - AlertChannelsEmailUserUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'EmailUser' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `channelProps` object
        - `recipients` string — The list of email addresses to send alerts to.
  - AlertChannelsGcpPubsubUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'GcpPubsub' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single message. Choosing `Events` results in a single message being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple messages being created, one for each resource. See [Create a GCP Pub/Sub Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=gcpPubSubUrl).
      - `credentials` object — Your GCP Pub/Sub's credentials.
        - `clientId` string — Your GCP Pub/Sub's client ID.
        - `privateKeyId` string — Your GCP Pub/Sub's private key.
        - `clientEmail` string — The Client Email name provided when creating the new service account.
        - `privateKey` string — Your GCP Pub/Sub's private key certificate.
      - `projectId` string — Your GCP Pub/Sub's project ID.
      - `topicId` string — The topic ID to use in this alert channel.
  - AlertChannelsIbmQradarUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'IbmQradar' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a IBM QRadar Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ibmQradarUrl).
      - `qradarCommType` 'HTTPS' | 'HTTPS Self Signed Cert' — The issue group to use in this alert channel such as Events, Resources.
      - `qradarHostUrl` string — Your domain name or IP address of QRadar.
      - `qradarHostPort` number — Your listen port defined in QRadar.
  - AlertChannelsJiraUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'Jira' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` union
      - AlertChannelsJiraDataJIRACLOUDUpdateSchema
        - `jiraType` 'JIRA_CLOUD' — The Jira product you are using such as Jira Cloud or Jira Server.
        - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
        - `jiraUrl` string — The URL of your Jira implementation.
        - `projectId` string — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
        - `issueType` string — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
        - `username` string — The Jira user name. FortiCNAPP recommends a dedicated Jira user.
        - `apiToken` string, password — Your Jira API Token.
        - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
      - AlertChannelsJiraDataJIRASERVERUpdateSchema
        - `jiraType` 'JIRA_SERVER' — The Jira product you are using such as Jira Cloud or Jira Server.
        - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
        - `jiraUrl` string — The URL of your Jira implementation.
        - `projectId` string — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
        - `issueType` string — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
        - `username` string — The Jira user name. FortiCNAPP recommends using a dedicated Jira user.
        - `password` string, password — The password to the Jira user specified in the `username` attribute.
        - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
  - AlertChannelsMicrosoftTeamsUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'MicrosoftTeams' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `teamsUrl` string — The URL of your Microsoft Teams incoming webhook.
  - AlertChannelsNewRelicInsightsUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'NewRelicInsights' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `insertKey` string — Your New Relic Insert Key. See [Add an Insert Key](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=newRelicUrl)
      - `accountId` number — Your New Relic account ID.
      - `region` 'US' | 'EU' — The data center (US or EU) to access.
  - AlertChannelsPagerDutyApiUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'PagerDutyApi' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `apiIntgKey` string — Your Integration Key.
  - AlertChannelsServiceNowRestUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'ServiceNowRest' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single ServiceNow incident. Choosing `Events` results in a single ServiceNow incident being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple compliance incidents being created, one for each resource. See [Create a ServiceNow Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=serviceNowUrl).
      - `userName` string — Your ServiceNow username.
      - `password` string, password — Your ServiceNow password.
      - `instanceUrl` string — Your ServiceNow server.
      - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
  - AlertChannelsSlackChannelUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'SlackChannel' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `slackUrl` string — The URL of your Slack incoming webhook.
  - AlertChannelsSplunkHecUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'SplunkHec' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a Splunk Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=splunkUrl).
      - `hecToken` string — Your Splunk HEC token. To find your HEC token, navigate to Splunk Web, then click **Data Inputs > HttpEvent Collector**.
      - `channel` string — Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a Globally Unique Identifier (GUID) but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When Splunk Enterprise sees a new channel identifier, it creates a new channel.
      - `host` string — The resolvable hostname or IP address of your Splunk instance (such as `http-inputs-<host>.splunkcloud.com`).
      - `port` number — The destination port for forwarding alerts [80 or 443].
      - `ssl` boolean — When sending a request, use this attribute to enable or disable the SSL encryption. When included in a response, returns `1` for enabled SSL encryption, or returns `0` for disabled SSL encryption.
      - `eventData` object — Details of the event's data structure.
        - `index` string — The Splunk index to use in this alert channel.
        - `source` string — The Splunk source to use in this alert channel.
        - `sourceType` '_json' | 'lacework:alerts'
  - AlertChannelsVictorOpsUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'VictorOps' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `intgUrl` string — The VictorOps REST endpoint URL.
  - AlertChannelsWebhookUpdateSchema
    - `name` string — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
    - `type` 'Webhook' — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
    - `enabled` number — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
    - `cloudId` string — The cloud account identifier.
    - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
    - `data` object
      - `webhookUrl` string — The Webhook URL endpoint.
      - `headers` object — A set of custom HTTP headers represented as key-value pairs. Keys are header names and values are header values.

## Response `200`

No Error

- object
  - `data` union
    - AlertChannelsAwsS3ResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'AwsS3', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `s3CrossAccountCredentials` object, required
          - `externalId` string, required
          - `roleArn` string, required
          - `bucketArn` string, required
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsCiscoSparkWebhookResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'CiscoSparkWebhook', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `webhook` string, required — The URL of your incoming webhook.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsCloudwatchEbResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'CloudwatchEb', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing `Events` results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple events being created, one for each resource. See [Create an Amazon CloudWatch Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSEventBridge).
        - `eventBusArn` string, required — The ARN of your Amazon CloudWatch event bus, which uses the following format: <br />`arn:aws:events:<REGION>:<YOUR-ACCOUNT-ID>:event-bus/<YOUR-EVENT-BUS-NAME>` <br />Replace `REGION` , `YOUR-ACCOUNT-ID` and `YOUR-EVENT-BUS-NAME` with your values.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsDatadogResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'Datadog', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `datadogType` 'Logs Detail' | 'Logs Summary' | 'Events Summary', required — The Datadog service to use in the alert channel such as Logs Detail, Logs Summary, or Events Summary.
        - `datadogSite` 'com' | 'eu' | 'us' | 'us3' | 'us5' | 'us1-fed', required — The Datadog site you want to store your logs, either the US or Europe.
        - `apiKey` string, password, required — YourApiKey
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsEmailUserResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'EmailUser', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `channelProps` object, required
          - `recipients` string, required — The list of email addresses to send alerts to.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsGcpPubsubResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'GcpPubsub', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single message. Choosing `Events` results in a single message being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple messages being created, one for each resource. See [Create a GCP Pub/Sub Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=gcpPubSubUrl).
        - `credentials` object, required — Your GCP Pub/Sub's credentials.
          - `clientId` string, required — Your GCP Pub/Sub's client ID.
          - `privateKeyId` string, required — Your GCP Pub/Sub's private key.
          - `clientEmail` string, required — The Client Email name provided when creating the new service account.
          - `privateKey` string, required — Your GCP Pub/Sub's private key certificate.
        - `projectId` string, required — Your GCP Pub/Sub's project ID.
        - `topicId` string, required — The topic ID to use in this alert channel.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsIbmQradarResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'IbmQradar', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a IBM QRadar Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ibmQradarUrl).
        - `qradarCommType` 'HTTPS' | 'HTTPS Self Signed Cert', required — The issue group to use in this alert channel such as Events, Resources.
        - `qradarHostUrl` string, required — Your domain name or IP address of QRadar.
        - `qradarHostPort` number — Your listen port defined in QRadar.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsJiraResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'Jira', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` union, required
        - AlertChannelsJiraDataJIRACLOUDCreateSchema
          - `jiraType` 'JIRA_CLOUD' — The Jira product you are using such as Jira Cloud or Jira Server.
          - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
          - `jiraUrl` string, required — The URL of your Jira implementation.
          - `projectId` string, required — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
          - `issueType` string, required — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
          - `username` string, required — The Jira user name. FortiCNAPP recommends a dedicated Jira user.
          - `apiToken` string, password, required — Your Jira API Token.
          - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
        - AlertChannelsJiraDataJIRASERVERCreateSchema
          - `jiraType` 'JIRA_SERVER' — The Jira product you are using such as Jira Cloud or Jira Server.
          - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
          - `jiraUrl` string, required — The URL of your Jira implementation.
          - `projectId` string, required — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
          - `issueType` string, required — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
          - `username` string, required — The Jira user name. FortiCNAPP recommends using a dedicated Jira user.
          - `password` string, password, required — The password to the Jira user specified in the `username` attribute.
          - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsMicrosoftTeamsResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'MicrosoftTeams', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `teamsUrl` string, required — The URL of your Microsoft Teams incoming webhook.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsNewRelicInsightsResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'NewRelicInsights', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `insertKey` string, required — Your New Relic Insert Key. See [Add an Insert Key](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=newRelicUrl)
        - `accountId` number, required — Your New Relic account ID.
        - `region` 'US' | 'EU' — The data center (US or EU) to access.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsPagerDutyApiResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'PagerDutyApi', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `apiIntgKey` string, required — Your Integration Key.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsServiceNowRestResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'ServiceNowRest', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single ServiceNow incident. Choosing `Events` results in a single ServiceNow incident being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple compliance incidents being created, one for each resource. See [Create a ServiceNow Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=serviceNowUrl).
        - `userName` string, required — Your ServiceNow username.
        - `password` string, password, required — Your ServiceNow password.
        - `instanceUrl` string, required — Your ServiceNow server.
        - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsSlackChannelResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'SlackChannel', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `slackUrl` string, required — The URL of your Slack incoming webhook.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsSplunkHecResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'SplunkHec', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a Splunk Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=splunkUrl).
        - `hecToken` string, required — Your Splunk HEC token. To find your HEC token, navigate to Splunk Web, then click **Data Inputs > HttpEvent Collector**.
        - `channel` string — Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a Globally Unique Identifier (GUID) but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When Splunk Enterprise sees a new channel identifier, it creates a new channel.
        - `host` string, required — The resolvable hostname or IP address of your Splunk instance (such as `http-inputs-<host>.splunkcloud.com`).
        - `port` number, required — The destination port for forwarding alerts [80 or 443].
        - `ssl` boolean — When sending a request, use this attribute to enable or disable the SSL encryption. When included in a response, returns `1` for enabled SSL encryption, or returns `0` for disabled SSL encryption.
        - `eventData` object, required — Details of the event's data structure.
          - `index` string, required — The Splunk index to use in this alert channel.
          - `source` string, required — The Splunk source to use in this alert channel.
          - `sourceType` '_json' | 'lacework:alerts'
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsVictorOpsResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'VictorOps', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `intgUrl` string, required — The VictorOps REST endpoint URL.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
    - AlertChannelsWebhookResponseSchema
      - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
      - `type` 'Webhook', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
      - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
      - `cloudId` string — The cloud account identifier.
      - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
      - `data` object, required
        - `webhookUrl` string, required — The Webhook URL endpoint.
        - `headers` object — A set of custom HTTP headers represented as key-value pairs. Keys are header names and values are header values.
      - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
      - `props` object — The integration's properties.
      - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
      - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
      - `intgGuid` string — The integration’s globally unique identifier.
      - `state` object — The integration’s real-time state, such as Pending, Success, or Error.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)