v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB

oauthManagement

Rotate the oauth client secret

Generates a new secret for the oauth client that is passed in the call, keeping the same client ID.

put/v1/oauth/clients/{id}/rotate

Path parameters

idstring required

The ID of the oauth client to rotate the secret for.

Response

OAuth client secret rotated successfully.

typestring required

Type of the object model.

idstring required

Unique identifier of the OAuth client.

clientIdstring required

Identifier of the OAuth client. Unique within each organization. Will be a URL for dynamically generated clients.

createdAtstring date-time required

Creation timestamp in UTC in RFC3339 format.

createdBystring required

Identifier of the user who created the OAuth client.

modifiedAtstring date-time required

Last modification timestamp in UTC.

modifiedBystring required

Identifier of the user who modified the OAuth client.

namestring required

Name of the OAuth client.

descriptionstring required

Description of the OAuth client.

disabledboolean required

Whether the OAuth client is disabled. Disabled OAuth clients cannot be used to authenticate users.

scopesstring[] required

Scopes assigned to the client.

MCP Server Required Scopes: For full access to all MCP Server tools, the following scopes are required. Each tool lists the scopes it needs.

alerts___alertsReadById — viewAlerts
alerts___alertsSearch — viewAlerts
dashboards___getDashboard — viewLibrary
dashboards___listDashboards — viewLibrary
dashboards___createDashboard — manageLibrary
dashboards___updateDashboard — manageLibrary
discovery___listPartitions — viewPartitions
discovery___listExtractionRules — viewFieldExtractionRules
discovery___listCustomFields — viewFields
log-search___runLogSearch — runLogSearch
insights___getAllInsights — viewCse
insights___getInsight — viewCse
insights___getInsights — viewCse
insights___updateInsightAssignee — viewCse, cseManageInsightAssignee
insights___updateInsightStatus — viewCse, cseManageInsightStatus
rules___getRule — viewCse, cseViewRules
rules___getRules — viewCse, cseViewRules
rules___createTemplatedMatchRule — viewCse, cseManageRules
rules___createThresholdRule — viewCse, cseManageRules

Alerting

viewAlerts (MCP Server)
adminMonitorsV2
viewMonitorsV2
manageMonitorsV2
viewMutingSchedules
manageMutingSchedules

Audit Event Management

searchAuditIndex
dataVolumeIndex
auditEventIndex

Cloud SIEM

viewCse (MCP Server)
cseViewRules (MCP Server)
cseManageRules (MCP Server)
cseManageInsightAssignee (MCP Server)
cseManageInsightStatus (MCP Server)
cseCommentOnInsights
cseCreateInsights
cseDeleteInsights
cseInvokeInsights
cseManageInsightPolicy
cseManageInsightSignals
cseManageInsightTags
cseViewThreatIntelligence
cseManageThreatIntelligence
cseViewMatchLists
cseManageMatchLists
cseViewFileAnalysis
cseManageFileAnalysis
cseViewCustomInsights
cseManageCustomInsights
cseViewNetworkBlocks
cseManageNetworkBlocks
cseViewSuppressedEntities
cseManageSuppressedEntities
cseViewMappings
cseManageMappings
cseManageArtifacts
cseViewCustomInsightStatuses
cseManageCustomInsightStatuses
cseViewContextActions
cseManageContextActions
cseViewActions
cseManageActions
cseViewEnrichments
cseManageEnrichments
cseViewCustomEntityType
cseManageCustomEntityType
cseViewEntity
cseManageEntity
cseViewEntityConfiguration
cseManageEntityConfiguration
cseViewEntityCriticality
cseManageEntityCriticality
cseViewTagSchemas
cseManageTagSchemas
cseManageFavoriteFields
cseViewEntityGroups
cseManageEntityGroups
cseViewAutomations
cseManageAutomations
cseExecuteAutomations

Cloud SOAR

viewCloudSoar
cloudSoarAPIAdmin
cloudSoarAPIEmailEdit
cloudSoarAPIEmailRead
cloudSoarAPIUse
cloudSoarAppCentralAccess
cloudSoarAppCentralExport
cloudSoarAuditAndInformationAuditTrail
cloudSoarAuditAndInformationConfigureAuditTrail
cloudSoarAuditAndInformationLicenseInformation
cloudSoarAutomationRulesAccess
cloudSoarAutomationRulesConfigure
cloudSoarBridgeMonitoringAccess
cloudSoarCustomizationFields
cloudSoarCustomizationIncidentLabels
cloudSoarCustomizationLogo
cloudSoarDashboardAccess
cloudSoarDashboardAll
cloudSoarEntitiesAccess
cloudSoarEntitiesBulkPhysicalDelete
cloudSoarEntitiesManage
cloudSoarGeneralConfigure
cloudSoarIncidentAccess
cloudSoarIncidentAccessAll
cloudSoarIncidentAttachmentsAccess
cloudSoarIncidentAttachmentsEdit
cloudSoarIncidentBulkOperations
cloudSoarIncidentChangeOwnership
cloudSoarIncidentEdit
cloudSoarIncidentFoldersEdit
cloudSoarIncidentManageInvestigators
cloudSoarIncidentNotesAccess
cloudSoarIncidentNotesEdit
cloudSoarIncidentPlaybooksAccess
cloudSoarIncidentPlaybooksEdit
cloudSoarIncidentPlaybooksManage
cloudSoarIncidentTaskAccess
cloudSoarIncidentTaskAccessAll
cloudSoarIncidentTaskEdit
cloudSoarIncidentTaskReassign
cloudSoarIncidentTaskView
cloudSoarIncidentTemplatesAccess
cloudSoarIncidentTemplatesConfigure
cloudSoarIncidentTriageAccess
cloudSoarIncidentTriageAccessAll
cloudSoarIncidentTriageChangeOwnership
cloudSoarIncidentTriageEdit
cloudSoarIncidentTriageView
cloudSoarIncidentView
cloudSoarIncidentWarRoomUse
cloudSoarIntegrationsAccess
cloudSoarIntegrationsConfigure
cloudSoarNotificationConfigure
cloudSoarNotificationTriage
cloudSoarObservabilityAccess
cloudSoarObservabilityManagement
cloudSoarPlaybooksAccess
cloudSoarPlaybooksConfigure
cloudSoarReportAccess
cloudSoarReportAll
cloudSoarUserManagementGroups
cloudSoarWidgetsAll

Dashboards

worldDashboards
whitelistDashboards
shareDashboardAllowlist
manageDashboardExecutionControls

Data Management

manageApps
viewCollectors
manageCollectors
viewConnections
manageConnections
contentAdmin
viewFieldExtractionRules (MCP Server)
manageFieldExtractionRules
viewFields (MCP Server)
manageFields
manageBudgets
viewLibrary (MCP Server)
manageLibrary (MCP Server)
viewPartitions (MCP Server)
managePartitions
manageS3DataForwarding
viewScheduledViews
manageScheduledViews
manageTokens
viewPipelines
managePipelines
viewAccountOverview
dataVolume
downloadSearchResults
viewDeletionRules
manageDeletionRules
reviewDeletionRequest
viewEventExtractionRules
manageEventExtractionRules
viewParsers

Data Masking

viewUnmaskedData
manageDataMasking

Entity Management

manageEntityTypeConfig

Logs

runLogSearch (MCP Server)

Macros

manageMacros

Metrics

runMetricsQuery
metricsTransformation
metricsExtraction
metricsRules

Open Analytics

manageOpenAnalyticsEndpoint

Organizations

viewOrganizations
createTrialOrganizations
createOrganizations
upgradeTrialOrganizations
changeCreditsAllocation
deactivateOrganizations
manageOrganizations

Reliability Management

viewSlos
manageSlos

Security

manageAccessKeys
viewPersonalAccessKeys
managePersonalAccessKeys
manageOAuthClients
changeDataAccessLevel
passwordPolicy
ipWhitelisting
ipAllowlisting
supportAccount
audit
saml
worldDashboardMaster
orgSettings

Threat Intelligence

viewThreatIntelDataStore
manageThreatIntelDataStore

Usage Management

viewUsageManagement
manageUsageManagement

User Management

viewUsersAndRoles
manageUsersAndRoles

Example response

{
  "id": "0000000006743FDE",
  "clientId": "zVplCFHcpTDwtktBIQmFI2K6s9HEo4HAtcQD1f1M5eQ",
  "createdAt": "2018-10-16T09:10:00Z",
  "createdBy": "0000000006743FDD",
  "modifiedAt": "2018-10-16T09:10:00Z",
  "modifiedBy": "0000000006743FDD",
  "name": "My OAuth Client",
  "description": "OAuth client for data ingestion",
  "scopes": [
    "manageUsersAndRoles",
    "viewCollectors"
  ]
}