--- title: "Triggers" method: GET path: "/reporting/triggers/v1" tags: ["Endpoints", "Triggers", "Deprecated"] deprecated: true --- # Triggers `GET /reporting/triggers/v1` > **Deprecated.** **⚠️ Scheduled for removal after Jan 2023. Please migrate to [Security Events](#tag/Endpoints/operation/insights.external_api.main.get_events)** This API provides a list of emails that have been flagged by one of the Tessian modules. Each row of data returned by the API represents a “trigger”: an email flagged by a Tessian module. Each trigger will include email details, details outlining how the user responded to the Tessian warning message (if they were shown one), and other information that will vary depending on various parameters (Inbound vs Outbound, module type, etc.). For inbound emails that trigger Defender, a single email received by multiple users is likely to result in multiple rows (i.e. one row per user). For outbound emails that trigger Guardian, Enforcer, Architect or Constructor (legacy), one outbound email may trigger multiple filters, resulting in multiple rows (i.e. one row per filter triggered). We have provided a guide and accompanying queries to help deal with this complexity in the “Calculating Statistics” section below. The data is returned in JSON as an array of objects. Each object will contain the information appropriate for the type of trigger (Guardian, Enforcer, Defender, Architect, Constructor). **Important: if the data is not deduped, calculations of counts and other statistics will be inaccurate.** ## Calculating statistics This section documents how to compute some interesting stats from the triggers that are returned by the API, using a SQL-like language for illustration. **Note that for all stats, you must first dedupe by trigger_id, as mentioned above.** ### Enforcer #### Unauthorized emails prevented The number of emails that Tessian Enforcer has prevented from being sent by your company’s employees. ```COUNT (DISTINCT message_id) WHERE module = 'enforcer' AND unauthorized_email_prevented = 'True'``` #### Enforcer messages shown to users The number of Tessian Enforcer warning messages shown to users (either via the Add-in or Gateway). ```COUNT WHERE module = 'enforcer' AND (alert_type = 'warn' or alert_type = 'block')``` #### Unauthorized email attempts The number of emails that triggered Tessian Enforcer. ```COUNT (DISTINCT message_id) WHERE module = 'enforcer'``` #### Sensitive unauthorized email attempts The number of emails that triggered Tessian Enforcer that also contained sensitive information. ```COUNT (DISTINCT message_id) WHERE module = 'enforcer' AND email_is_sensitive = 'True'``` #### Filter triggers The number of times any active Tessian Enforcer filters have been triggered by outbound emails. ```COUNT WHERE module = 'enforcer' GROUP BY filter_name``` #### Users with the most unauthorized emails detected The number of unauthorized emails sent / attempted to be sent by each user. ```COUNT (DISTINCT message_id) WHERE module = 'enforcer' GROUP BY user``` ### Guardian #### Misdirected emails prevented The number of misdirected emails that Tessian Guardian prevented from being sent by your company’s employees. ```COUNT (DISTINCT message_id) WHERE module = 'guardian' AND misdirected_email_prevented = 'True'``` #### Guardian messages shown to users The number of Tessian Guardian warning messages shown to users. ```COUNT WHERE module = 'guardian' AND (alert_type = 'warn' or alert_type = 'block')``` #### Guardian triggers The number of times that any Tessian Guardian filters were triggered by outbound emails. ```COUNT (DISTINCT message_id) WHERE module = 'guardian'``` #### Users with the most misdirected emails detected The number of misdirected emails that were prevented from being sent by Tessian Guardian per user. ```COUNT (DISTINCT message_id) WHERE module = 'guardian' AND misdirected_email_prevented = 'True' GROUP BY user``` ### Constructor #### Filter triggers (total count) The number of times any active constructor filters were triggered in total. ```COUNT WHERE module = 'constructor'``` #### Filter triggers (count per filter) The number of times each active constructor filter was triggered. ```COUNT WHERE module = 'constructor' GROUP BY filter_name``` ### Defender #### Malicious emails detected The total number of emails that triggered Tessian Defender and that were classified as ‘malicious’. ```COUNT (DISTINCT message_id) WHERE module = 'defender' AND threat_classification = 'malicious'``` #### Anomalous emails detected The total number of emails that triggered Tessian Defender and that were classified as ‘anomalous’. ```COUNT (DISTINCT message_id) WHERE module = 'defender' AND threat_classification = 'anomalous'``` #### Threat type statistics The total number of emails that triggered Tessian Defender that were classified as being a particular threat type. ```COUNT (DISTINCT message_id) WHERE module = 'defender' AND threat_types CONTAINS 'Domain Impersonation'``` Note: `CONTAINS` means that the value exists in the `threat_types` list. Replace 'Domain Impersonation' with 'Display Name Impersonation', 'Direct Spoof Impersonation', 'Unusual Email', 'Blacklist', 'Account Takeover' to calculate these other stats. 'Unusual Email' is semantically the same as 'Other Phishing', which is used in other parts of the platform. #### Defender warnings shown to users The number of Tessian Defender warnings shown to users. ```COUNT (DISTINCT user, message_id) WHERE module = 'defender' AND user_interaction NOT IN ('warning_message_not_shown', 'warning_message_not_shown_deleted', 'silently_track', 'defender_not_enabled')``` #### Confirmed as malicious by users The number of emails that triggered Tessian Defender and were confirmed as malicious by users clicking the “Mark as Malicious” button in the warning message. ```COUNT (DISTINCT user, message_id) WHERE module = 'defender' AND user_interaction = 'marked_as_malicious'``` #### Triggered emails manually deleted by users The number of emails that triggered Tessian Defender and that were subsequently deleted by users. ```COUNT (DISTINCT user, message_id) WHERE module = 'defender' AND user_interaction = 'deleted_email'``` #### Marked as safe by users The number of emails that triggered Tessian Defender but that were subsequently marked as safe by users clicking the “Mark as Safe” button in the warning message. ```COUNT (DISTINCT user, message_id) WHERE module = 'defender' AND user_interaction = 'marked_as_safe'``` #### Most targeted (malicious) The number of emails that Tessian Defender classified as ‘malicious’ received by each user. ```COUNT WHERE module = 'defender' AND threat_classification = 'malicious' GROUP BY user``` #### Most targeted (anomalous) The number of emails that Tessian Defender classified as ‘anomalous’ received by each user. ```COUNT WHERE module = 'defender' AND threat_classification = 'anomalous' GROUP BY user``` #### Most impersonated address The internal addresses that Tessian Defender identified as being the most impersonated. ```COUNT WHERE module = 'defender' AND impersonated_address != '' AND impersonation_type = 'internal' GROUP BY impersonated_address``` #### Most impersonated domain The domains that Tessian Defender identified as being the most impersonated. ```COUNT WHERE module = 'defender' AND impersonated_domain != '' GROUP BY impersonated_domain``` ## Query parameters - `start_date` string, date - `after_checkpoint` string - `limit` integer ## Response `200` Request was successfully processed - object - `status` integer — The HTTP status of the response - `has_more` boolean — True if there are more triggers that can be immediately retrieved. - `data` union[] — The list of triggers. - union - GuardianTrigger — Represents a trigger for one of the outbound modules - `module` 'guardian' — The module name - `filter_name` string — Name of the filter that was triggered - `user` string, email — The individual user account protected by Tessian - `timestamp` string, date-time — The date and time of the email, in UTC. This is the time that the email was sent (for inbound emails) or the time that the user attempted to send it (in the case of outbound emails). For more detailed documentation and format description, refer to [Timestamp](#section/Timestamps). - `recipients` string[] — All recipients of the email. - `to_recipients` string[] — to: recipients of the email. - `cc_recipients` string[] — cc: recipients of the email. - `bcc_recipients` string[] — bcc: recipients of the email. - `subject` string — The subject line of the email. - `message_id` string, uuid — The identifier assigned to each email - `number_of_attachments` integer — The total number of attachments in the email. - `attachments_total_size` number, float — The total size of all attachments, in megabytes. - `attachments` Attachment[] — Details of each attachment - `attachment` string — Name of the attachment - `encrypted` boolean — Is the attachment encrypted - `message_shown_to_user` string — The Tessian warning message that was shown to the user. If 'alert_type' is set to 'silent' or 'quarantine', then this is the message that **would** have been shown to the user, if it was set to 'warn' or 'block'. - `updated_at` string, date-time — The date and time when this trigger was last modified, in UTC. - `trigger_id` string — Uniquely idenfies this trigger, across multiple updates. You should dedupe the triggers returned by this API by their trigger_id, keeping only the last row (by updated_at time). The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically. - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only triggers that have been modified after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering triggers. - `links` Links — Contains URLs that are associated with this event. - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed. - `priority` number, nullable — A heuristic value that indicates how confident Tessian Guardian is that this trigger represents a risky event (closer to 1 represents higher confidence). - `alert_type` 'block' | 'silent' | 'warn' | 'quarantine' — The type of trigger response set by the administrator. - `initial_response` string — How the user responded to the Tessian warning message (if it was shown). - `subsequent_action` string — The user's subsequent action after responding to the Tessian warning message (if any). - `changes_made` string — Changes made to the email (if it was initally not sent, but subsequently sent with changes). - `final_outcome` string — The final outcome of the email. - `salutation_extracted` string — The salutation used by the sender in the triggered email. - `project_identifiers` string[] — Any terms present that could refer to a project / potentially sensitive information. - `check_performed_by` 'Tessian Add-in' | 'Tessian Gateway' | 'Tessian Office Add-in' — Whether the check was performed via the Tessian Add-in, Tessian Gateway, or Tessian Office Add-in. - `tracking_id` string — The value of the x-ts-tracking-id field in the email (or an empty string if none). - `guardian_event_type` 'misdirected_email' | 'misattached_file' — The type of the guardian trigger event. - `misdirected_email_prevented` boolean — True if Guardian prevented this email from being sent due to being flagged as misdirected. - `flag_reason` string — The reason that Guardian flagged this email as being misdirected. - `anomalous_recipient` string — The recipient email address that Guardian has identified as being a possible mistake. - `suggested_recipient` string — The recipient that Guardian thinks the user should be sending the email to, based on the user's historical relationship with the suggested recipient. - `misattached_file_prevented` boolean — True if Guardian prevented this email from being sent due to being flagged as having a misattached file. - `misattached_file_reasons` string[] — The reasons that Guardian thinks this email has misattached files. - `anomalous_attachments` string[] — The email attachment names that Guardian has identified as being misattached. - EnforcerTrigger — Represents a trigger for one of the outbound modules - `module` 'enforcer' — The module name - `filter_name` string — Name of the filter that was triggered - `user` string, email — The individual user account protected by Tessian - `timestamp` string, date-time — The date and time of the email, in UTC. This is the time that the email was sent (for inbound emails) or the time that the user attempted to send it (in the case of outbound emails). For more detailed documentation and format description, refer to [Timestamp](#section/Timestamps). - `recipients` string[] — All recipients of the email. - `to_recipients` string[] — to: recipients of the email. - `cc_recipients` string[] — cc: recipients of the email. - `bcc_recipients` string[] — bcc: recipients of the email. - `subject` string — The subject line of the email. - `message_id` string, uuid — The identifier assigned to each email - `number_of_attachments` integer — The total number of attachments in the email. - `attachments_total_size` number, float — The total size of all attachments, in megabytes. - `attachments` Attachment[] — Details of each attachment - `attachment` string — Name of the attachment - `encrypted` boolean — Is the attachment encrypted - `message_shown_to_user` string — The Tessian warning message that was shown to the user. If 'alert_type' is set to 'silent' or 'quarantine', then this is the message that **would** have been shown to the user, if it was set to 'warn' or 'block'. - `updated_at` string, date-time — The date and time when this trigger was last modified, in UTC. - `trigger_id` string — Uniquely idenfies this trigger, across multiple updates. You should dedupe the triggers returned by this API by their trigger_id, keeping only the last row (by updated_at time). The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically. - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only triggers that have been modified after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering triggers. - `links` Links — Contains URLs that are associated with this event. - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed. - `priority` number, nullable — A heuristic value that indicates how confident Tessian Guardian is that this trigger represents a risky event (closer to 1 represents higher confidence). - `alert_type` 'block' | 'silent' | 'warn' | 'quarantine' — The type of trigger response set by the administrator. - `initial_response` string — How the user responded to the Tessian warning message (if it was shown). - `subsequent_action` string — The user's subsequent action after responding to the Tessian warning message (if any). - `changes_made` string — Changes made to the email (if it was initally not sent, but subsequently sent with changes). - `final_outcome` string — The final outcome of the email. - `salutation_extracted` string — The salutation used by the sender in the triggered email. - `project_identifiers` string[] — Any terms present that could refer to a project / potentially sensitive information. - `check_performed_by` 'Tessian Add-in' | 'Tessian Gateway' | 'Tessian Office Add-in' — Whether the check was performed via the Tessian Add-in, Tessian Gateway, or Tessian Office Add-in. - `tracking_id` string — The value of the x-ts-tracking-id field in the email (or an empty string if none). - `unauthorised_recipients` string[] — Recipients Enforcer has identified as being unauthorized, non-business contacts (third-parties, personal email addresses). - `unauthorized_email_prevented` boolean — True if Enforcer prevented this email from being sent. - `email_is_sensitive` boolean — True when Enforcer has identified this email as containing sensitive information. - `request_for_override` boolean, nullable — True when the user requested to override the Enforcer warning and send the email. - `justification_for_override` string — The text that the user typed when requesting to override the Enforcer warning and send the email. - ConstructorTrigger — Represents a trigger for one of the outbound modules - `module` 'constructor' — The module name - `filter_name` string — Name of the filter that was triggered - `user` string, email — The individual user account protected by Tessian - `timestamp` string, date-time — The date and time of the email, in UTC. This is the time that the email was sent (for inbound emails) or the time that the user attempted to send it (in the case of outbound emails). For more detailed documentation and format description, refer to [Timestamp](#section/Timestamps). - `recipients` string[] — All recipients of the email. - `to_recipients` string[] — to: recipients of the email. - `cc_recipients` string[] — cc: recipients of the email. - `bcc_recipients` string[] — bcc: recipients of the email. - `subject` string — The subject line of the email. - `message_id` string, uuid — The identifier assigned to each email - `number_of_attachments` integer — The total number of attachments in the email. - `attachments_total_size` number, float — The total size of all attachments, in megabytes. - `attachments` Attachment[] — Details of each attachment - `attachment` string — Name of the attachment - `encrypted` boolean — Is the attachment encrypted - `message_shown_to_user` string — The Tessian warning message that was shown to the user. If 'alert_type' is set to 'silent' or 'quarantine', then this is the message that **would** have been shown to the user, if it was set to 'warn' or 'block'. - `updated_at` string, date-time — The date and time when this trigger was last modified, in UTC. - `trigger_id` string — Uniquely idenfies this trigger, across multiple updates. You should dedupe the triggers returned by this API by their trigger_id, keeping only the last row (by updated_at time). The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically. - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only triggers that have been modified after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering triggers. - `links` Links — Contains URLs that are associated with this event. - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed. - `priority` number, nullable — A heuristic value that indicates how confident Tessian Guardian is that this trigger represents a risky event (closer to 1 represents higher confidence). - `alert_type` 'block' | 'silent' | 'warn' | 'quarantine' — The type of trigger response set by the administrator. - `initial_response` string — How the user responded to the Tessian warning message (if it was shown). - `subsequent_action` string — The user's subsequent action after responding to the Tessian warning message (if any). - `changes_made` string — Changes made to the email (if it was initally not sent, but subsequently sent with changes). - `final_outcome` string — The final outcome of the email. - `salutation_extracted` string — The salutation used by the sender in the triggered email. - `project_identifiers` string[] — Any terms present that could refer to a project / potentially sensitive information. - `check_performed_by` 'Tessian Add-in' | 'Tessian Gateway' | 'Tessian Office Add-in' — Whether the check was performed via the Tessian Add-in, Tessian Gateway, or Tessian Office Add-in. - `tracking_id` string — The value of the x-ts-tracking-id field in the email (or an empty string if none). - `internal_external` 'internal' | 'external' | 'both' — * "internal" = The email was sent only to internal recipients. * "external" = The email was sent only to external recipients. * "both" = The email was sent both internal and external recipients. - `triggered_recipients` string[] — Any recipients that were identified and subsequently triggered a Constructor filter. - `triggered_keywords` string[] — Any keywords that were identified and subsequently triggered a Constructor filter. - ArchitectTrigger — Represents a trigger for one of the outbound modules - `module` 'architect' — The module name - `filter_name` string — Name of the filter that was triggered - `user` string, email — The individual user account protected by Tessian - `timestamp` string, date-time — The date and time of the email, in UTC. This is the time that the email was sent (for inbound emails) or the time that the user attempted to send it (in the case of outbound emails). For more detailed documentation and format description, refer to [Timestamp](#section/Timestamps). - `recipients` string[] — All recipients of the email. - `to_recipients` string[] — to: recipients of the email. - `cc_recipients` string[] — cc: recipients of the email. - `bcc_recipients` string[] — bcc: recipients of the email. - `subject` string — The subject line of the email. - `message_id` string, uuid — The identifier assigned to each email - `number_of_attachments` integer — The total number of attachments in the email. - `attachments_total_size` number, float — The total size of all attachments, in megabytes. - `attachments` Attachment[] — Details of each attachment - `attachment` string — Name of the attachment - `encrypted` boolean — Is the attachment encrypted - `message_shown_to_user` string — The Tessian warning message that was shown to the user. If 'alert_type' is set to 'silent' or 'quarantine', then this is the message that **would** have been shown to the user, if it was set to 'warn' or 'block'. - `updated_at` string, date-time — The date and time when this trigger was last modified, in UTC. - `trigger_id` string — Uniquely idenfies this trigger, across multiple updates. You should dedupe the triggers returned by this API by their trigger_id, keeping only the last row (by updated_at time). The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically. - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only triggers that have been modified after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering triggers. - `links` Links — Contains URLs that are associated with this event. - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed. - `priority` number, nullable — A heuristic value that indicates how confident Tessian Guardian is that this trigger represents a risky event (closer to 1 represents higher confidence). - `alert_type` 'block' | 'silent' | 'warn' | 'quarantine' — The type of trigger response set by the administrator. - `initial_response` string — How the user responded to the Tessian warning message (if it was shown). - `subsequent_action` string — The user's subsequent action after responding to the Tessian warning message (if any). - `changes_made` string — Changes made to the email (if it was initally not sent, but subsequently sent with changes). - `final_outcome` string — The final outcome of the email. - `salutation_extracted` string — The salutation used by the sender in the triggered email. - `project_identifiers` string[] — Any terms present that could refer to a project / potentially sensitive information. - `check_performed_by` 'Tessian Add-in' | 'Tessian Gateway' | 'Tessian Office Add-in' — Whether the check was performed via the Tessian Add-in, Tessian Gateway, or Tessian Office Add-in. - `tracking_id` string — The value of the x-ts-tracking-id field in the email (or an empty string if none). - `triggered_keywords` string[] — Any keywords that were identified and subsequently triggered an Architect filter. - `justification` string — The 'justification' text that the user entered when choosing to send the email. - `email_is_sensitive` boolean — True when this email contains sensitive information. - `policy_breach_prevented` boolean — True if Architect prevented this email from being sent. - DefenderTrigger — Represents a trigger by the Defender module - `module` 'defender' — The module name - `filter_name` string — Name of the filter that was triggered - `user` string, email — The individual user account protected by Tessian - `timestamp` string, date-time — The date and time of the email, in UTC. This is the time that the email was sent (for inbound emails) or the time that the user attempted to send it (in the case of outbound emails). For more detailed documentation and format description, refer to [Timestamp](#section/Timestamps). - `recipients` string[] — All recipients of the email. - `to_recipients` string[] — to: recipients of the email. - `cc_recipients` string[] — cc: recipients of the email. - `bcc_recipients` string[] — bcc: recipients of the email. - `subject` string — The subject line of the email. - `message_id` string, uuid — The identifier assigned to each email - `number_of_attachments` integer — The total number of attachments in the email. - `attachments_total_size` number, float — The total size of all attachments, in megabytes. - `attachments` Attachment[] — Details of each attachment - `attachment` string — Name of the attachment - `encrypted` boolean — Is the attachment encrypted - `message_shown_to_user` string — The Tessian warning message that was shown to the user. If 'alert_type' is set to 'silent' or 'quarantine', then this is the message that **would** have been shown to the user, if it was set to 'warn' or 'block'. - `updated_at` string, date-time — The date and time when this trigger was last modified, in UTC. - `trigger_id` string — Uniquely idenfies this trigger, across multiple updates. You should dedupe the triggers returned by this API by their trigger_id, keeping only the last row (by updated_at time). The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically. - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only triggers that have been modified after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering triggers. - `links` Links — Contains URLs that are associated with this event. - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed. - `threat_classification` 'malicious' | 'anomalous' — Defender analyzes all email communications and classifies them based on each email's perceived danger. The emails representing the most dangerous threats are classified as 'malicious'; other emails are classified as 'anomalous'. - `threat_types` string[] — The type of each attack detected by Defender. 'Unusual Email' is semantically the same as 'Other Phishing', which is used in other parts of the platform. - `threat_details` string[] — Additional information about each extracted threat. This may include information such as the positioning of any threat within the email itself, or which domain was being impersonated. - `user_interaction` 'deleted_email' | 'marked_as_malicious' | 'marked_as_safe' | 'no_action' | 'warning_message_not_shown' | 'marked_as_unsure' | 'marked_as_unsure_and_deleted' | 'defender_not_enabled' | 'silently_track' | 'warning_message_not_shown_deleted' — The action the user took after seeing the Defender warning. (Action tracking is currently only available in the Tessian Outlook Add-in.) - `urls` string[] — The URLs extracted from the email. - `sender_display_name_and_address` string — The email sender's display name and address, as seen by the email's recipients. - `reply_to_address` string — The reply-to address, if specified by the sender. The reply-to address is the email address to which the email will be sent to if a recipient replies to the email. The reply-to address causes the user's reply to go to a different email address, not to the original sender. - `impersonation_type` 'internal' | 'external' | '' — An Internal Impersonation is an impersonation of your organization's domains or employees. An External Impersonation is an impersonation of your external counterparties or suppliers. This field only appears in Display Name, Domain, and Direct Spoof Impersonations. - `impersonated_domain` string — The domain that Defender believes is being impersonated. This field only appears in certain impersonations. - `impersonated_address` string — The email address that Defender believes is being impersonated. This field only appears in certain impersonations. - `header` string — The content of the email header. This is invisible to users, and contains information on the email's sender, the recipient, authentication details, and other information. - `email_summary` string — A summary of the email components that triggered the Defender filter. - `intents` string[] — Intents describe how the potential attacker has tried to deceive the email's recipient. Defender analyzes each email's subject line and body text to determine the attacker's intent. ## Other responses - `400` — There was a problem with the request - `401` — There was a problem with the request - `403` — Invalid token or API is not enabled - `429` — Rate limited - wait a few seconds and try again - `500` — Server error - `503` — Server error - `504` — Server error --- [API](https://skmtc.net/tessian/apis/tessian-api.md) · [All operations](https://skmtc.net/tessian/apis/tessian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tessian/tessian-api/versions/08762fb51cf0/schema)