Tools API

Manage tool integrations programmatically, create connections, set visibility, validate credentials, and configure the AWS/Azure bundles.

Base path: /api/v1/tools · Permission resource: tools. Tool IDs are UUIDs. All requests require authentication.

Endpoints

Method	Path	Purpose	Permission
POST	`/tools/`	Create a tool configuration	`tools:create`
GET	`/tools/?tool_type=`	List tools (optionally by type)	`tools:read`
GET	`/tools/{id}`	Get one tool	`tools:read`
PUT	`/tools/{id}`	Update a tool	`tools:update`
PATCH	`/tools/{id}/capabilities`	Update tool capabilities	`tools:update`
DELETE	`/tools/{id}`	Delete a tool	`tools:delete`
GET	`/tools/{type}/schema`	The config schema for a tool type	`tools:read`
GET	`/tools/providers/catalog`	The full provider catalogue	`tools:read`
GET	`/tools/providers/{type}/config-schema`	A provider's config schema	`tools:read`
POST	`/tools/validate-credentials`	Test credentials before saving	authenticated
POST	`/tools/bundles/aws`	Create an AWS bundle	`tools:create`
POST	`/tools/bundles/azure`	Create an Azure bundle	`tools:create`
GET	`/tools/bundles`	List bundles	`tools:read`
GET	`/tools/bundles/{bundleId}`	Get a bundle	`tools:read`
PUT	`/tools/bundles/{bundleId}`	Update a bundle	`tools:update`
PUT	`/tools/bundles/azure/{bundleId}`	Update an Azure bundle	`tools:update`
DELETE	`/tools/bundles/{bundleId}`	Delete a bundle	`tools:delete`

Create a tool

POST /api/v1/tools/: body:

Field	Type	Notes
`name`	string	≤255 chars
`type`	string	the provider type (see below)
`visibility`	object	exactly one of `{ "global": true }`, `{ "tenant": true }`, or `{ "user": "<id>" }`
`credential_data`	object	provider credentials
`config`	object	provider configuration
`description`	string	optional

curl -s -X POST "http://localhost:8000/api/v1/tools/" \
  -H "Authorization: Bearer $CLOUDPEEK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "splunk-prod",
        "type": "splunk",
        "visibility": { "tenant": true },
        "credential_data": { "token": "…" },
        "config": { "host": "https://splunk.internal:8089" }
      }'

Provider types

The type field accepts the supported provider identifiers, including: splunk, opensearch, elasticsearch, github, virustotal, shodan, greynoise, netskope, posthog, nvd, cloudflare, abuseipdb, the aws_* services (e.g. aws_security_hub, aws_guardduty, aws_ssm), the azure_* services, and cloudpeek. Use GET /tools/providers/catalog to see exactly what your deployment supports, and GET /tools/providers/{type}/config-schema for the fields a given provider needs.

Validate credentials first

POST /tools/validate-credentials lets you test a provider's credentials before creating the tool, the same check the Test Connection button performs in the UI.

AWS and Azure bundles

Bundles let you configure cloud credentials once and enable multiple services. Create them with POST /tools/bundles/aws or POST /tools/bundles/azure. A bundle carries credential_data, shared configuration, a services map of the services to enable, and a visibility. Some services require extra fields (for example Azure Sentinel needs a subscription id, resource group and workspace name), the request is validated and tells you what's missing. See Tools & Integrations.

The tool object

A listed tool includes: id (UUID), name, type, visibility, has_credentials (booleans never return the secret itself), config, description, playbook_id, created_at, updated_at.

Tools & Integrations: the UI and provider details.
Incidents API: incidents created from tools that are alert sources.