{"openapi":"3.1.0","info":{"title":"Triage (BYOK) API","version":"0.1.0","description":"Triage (BYOK) lets an AI assistant read your own Triage data through the Triage API with a key you supply (Triage API key). Read-only: 8 tools (list_samples, search_samples, get_sample, get_sample_summary, get_overview_report, list_profiles, get_user_stats, get_org_stats). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-triage.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-triage/docs"},"termsOfService":"https://connectorbay.com/byok-triage/terms"},"servers":[{"url":"https://byok-triage.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-triage/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_samples":{"post":{"operationId":"list_samples","summary":"List analysed samples: the ones you own (default), your organisation's, or the public ones (public cloud only), newest f","description":"List analysed samples: the ones you own (default), your organisation's, or the public ones (public cloud only), newest first, with status, kind, filename and submit time. Use for \"What malware samples did I analyse recently in Triage\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"subset":{"anyOf":[{"enum":["owned","org","public"],"type":"string"},{"type":"null"}],"default":"owned","description":"Which samples: owned (yours), org (your organisation's) or public (public cloud only).","title":"Subset"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many samples to return (default 50, maximum 200).","title":"Limit"},"offset":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque offset taken from the 'next' field of the previous answer; leave out for the first page.","title":"Offset"}},"title":"list_samplesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/search_samples":{"post":{"operationId":"search_samples","summary":"Search analyses with Triage search syntax, for example by hash (sha256:...), family (family:emotet), tag (tag:ransomware","description":"Search analyses with Triage search syntax, for example by hash (sha256:...), family (family:emotet), tag (tag:ransomware), extracted C2 (ip:, domain:, url:) or date range (from:, to:). Operators combine with AND, OR, NOT. Use for \"Which Triage analyses are tagged as emotet\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"query":{"description":"Triage search query, for example 'family:emotet' or 'sha256:abc... AND score:10'.","maxLength":500,"title":"Query","type":"string"}},"required":["query"],"title":"search_samplesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_sample":{"post":{"operationId":"get_sample","summary":"Get one sample: ID, status, kind (file or url), filename, privacy flag and submit time. Use for \"What is the status of T","description":"Get one sample: ID, status, kind (file or url), filename, privacy flag and submit time. Use for \"What is the status of Triage sample 190724-hakvlwz8cx\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"sample_id":{"description":"Sample (analysis) ID as shown in lists and search results, for example '190724-hakvlwz8cx'.","maxLength":64,"title":"Sample Id","type":"string"}},"required":["sample_id"],"title":"get_sampleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_sample_summary":{"post":{"operationId":"get_sample_summary","summary":"Get a short summary of a sample and its analysis tasks: overall score (1 to 10), hashes, creation and completion time, a","description":"Get a short summary of a sample and its analysis tasks: overall score (1 to 10), hashes, creation and completion time, and per-task status, tags, score and platform. Use for \"Summarise Triage sample 200606-l5dz9871we\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"sample_id":{"description":"Sample (analysis) ID as shown in lists and search results, for example '190724-hakvlwz8cx'.","maxLength":64,"title":"Sample Id","type":"string"}},"required":["sample_id"],"title":"get_sample_summaryArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_overview_report":{"post":{"operationId":"get_overview_report","summary":"Get the one-page overview report of a sample: hashes, overall score, malware families, tags, per-target signatures and i","description":"Get the one-page overview report of a sample: hashes, overall score, malware families, tags, per-target signatures and indicators (URLs, domains, IPs). Extracted configuration and credential blocks are not returned. Use for \"Show the Triage overview report for sample 200916-w52vg1yl1a\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"sample_id":{"description":"Sample (analysis) ID as shown in lists and search results, for example '190724-hakvlwz8cx'.","maxLength":64,"title":"Sample Id","type":"string"}},"required":["sample_id"],"title":"get_overview_reportArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_profiles":{"post":{"operationId":"list_profiles","summary":"List analysis profiles your company has (name, tags, network mode, timeout). Only available to company-managed accounts.","description":"List analysis profiles your company has (name, tags, network mode, timeout). Only available to company-managed accounts. Use for \"Which Triage analysis profiles do we have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many samples to return (default 50, maximum 200).","title":"Limit"},"offset":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque offset taken from the 'next' field of the previous answer; leave out for the first page.","title":"Offset"}},"title":"list_profilesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_user_stats":{"post":{"operationId":"get_user_stats","summary":"Show how many samples your own account has submitted. Use for \"How many samples have I submitted to Triage\".","description":"Show how many samples your own account has submitted. Use for \"How many samples have I submitted to Triage\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_user_statsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_org_stats":{"post":{"operationId":"get_org_stats","summary":"Show how many samples your organisation has submitted in total. Use for \"How many samples has my Triage organisation sub","description":"Show how many samples your organisation has submitted in total. Use for \"How many samples has my Triage organisation submitted\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_org_statsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}