From ce2faa628be45cb134d687872adf906339cf3e3c Mon Sep 17 00:00:00 2001 From: Kirill Izotov Date: Fri, 25 Sep 2026 16:27:44 +0200 Subject: [PATCH] Use query parameters for schema and SBOM selectors --- docs/8-reference/event-schemas.md | 4 +++- docs/cloud-security/api-reference.md | 2 +- docs/cloud-security/code-security/reference.md | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/8-reference/event-schemas.md b/docs/8-reference/event-schemas.md index fab8b2a11..60a104a5f 100644 --- a/docs/8-reference/event-schemas.md +++ b/docs/8-reference/event-schemas.md @@ -46,7 +46,9 @@ The value is generally the Event Type except for Detections where it is the `cat ### Retrieveing Schema Definition -Retrieving a specific schema definition can be done by doing a `GET` on `api.limacharlie.io/v1/orgs/YOUR-OID/schema/EVENT-TYPE`, where the `EVENT-TYPE` is one of the exact keys returned by the listing API above. +Retrieving a specific schema definition can be done by doing a `GET` on `api.limacharlie.io/v1/orgs/YOUR-OID/schema?name=EVENT-TYPE`, where the `EVENT-TYPE` is one of the exact keys returned by the listing API above. + +URL-encode the `name` query value. Omitting `name` lists available schemas; an empty value is invalid. A prefix such as `name=evt:` returns all matching schemas under a `schemas` map. The legacy `/schema/EVENT-TYPE` path remains available for compatibility. The returned data looks like: diff --git a/docs/cloud-security/api-reference.md b/docs/cloud-security/api-reference.md index 364e7c906..a9400f166 100644 --- a/docs/cloud-security/api-reference.md +++ b/docs/cloud-security/api-reference.md @@ -51,7 +51,7 @@ Shared behaviors: | `GET /ciem/facets` | `{facets}` — identity facet counts. | | `GET /ciem/identities` | `{principals, next_cursor}` — the same per-principal effective-access rows `public-access` carries, but server-filtered and keyset-paginated instead of a top-N. Takes the same selectors as `/ciem/facets`, so the rail's counts always describe the population in the list. Ranked by risk score by default, so a walk that spans a projector rebuild can move a row across the cursor — use it for browsing, and `/inventory` with `type=Identity` and the default `urn` sort for an exact export. | | `GET /ciem/identity?urn=` | `{identity}` — the Identity 360 single-identity rollup for one principal URN: its grants, reachable sensitive resources, access levels, and escalation paths. | -| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/repos/{repo}/sbom`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). | +| `GET /code/repos`, `/code/status`, `/code/capabilities`, `/code/fixes`, `/code/sbom?repo={repo}`, `/code/images`, `/code/image-repos` | Code Security reads: repositories, run status, GitHub capabilities, the dependency fix queue, SBOM links and container images. See [Code Security API routes](code-security/reference.md#api-routes). | | `GET /inventory` | `{resources, next_cursor}`. Filters: `type`, `provider`, `account`, `region`, `q`, `account_unscoped` (drop the account scoping and walk the whole estate), `sort` (`urn`, the default and the safe order for a full walk or export; `risk` with `type=Identity`; `last_seen` with `type=ThirdPartyAsset`), paging. With `type=Identity`, `provider`/`source`, `account`, and `region` become repeatable and the identity cross-filter applies: `kind`, `criticality`, `risk_band`, `mfa` (`on`/`off`/`unknown`), and the tri-state `admin`, `external`, `public`, `disabled`, `crown_jewel`, `can_escalate`, `dormant_90d`, `with_sensitive`. Pages served from the materialized view also carry `served_from` and `data_as_of` (the snapshot's build time) so a client can render "as of" instead of implying live. | | `GET /inventory/facets` | Inventory facet counts by type/account/region. | | `GET /data-security/facets` | `{facets}` — DSPM data-store rollup. | diff --git a/docs/cloud-security/code-security/reference.md b/docs/cloud-security/code-security/reference.md index 7b450f816..5fc6ba39a 100644 --- a/docs/cloud-security/code-security/reference.md +++ b/docs/cloud-security/code-security/reference.md @@ -159,7 +159,7 @@ subscribed to `ext-cloud-security`. | `GET /code/status` | `code status` | Run status per connection. | | `GET /code/capabilities` | `code capabilities` | What each GitHub connection can do, and its webhook status. Optional `repo`. | | `GET /code/fixes` | `code fixes` | Open dependency findings grouped by the upgrade that fixes them. | -| `GET /code/repos/{repo}/sbom` | `code sbom` | A short-lived download link for the repository's SBOM. | +| `GET /code/sbom?repo={repo}` | `code sbom` | A short-lived download link for the repository's SBOM. | | `GET /code/images`, `GET /code/images/{digest}` | | Container images and one image's detail. | | `GET /code/image-repos`, `GET /code/image-repos/facets` | | Image repositories and their filter counts. | | `POST /code/scan` | `code rescan` | Rescan one repository. Body: `{repo, ref?, provider?}`. |