SafeBreach API Docs

SafeBreach's API Documentation Portal

## Sections
• [Welcome to SafeBreach API Documentation](https://developers.safebreach.com/getting-started.md): The SafeBreach API is designed to integrate the SafeBreach platform within your processes and with third-party tools. The API documentation provides a quick start, API usage, use cases, and sample code that will help you better understand the usage of the API services and endpoints. Check out SafeBreach Postman Collections Here Authentication All requests to the SafeBreach API should be authorized using the API key, x-apitoken, and the Account ID. You can find all three in the Administration section under API Keys. Above the API Keys table, you can find the Base URL for your environment and the Account ID needed for most requests. On the right side is the Create API Key button, which generates an x-apitoken. Once you have these keys, you can authenticate any request in the SafeBreach API Portal on the right side of the request. To authenticate your requests : In SafeBreach, select Administration > API Keys. Copy your Account ID and the domain of the Base URL without the scheme and prefix, for example, demo.safebreach.com. Click Create API Key to generate an x-apitoken. The Create API Key dialog box is displayed. In Name , enter a name for the key. You can enter any name that is meaningful for you of the key’s use case, and then click Create . Copy the API token. In the SafeBreach API Portal, open any request. In the request, you must enter the following information: Token : Enter your x-apitoken. base_url : Enter the domain only of your Base URL. account_id : Enter your Account ID. After completing the rest of the request, you can click Try it ! to test the request and if successful, copy a code sample below from the Code Samples area. API Usage This section includes the available endpoints, API structure, content-type header, API key usage, request submission and response, status codes, and error handling when using the SafeBreach API and available endpoints. SafeBreach also provides various Postman samples to get you started. API Structure SafeBreach offers a RESTful-based API that supports JSON format. HTTP methods are described further in the Response and Status Code section. Most SafeBreach endpoints have the following structure: api/{service}/{version}/accounts/{accountId}/{endpoint} service : The name of the service (e.g. config) in the SafeBreach platform that is responsible for managing the endpoints. version : Prefixed with the letter ‘v’ this is the version of the API, e.g. v1. Each module has its version. When a backward compatibility-breaking change is introduced, we bump the API version. Older versions of the API are maintained for a while, and then deprecated. In such a case, a deprecation notice will be sent. accountId : The accountId is your SafeBreach account number. See the Retrieve Account Id section for details. endpoint : The name/path of the endpoint. For more information about the available endpoints, see API Reference. This is an example: api/orch/v4/accounts/{accountId}/queue Content-Type Header The content type header will depend on the HTTP method used: GET : Accept: application/json POST , PUT and DELETE – Content-Type: application/json Using the SafeBreach API Key in a Request All requests to the SafeBreach API should be authorized using the API key in the x-apitoken header and the Account Id in the request endpoint path according to the API Reference. To use the SafeBreach API key in a request : Create an HTTP request. Add the API key and the content type to the request, as follows: x-apitoken : {API key} Content-Type : application/json Add the accountId to the request according to the endpoint. This is a sample request: CURL curl --location --request POST 'https://{management_IP}/api/orch/v4/accounts/{accountId}/queue' --header 'Accept: application/json' --header 'x-apitoken: {api_key}' --header 'Content-Type: application/json' --data-raw '{ "matrix" : { "name" : "Test API predefined plan", "matrixId": 139 }, "force" : false } This is a sample JSON response: JSON { "data": { "runId": "1616996079648.38", "name": "API Test", "queueId": 1616996079648, "filter": { "attackPhase": { "operator": "is", "values": [ 5 ] }, "playbook": { "operator": "is", "values": [ 814 ] }, "simulators": { "operator": "is", "values": [ "1b1f9f6c-a478-4efc-a22d-233faac098b3" ] }, "attackerSimulators": { "operator": "is", "values": [ "1b1f9f6c-a478-4efc-a22d-233faac098b3" ] }, "targetSimulators": { "operator": "is", "values": [ "1b1f9f6c-a478-4efc-a22d-233faac098b3" ] }, "bypassProxy": { "operator": "is", "values": [ true ] } } } Error Handling In addition to the HTTP status code, an error object may be sent with more details. The error object has the following fields: message : A message to the developer that explains in more detail what the problem may be. Don’t write code that counts on this string as it may change in future versions. This string is not intended to be displayed to an end-user. sbcode : A unique error code that you can use in your code to display your own message to the user, or to make further decisions. Available values are: min: 700 - a provided value is below the permitted minimum max: 701 - a provided value is above the permitted maximum len: 702 - a provided string is longer than the permitted length isInt: 703 - expected int but received something else notEmpty: 704 - expected a value but received nothing or empty value isIn: 705 - a provided value is not in the allowed set of values unique: 706 - a provided value is not unique resourceNotFound: 707 - could not find the requested value isUuid: 708 - expected uuid but received something else allowNull: 709 - field cannot be null invalidUrl: 710 - provided url is not valid staticParamChanged: 711 - parameter that should not be changed was updated (e.g accountId) invalidLicense: 712 - license is invalid oppositeAttributes: 713 - conflicting attributes were set (e.g. node-set as critical and infiltration) attributeBlocksAssociation: 714 - Illegal association was set (e.g. node-set as infiltration with an asset) weakPassword: 715 - weak password was set. Password doesn’t match: /^(?=. [0-9]) (?=. [a-z])(?=. [A-Z])(?=.*[@#/; accountNameMismatch: 716 - account name does not match the account number blockedPath: 717 - Not in use licenseExpired: 718 - Request was rejected because the account license has expired. Contact SafeBreach to renew your license. connectionRefused: 719 - connection refused oldPasswordMismatch: 720 - old password doesn’t match the provided one when changing the password gatewayTimeout: 721 - timeout error (http error 504) data : A JSON object that points to the specific faulty fields.
• [Create a Scenario](https://developers.safebreach.com/use-cases/create-a-scenario.md): This guide is designed for new users and clients who want to quickly create and execute a scenario in SafeBreach that includes two simulated attacks. ✅ Step 1: Choose Simulators Why this matters: Simulators are the agents that execute attack steps in your scenario. List available simulators Use the following endpoint: GET /api/config/v1/accounts/:accountId/nodes You may add filters like: ?isConnected=true&name=HQ-Simulator Copy relevant simulator IDs You’ll use these in your scenario request inside the attackerFilter . ✅ Step 2: Choose Attacks (Moves) Why this matters: In SafeBreach, attacks are referred to as moves . List available attacks (moves) Use this endpoint: GET /api/content/v2/accounts/:accountId/moves?details=true Filter by criteria like status, category, etc. Example: ?details=true&status=published Take note of each move’s uuid These will be inserted into the scenario steps. ✅ Step 3: Create a Scenario Use the following endpoint : POST /api/config/v2/accounts/:accountId/plans Basic JSON Payload: JSON { "name": "New Scenario", "description": "Runs two critical attacks for validation", "accountId": 123456789, "actions": [ { "id": 1, "type": "multiAttack", "data": { "uuid": "uuid-of-move-1" } }, { "id": 2, "type": "multiAttack", "data": { "uuid": "uuid-of-move-2" } } ], "edges": [ { "from": 1, "to": 2, "condition": true } ] } Optional targeting (add to each step if needed): "attackerFilter": { "operator": "is", "values": ["<simulatorId>"], "name": "simulators" } ✅ Step 4: Execute the Scenario Once the scenario is created, queue it for execution: POST /api/orch/v4/accounts/:accountId/queue Payload : "plan": { "planId": "id-of-the-scenario", "name": "name-of-the-scenario" } 📝 Best Practice Tips Use separate staging simulators for testing. Make sure API tokens are secure and access is scoped. Document scenario intent (use description ) for audit clarity. Scenarios can be reused and extended with more actions and conditions.
• [Run a Scenario](https://developers.safebreach.com/use-cases/run-a-scenario.md): This step-by-step guide walks you through using the SafeBreach API to identify and execute a predefined scenario (plan). ✅ Step 1: List All Scenarios Purpose: Retrieve all available scenarios to choose one to run. Endpoint: GET /api/config/v2/accounts/:accountId/plans?details=false Description: Returns a list of scenarios (plans) for the given account. Query Parameters (optional): details=false (default) - returns basic metadata (ID, name) Set details=true to get full details for all plans ✅ Step 2: Get Scenario by ID Purpose: Retrieve the full configuration of a specific scenario using its ID . Endpoint: GET /api/config/v2/accounts/:accountId/plans/:id Description: Returns complete details of the specified scenario, including steps and filters. ✅ Step 3: Execute the Scenario Purpose: Queue the selected scenario for execution. Endpoint: POST /api/orch/v4/accounts/:accountId/queue Payload Example: "plan": { "planId": "id-of-the-scenario", "name": "name-of-the-scenario" } Response: Confirms execution request; may include queue job or run ID. 📝 Best Practice Tips Ensure the simulator agents are online before executing. Use scenario descriptions to validate the scenario's goal. Use audit logs or execution history to track results and behavior.
• [Get Test Results](https://developers.safebreach.com/use-cases/get-test-results.md): This guide is designed for new users who want to retrieve test execution results, known as test summaries. You can get the planRunId directly from running tests or by listing past summaries. ✅ Step 1: List Test Summaries Why this matters : You need the planRunId to query a specific test result. List all test summaries Use the following endpoint: GET /api/data/v1/accounts/:accountId/testsummaries Optional filters: planId – to filter by a specific scenario status – to narrow by test state sortBy=endTime – to get the latest runs Example : GET /api/data/v1/accounts/12345/testsummaries?size=100&sortBy=endTime Sample Response : JSON [ { "planRunId": "67890", "planId": "abcde", "startTime": "2024-01-15T12:00:00Z", "endTime": "2024-01-15T12:10:00Z", "status": "Completed", "blocked": 24, "notBlocked": 6, "assumedBlocked": 1 } ] What to look for : Copy the relevant planRunId from the response to use in the next step. ✅ Step 2: Retrieve a Specific Test Summary Why this matters : This gives you full details on test execution, including blocked attacks and simulator behavior. Get test summary by planRunId Use this endpoint: GET /api/data/v1/accounts/:accountId/testsummaries/:planRunId Example : GET /api/data/v1/accounts/12345/testsummaries/67890 Sample Response : JSON { "planRunId": "67890", "planName": "Lateral Movement Test", "startTime": "2024-01-15T12:00:00Z", "endTime": "2024-01-15T12:10:00Z", "blocked": 24, "notBlocked": 6, "assumedBlocked": 1, "simulators": [ { "simulatorId": "sim-001", "name": "HQ-Simulator" } ], "matrixId": "matrix-abc", "simulationId": "sim-run-567" } What you get : Blocked / not blocked / assumed blocked counts Start and end times Simulator involvement Matrix and simulation IDs. ✅ Optional: Retrieve Multiple Test Summaries at Once Use case : Bulk analysis or correlation across several test executions. Endpoint : GET /api/data/v1/accounts/:accountId/detailedTestSummaries?planRunIds=id1|id2|id3 Example : GET /api/data/v1/accounts/12345/detailedTestSummaries?planRunIds=67890|12345|23456 Sample Response : JSON [ { "planRunId": "67890", "planName": "Lateral Movement Test", "blocked": 24, "notBlocked": 6 }, { "planRunId": "12345", "planName": "Phishing Simulation", "blocked": 12, "notBlocked": 8 } ] 📝 Best Practice Tips Sort summaries by endTime to identify the most recent test. Save commonly used planRunIds for faster future access. Use metadata tagging or descriptions in your test plans for easier identification.
• [Create a Custom Attack](https://developers.safebreach.com/use-cases/create-a-custom-attack.md): Create, validate, publish, and maintain your breach‑simulation method (Python or PCAP). ✅ Step 0 – Prerequisites Title Description Title Item Notes API Key & Account ID Find them in Administration → API Keys Base URL SaaS: https://companyName.safebreach.com ; on‑prem: your console URL Auth header Authorization: Bearer <API‑KEY> OR x-apitoken: <API-KEY> Content‑Type multipart/form-data for uploads, application/json for reads ✅ Step 1 – Validate Your Script Why this matters: Creating attacker/target scripts are the first step you need to take using SafeBreach SDK documentation. you can find examples here . SafeBreach rejects files that are too large, missing metadata or the wrong class. Endpoint - Validate method file PUT /api/content/v1/accounts/:accountId/customMethods/validate Required fields file – the attacker or target script class – python or pcap optional metaData – JSON key/values Example CURL curl -X PUT "$BASE_URL/api/content/v1/accounts/$ACCOUNT_ID/customMethods/validate" \ -H "Authorization: Bearer $API_KEY" \ -F "file=@attacker.py" \ -F "class=python" \ -F 'metaData={"author":"alice"}' If the JSON response contains "valid": true , continue; otherwise fix the script and re‑validate. ✅ Step 2 – Create the Method (Draft) Why this matters: A draft lets you test safely before production. Endpoint - Create new custom method POST /api/content/v1/accounts/:accountId/customMethods Example CURL curl -X POST "$BASE_URL/api/content/v1/accounts/$ACCOUNT_ID/customMethods" \ -H "Authorization: Bearer $API_KEY" \ -F "name=Domain Discovery via AXFR" \ -F "methodType=1" # 0‑exfil, 1‑lateral, 2‑infil, 5‑hostlevel \ -F "class=python" \ -F "status=draft" \ -F "description=Attempts zone‑transfer against internal DNS" \ -F "attackerFile=@attacker.py" \ -F "targetFile=@target.py" ✅ Step 3 – Iterate & Update (Optional) Need to change timeout, scripts or metadata? Use PUT . Endpoint - Update custom method PUT /api/content/v1/accounts/:accountId/customMethods/:id Example CURL curl -X PUT "$BASE_URL/api/content/v1/accounts/$ACCOUNT_ID/customMethods/$METHOD_ID" \ -H "Authorization: Bearer $API_KEY" \ -F "status=draft" \ -F "attackerFile=@fixed_attacker.py" ✅ Step 4 – Publish Set status=published in a final PUT (same endpoint as Step 3). The method appears in Library → My Methods for all scenario designers. ✅ Step 5 – Verify or List Methods Single method : GET …/customMethods/:id All drafts/published : GET …/customMethods?status=draft|published ✅ Step 6 – Download Script (Optional) Retrieve stored script files for audit: GET /api/content/v1/accounts/:accountId/customMethods/:id/files/:fileName ✅ Step 7 – Delete (Cleanup) Remove a method and its files. Endpoint - Delete custom method DELETE /api/content/v1/accounts/:accountId/customMethods/:id Example CURL curl -X DELETE "$BASE_URL/api/content/v1/accounts/$ACCOUNT_ID/customMethods/$METHOD_ID" \ -H "Authorization: Bearer $API_KEY" 📝 Best Practice Tips Title Description Do Why Validate every file before uploading Catches syntax & size issues early Use staging simulators to test drafts Prevents noisy alerts in production Keep method names unique and descriptive Avoids 409 Conflict errors Limit API tokens and rotate regularly Minimises security exposure Document purpose in the description Aids audit & collaboration Increase timeout only when necessary Short runs speed up CI pipelines
• [Simulators](https://developers.safebreach.com/environment/simulators.md): A **Simulator,** also known as a node or agent, is deployed within a network that executes simulated breach and attack scenarios. It collects data from these simulations to assess security postures and identify vulnerabilities.
  • [Return simulator list](https://developers.safebreach.com/environment/simulators/return-simulator-list.md): Return the list of all nodes(agents), both active and inactive
  • [Return simulator details](https://developers.safebreach.com/environment/simulators/return-simulator-details.md): Return simulator details
  • [Create new simulator](https://developers.safebreach.com/environment/simulators/create-new-simulator.md): Create a new remote node, for use when the node can't access it self to the system and the connection needs to be initiated from the system to the node
  • [Update simulator](https://developers.safebreach.com/environment/simulators/update-simulator.md): Update a node. Only the details provided will be updated.
  • [Delete simulator](https://developers.safebreach.com/environment/simulators/delete-simulator.md): Deletes a node from the system
  • [Return simulator list bulk](https://developers.safebreach.com/environment/simulators/return-simulator-list-bulk.md): Return the list of all nodes(agents), both active and inactive
  • [Return simulator aggregation](https://developers.safebreach.com/environment/simulators/return-simulator-aggregation.md): Return the nodes aggregations by specific column
  • [Return associated users list for simulator](https://developers.safebreach.com/environment/simulators/return-associated-users-list-for-simulator.md): Return the list of simulation users available on a given node
  • [Return associated proxies list for simulator](https://developers.safebreach.com/environment/simulators/return-associated-proxies-list-for-simulator.md): List the proxies associated with/connected to a simulator (aka node/agent)
  • [Return associated assets list for simulator](https://developers.safebreach.com/environment/simulators/return-associated-assets-list-for-simulator.md): Return the list of assets available on a given node
  • [Associate user with a simulator](https://developers.safebreach.com/environment/simulators/associate-user-with-a-simulator.md): Add a simulation user to an existing node
  • [Associate proxy with simulator](https://developers.safebreach.com/environment/simulators/associate-proxy-with-simulator.md): Add a proxy to a simulator (aka node/agent)
  • [Associate asset with simulator](https://developers.safebreach.com/environment/simulators/associate-asset-with-simulator.md): Add an asset to an existing node. Once the asset is in the node the system will try to exfiltrate the asset from there
  • [Delete associated proxy with simulator](https://developers.safebreach.com/environment/simulators/delete-associated-proxy-with-simulator.md): Delete a proxy association from a node
  • [Delete associated impersonated users with simulator](https://developers.safebreach.com/environment/simulators/delete-associated-impersonated-users-with-simulator.md): Delete a simulation user from a node will stop running simulations as this user from the node
  • [Delete associated asset from simulator](https://developers.safebreach.com/environment/simulators/delete-associated-asset-from-simulator.md): Delete an asset from a node will stop running exfiltrations from the node with the asset
  • [Enable advanced action on simulator](https://developers.safebreach.com/environment/simulators/enable-advanced-action-on-simulator.md): Enables an Advanced Action for a node. This will allow running attacks tagged with this Advanced Action"
  • [Disable advanced action on simulator](https://developers.safebreach.com/environment/simulators/disable-advanced-action-on-simulator.md): Disables an Advanced Action for a node. This will prevent running attacks tagged with this Advanced Action
  • [Return current secret](https://developers.safebreach.com/environment/simulators/return-current-secret.md): Return the currently used secret, if one does not exist, create a new random secret and return it.
  • [Create new random secret](https://developers.safebreach.com/environment/simulators/create-new-random-secret.md): Create a new random secret.
• [Proxies](https://developers.safebreach.com/environment/proxies.md): A **Proxy** in SafeBreach facilitates connectivity for simulators that require indirect access to the platform, typically in segmented or remote environments.
  • [Return proxy list](https://developers.safebreach.com/environment/proxies/return-proxy-list.md): Return a list of proxies that has been configured in the system
  • [Return proxy details](https://developers.safebreach.com/environment/proxies/return-proxy-details.md): Retrieves proxy details
  • [Create new proxy](https://developers.safebreach.com/environment/proxies/create-new-proxy.md): Creates a new proxy configuration. The system uses the proxy to perform simulations and test the network
  • [Update proxy](https://developers.safebreach.com/environment/proxies/update-proxy.md): Updates a proxy
  • [Delete proxy](https://developers.safebreach.com/environment/proxies/delete-proxy.md): Delete proxy and stop using it to run simulations
  • [Return proxy's simulator list](https://developers.safebreach.com/environment/proxies/return-proxy-s-simulator-list.md): Return the list of simulators (aka nodes or agents) that are configured to use this proxy
  • [Associate simulator with proxy](https://developers.safebreach.com/environment/proxies/associate-simulator-with-proxy.md): Add simulators (aka nodes/agents) to an existing proxy
  • [Delete simulator association to proxy](https://developers.safebreach.com/environment/proxies/delete-simulator-association-to-proxy.md): Delete a node from association proxy
  • [Test connection for the proxy](https://developers.safebreach.com/environment/proxies/test-connection-for-the-proxy.md): Performs a test that connects the simulators via the proxy on the provided port. If a normal payload passes successfully, the test will succeed
  • [Test proxy connection](https://developers.safebreach.com/environment/proxies/test-proxy-connection.md): Performs a test that connects the simulators via the stored proxy’s details. If the details of the proxy are different, the test will override the stored details.
• [Impersonated Users](https://developers.safebreach.com/environment/impersonated-users.md): The Impersonated Users object tracks users whose credentials or roles are used by simulators to perform actions as part of attack simulations. This is critical for validating privilege escalation, lateral movement, and identity-based attack scenarios.
  • [Return impersonated user list](https://developers.safebreach.com/environment/impersonated-users/return-impersonated-user-list.md): Provide the list of impersonated users that have been configured to participate in simulations.
  • [Add impersonated user](https://developers.safebreach.com/environment/impersonated-users/add-impersonated-user.md): Add a new user to the setup for simulations and network testing
  • [Update impersonated user](https://developers.safebreach.com/environment/impersonated-users/update-impersonated-user.md): Update an impersonated user.
  • [Delete impersonated user](https://developers.safebreach.com/environment/impersonated-users/delete-impersonated-user.md): Remove an impersonated user. Simulations will stop running with it.
  • [Add nodes to an impersonated user](https://developers.safebreach.com/environment/impersonated-users/add-nodes-to-an-impersonated-user.md): Add nodes to an existing impersonated user
  • [Get impersonation user's nodes](https://developers.safebreach.com/environment/impersonated-users/get-impersonation-user-s-nodes.md): Return the list of nodes configured to use this impersonated user
  • [Delete a node from an impersonated user](https://developers.safebreach.com/environment/impersonated-users/delete-a-node-from-an-impersonated-user.md): Delete a node from an impersonated user will stop running simulations as this user on this node
  • [Test connection for existing impersonated user](https://developers.safebreach.com/environment/impersonated-users/test-connection-for-existing-impersonated-user.md): Test connection for existing impersonated user
  • [Test connection for impersonated user](https://developers.safebreach.com/environment/impersonated-users/test-connection-for-impersonated-user.md): Test connection for impersonated user.
  • [Show an impersonated user's details](https://developers.safebreach.com/environment/impersonated-users/show-an-impersonated-user-s-details.md): Provide the details about an impersonated user.
• [Advanced Actions](https://developers.safebreach.com/environment/advanced-actions.md): Advanced Actions define specialized behaviors or operations that a simulator can execute in conjunction with standard attack scenarios. These may include custom scripts, extended attack simulations, or orchestrated sequences targeting specific environments.
  • [Return Advanced Actions list](https://developers.safebreach.com/environment/advanced-actions/return-advanced-actions-list.md): Return the list of Advanced Actions in the system
  • [Return Advanced Action](https://developers.safebreach.com/environment/advanced-actions/return-advanced-action.md): Return an Advanced Action
  • [Set Advanced Action](https://developers.safebreach.com/environment/advanced-actions/set-advanced-action.md): set configuration for an Advanced Action
• [Virtual Nodes](https://developers.safebreach.com/environment/virtual-nodes.md): Virtual Nodes are Mailboxes, Cloud Attacks (cloud integration), Web Applications used as attack entities
  • [Get the virtual node list](https://developers.safebreach.com/environment/virtual-nodes/get-the-virtual-node-list.md): Return the list of all virtual nodes(simulators), both active and inactive
  • [Return virtual node details](https://developers.safebreach.com/environment/virtual-nodes/return-virtual-node-details.md): Return details about a virtual simulator, including if it's defined as a critical asset, and its external IP
  • [Create a new virtual node](https://developers.safebreach.com/environment/virtual-nodes/create-a-new-virtual-node.md): Create a new virtual node
  • [Delete virtual node](https://developers.safebreach.com/environment/virtual-nodes/delete-virtual-node.md): Deletes a node from the system
  • [Update virtual node](https://developers.safebreach.com/environment/virtual-nodes/update-virtual-node.md): Update a node. Only the details provided will be updated.
  • [Test virtual node connection](https://developers.safebreach.com/environment/virtual-nodes/test-virtual-node-connection.md): test the connection to the virtual node with the given configuration
  • [Test the connection to a virtual node with the given configuration](https://developers.safebreach.com/environment/virtual-nodes/test-the-connection-to-a-virtual-node-with-the-given-configuration.md): test the connection to a virtual node with the given configuration
  • [Generate verification code](https://developers.safebreach.com/environment/virtual-nodes/generate-verification-code.md): Will generate verification code for the provided node
• [Data Assets](https://developers.safebreach.com/environment/data-assets.md): A Data Asset in SafeBreach refers to data used in exfiltration simulations, which can be default or custom data types representing information such as credit card numbers, SSN, physical addresses, and more. Custom data assets can be defined to make simulations more realistic and represent organizational data. These assets are assigned to simulators and used during simulation runs to simulate data exfiltration and other breach scenarios.
  • [Return asset list](https://developers.safebreach.com/environment/data-assets/return-asset-list.md): Returns a list of the all the assets supported by the system
  • [Return asset details](https://developers.safebreach.com/environment/data-assets/return-asset-details.md): Return details about an existing asset, including whether it's enabled and the data values included
  • [Create new asset](https://developers.safebreach.com/environment/data-assets/create-new-asset.md): Creates an asset. Asset can be either a predefined asset supported by the system or a custom one. In case of a custom asset, the payload should be set by the /rawData update API
  • [Update asset](https://developers.safebreach.com/environment/data-assets/update-asset.md): Update an asset. Only the provided details will be updated.
  • [Delete asset](https://developers.safebreach.com/environment/data-assets/delete-asset.md): Deletes an asset, and will no longer be transferred between nodes as part of the moves
  • [Return asset's simulators](https://developers.safebreach.com/environment/data-assets/return-asset-s-simulators.md): Return a list of node that have a specific asset
  • [Update asset file](https://developers.safebreach.com/environment/data-assets/update-asset-file.md): Update an asset raw data. Can be used to pass binary data. This is available for asset with type custom only.
  • [Return custom asset file](https://developers.safebreach.com/environment/data-assets/return-custom-asset-file.md): Get custom asset file
• [Deployments](https://developers.safebreach.com/environment/deployments.md): A Deployment object represents a structured grouping or environment in which simulators are organized. It is often used to segment simulators by geography, business unit, or purpose (e.g., production vs staging).
  • [Return deployment list](https://developers.safebreach.com/environment/deployments/return-deployment-list.md): Provide the list of deployments which group simulators.
  • [Return deployment details](https://developers.safebreach.com/environment/deployments/return-deployment-details.md): Provide the details about a deployment.
  • [Create new deployment](https://developers.safebreach.com/environment/deployments/create-new-deployment.md): Add a deployment
  • [Update deployment](https://developers.safebreach.com/environment/deployments/update-deployment.md): Update a deployment.
  • [Delete deployment](https://developers.safebreach.com/environment/deployments/delete-deployment.md): Remove a deployment. Simulations will stop running with it.
• [Integrations](https://developers.safebreach.com/environment/integrations.md): Integrations in SafeBreach enable connectivity with third-party products to enhance security automation, visibility, and control. Supported integration types include Custom Integrations, SIEM, Security Controls, Threat Intelligence, Workflow & Automation, and Privileged Access Management (PAM) systems. These integrations allow automatic correlation of simulated attacks with real-world events, enabling streamlined and automated security operations.
  • [Get All Installed Integrations](https://developers.safebreach.com/environment/integrations/get-all-installed-integrations.md): Retrieves all installed integrations for the specified account.
  • [Update Installed Integration](https://developers.safebreach.com/environment/integrations/update-installed-integration.md): Updates the configuration of an installed integration for the specified account and integration ID.
  • [Delete Installed Integration](https://developers.safebreach.com/environment/integrations/delete-installed-integration.md): Deletes the installed integration for the specified account and integration ID.
  • [Test Connection](https://developers.safebreach.com/environment/integrations/test-connection.md): Test connection to all configured integrations
  • [Test Connection By Id](https://developers.safebreach.com/environment/integrations/test-connection-by-id.md): Test Connection to a specific integration by Integration Id
  • [Get Global Config](https://developers.safebreach.com/environment/integrations/get-global-config.md): Get all integrations' global configurations
  • [Set Global Config](https://developers.safebreach.com/environment/integrations/set-global-config.md): Set integrations' global configurations
  • [Get All Available Integrations](https://developers.safebreach.com/environment/integrations/get-all-available-integrations.md): Retrieves all available integrations for the specified account.
  • [Export Parsers](https://developers.safebreach.com/environment/integrations/export-parsers.md): Exports the full configuration of one or more custom parsers by name. Never exports default (built-in) parsers or drafts. The response `result` is an envelope `{ version, exportedAt, parsers: [...] }` (`version` is `1.0`; `exportedAt` is a server-generated ISO-8601 timestamp) so it can be pasted verbatim as the import endpoint's request body.
  • [Import Parsers](https://developers.safebreach.com/environment/integrations/import-parsers.md): Imports one or more parsers as custom parsers, appended after existing parsers in priority order. All-or-nothing; fails closed on name conflicts unless override is set, and always rejects a collision with the caller's in-progress draft.
• [Scenarios](https://developers.safebreach.com/attack/scenarios.md): A Scenario , also known as a Plan, is a predefined sequence of attacks, grouped in steps to simulate real-world threat behaviors. It helps validate defense effectiveness against multi-stage attacks such as ransomware campaigns or lateral movement.
  • [Return scenario list](https://developers.safebreach.com/attack/scenarios/return-scenario-list.md): Return a list of all plans defined in the system
  • [Return scenario details](https://developers.safebreach.com/attack/scenarios/return-scenario-details.md): Return the details about the given plan id.
  • [Create new scenario](https://developers.safebreach.com/attack/scenarios/create-new-scenario.md): Create a new scenario. An empty parameter indicates that all values for that parameter are included.
  • [Update scenario](https://developers.safebreach.com/attack/scenarios/update-scenario.md): Update plan. Only the provided details will be updated.
  • [Delete scenario](https://developers.safebreach.com/attack/scenarios/delete-scenario.md): Delete a scenario
  • [Return count of expected simulations for a scenario](https://developers.safebreach.com/attack/scenarios/return-count-of-expected-simulations-for-a-scenario.md): Return count of expected simulations for a scenario
  • [Delete plan](https://developers.safebreach.com/attack/scenarios/v1-deprecated/delete-plan.md): Deprecated since 01/01/2025
  • [Update plan](https://developers.safebreach.com/attack/scenarios/v1-deprecated/update-plan.md): Update matrix. Only the provided details will be updated.
  • [Get plan details](https://developers.safebreach.com/attack/scenarios/v1-deprecated/get-plan-details.md): Return the details about the given matrix id.
  • [Return plan list](https://developers.safebreach.com/attack/scenarios/v1-deprecated/return-plan-list.md): Return a list of all matrices defined in the system
  • [Create new plan](https://developers.safebreach.com/attack/scenarios/v1-deprecated/create-new-plan.md): Create a new matrix. If the parameters are left empty it means all. For example running a specific move on all the nodes with all the assets, the matrix should contain only the move in the move ids property
• [Playbook / Content](https://developers.safebreach.com/attack/playbook-content.md): The Playbook is a repository of curated attacks, involving parameters, and offering remediation guidance.
  • [Attacks](https://developers.safebreach.com/attack/playbook-content/attacks.md): An Attack , also known as a Move, is an object that represents an individual tactic or technique modeled in SafeBreach. Each attack simulates a specific action an adversary might take (for example, DLL injection and brute-force). A single attack may involve multiple simulations, based on its parameters.
    • [Return attack details](https://developers.safebreach.com/attack/playbook-content/attacks/return-attack-details.md): Return a specific attack from the playbook using attack id
    • [Create new attack](https://developers.safebreach.com/attack/playbook-content/attacks/create-new-attack.md): This API will create a new custom attack. We recommend using the Clone attack endpoint for creating a new attack based on an existing one.
    • [Update attack details](https://developers.safebreach.com/attack/playbook-content/attacks/update-attack-details.md): This API allows editing an existing custom attack's details and parameters
    • [Delete attack](https://developers.safebreach.com/attack/playbook-content/attacks/delete-attack.md): Delete a list of custom attacks or single custom attack. It can delete custom attack using the move id or the move source.
    • [Return attack list](https://developers.safebreach.com/attack/playbook-content/attacks/return-attack-list.md): Returns a list of all attacks in the attack playbook. Note: the total number of attacks can be large, which may result in a correspondingly large response.
    • [Clone attack](https://developers.safebreach.com/attack/playbook-content/attacks/clone-attack.md): This API has two capabilities, to create or to update. update move that exists in the knowledge base or in the local DB. In both case the update object should contain the data that needs to be updated including move json.
    • [Get custom tags for an attack](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/get-custom-tags-for-an-attack.md): Returns the custom tags (TAG_CUSTOM_TAGS) for a specific move/attack.
    • [Add custom tags to an attack](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/add-custom-tags-to-an-attack.md): Append new custom tags to a move/attack without affecting existing tags.
    • [Update (rename) a custom tag on an attack](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/update-rename-a-custom-tag-on-an-attack.md): Rename an existing custom tag value on a move/attack.
    • [Delete custom tags from an attack](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/delete-custom-tags-from-an-attack.md): Remove specific custom tags from a move/attack by value.
    • [Add custom tags to multiple attacks](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/add-custom-tags-to-multiple-attacks.md): Append custom tags to multiple moves/attacks in a single request.
    • [Update (rename) a custom tag on multiple attacks](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/update-rename-a-custom-tag-on-multiple-attacks.md): Rename an existing custom tag value on multiple moves/attacks in a single request.
    • [Delete custom tags from multiple attacks](https://developers.safebreach.com/attack/playbook-content/attacks/custom-tags/delete-custom-tags-from-multiple-attacks.md): Remove custom tags from multiple moves/attacks in a single request.
    • [get move](https://developers.safebreach.com/attack/playbook-content/attacks/get-move.md): This API has two capabilities, to create or to update. update move that exists in the knowledge base or in the local DB. In both case the update object should contain the data that needs to be updated including move json.
  • [Custom Methods](https://developers.safebreach.com/attack/playbook-content/custom-methods.md): A Custom Method is a user-defined attack or variation of a built-in attack. These are typically developed to match environment-specific behaviors or to test novel threat techniques.
    • [Return custom method details](https://developers.safebreach.com/attack/playbook-content/custom-methods/return-custom-method-details.md): Returns details for a custom breach method
    • [Create new custom method](https://developers.safebreach.com/attack/playbook-content/custom-methods/create-new-custom-method.md): This API will create a new custom method depending on its type
    • [Update custom method](https://developers.safebreach.com/attack/playbook-content/custom-methods/update-custom-method.md): This API will update the current method to the provided method. It won't perform partial updates.
    • [Delete custom method](https://developers.safebreach.com/attack/playbook-content/custom-methods/delete-custom-method.md): Delete a custom method entry and associated files.
    • [Validate method file](https://developers.safebreach.com/attack/playbook-content/custom-methods/validate-method-file.md): Validate method script based on class
    • [Return custom method file](https://developers.safebreach.com/attack/playbook-content/custom-methods/return-custom-method-file.md): Get method python file
    • [Return custom method list](https://developers.safebreach.com/attack/playbook-content/custom-methods/return-custom-method-list.md): Returns a list of all user defined custom methods in the system.
  • [Feeds](https://developers.safebreach.com/attack/playbook-content/feeds.md): Feeds input external intelligence data (for example, threat indicators and IOCs) into the SafeBreach platform to enrich simulations or correlate findings. They are used when customizing or building new attacks with Breach Studio.
    • [Return feed details](https://developers.safebreach.com/attack/playbook-content/feeds/return-feed-details.md): Get a specific feed's details
    • [Create feed](https://developers.safebreach.com/attack/playbook-content/feeds/create-feed.md): Create a new user defined feed
    • [Delete feed](https://developers.safebreach.com/attack/playbook-content/feeds/delete-feed.md): Delete a specific feed and all its associated feed records
    • [Return feed list](https://developers.safebreach.com/attack/playbook-content/feeds/return-feed-list.md): Get all user defined feed Ids
    • [Return feed record details](https://developers.safebreach.com/attack/playbook-content/feeds/return-feed-record-details.md): Get details of a user defined feed record
    • [Create feed record](https://developers.safebreach.com/attack/playbook-content/feeds/create-feed-record.md): Create a new user defined feed record associated with an existing feed
    • [Delete feed record](https://developers.safebreach.com/attack/playbook-content/feeds/delete-feed-record.md): Delete a feed record associated with a specific feed id
    • [Return all feed records for feed ID](https://developers.safebreach.com/attack/playbook-content/feeds/return-all-feed-records-for-feed-id.md): Get all user defined feed records associated with the feed Id
• [Schedules](https://developers.safebreach.com/attack/schedules.md): A Schedule defines the timing and recurrence of running attacks from scenarios and sharing dashboards and reports. It allows SafeBreach to automate these tasks at predefined intervals without manual initiation.
  • [Return schedule list](https://developers.safebreach.com/attack/schedules/return-schedule-list.md): Return all schedules that are currently defined in the account
  • [Return schedule details](https://developers.safebreach.com/attack/schedules/return-schedule-details.md): Return an existing schedule's definition and details
  • [Create new schedule](https://developers.safebreach.com/attack/schedules/create-new-schedule.md): Creates a new schedule in the system. Schedule allows the system to run predefined matrices in predefined time. The schedule is defined in cron like format
  • [Update schedule details](https://developers.safebreach.com/attack/schedules/update-schedule-details.md): Update an existing schedule's definition and scenario assignment
  • [Delete schedule](https://developers.safebreach.com/attack/schedules/delete-schedule.md): Delete an existing schedule
  • [Get status if scenario scheduler is paused](https://developers.safebreach.com/attack/schedules/get-status-if-scenario-scheduler-is-paused.md): Get status if scenario scheduler is paused
  • [Pause or resume all scheduled scenarios](https://developers.safebreach.com/attack/schedules/pause-or-resume-all-scheduled-scenarios.md): Pauses or resumes scheduled scenarios (reverts the current status)
• [Queue](https://developers.safebreach.com/attack/queue.md): The Queue represents the sequence of pending tests that were sent to be run, beyond the number of tests that can be run in parallel. As running tests are completed, queued tests are run.
  • [Return running and queued tests](https://developers.safebreach.com/attack/queue/return-running-and-queued-tests.md): Return running and queued tests
  • [Stop and delete a test from queue](https://developers.safebreach.com/attack/queue/stop-and-delete-a-test-from-queue.md): Stop and delete a test from queue
  • [Pause or resume running tests/simulations](https://developers.safebreach.com/attack/queue/pause-or-resume-running-tests-simulations.md): Pause or resume tests or simulations that are currently running (reverts their current status)
  • [Set test position in queue](https://developers.safebreach.com/attack/queue/set-test-position-in-queue.md): Set test position in queue
  • [Add test to processing queue](https://developers.safebreach.com/attack/queue/add-test-to-processing-queue.md): Note: There is a 1000 limit for rerunning simulations.
  • [Clear test queue](https://developers.safebreach.com/attack/queue/clear-test-queue.md): Clear test queue
• [Test Summaries](https://developers.safebreach.com/analyze/test-summaries.md): Test Summaries provide high-level outcome analyses of completed tests, highlighting key results and performance indicators including aggregated outcomes across simulators, attack types, security controls, and more.
  • [Return Test Summary list](https://developers.safebreach.com/analyze/test-summaries/return-test-summary-list.md): Return a list of all test summaries
  • [Return Test Summary](https://developers.safebreach.com/analyze/test-summaries/return-test-summary.md): Return the test summary info for a specific testEndFragment
  • [Update Test Summary](https://developers.safebreach.com/analyze/test-summaries/update-test-summary.md): Update the test summary informationEndFragment
  • [Delete test summary](https://developers.safebreach.com/analyze/test-summaries/delete-test-summary.md): Delete the specified test summary and all the results associated with it
  • [get Detailed Test Summaries](https://developers.safebreach.com/analyze/test-summaries/get-detailed-test-summaries.md): Return all detailed test summaries
• [Returns the executions history results using post](https://developers.safebreach.com/analyze/simulation-results/returns-the-executions-history-results-using-post.md): Returns the executions history results
• [Returns the executions history results](https://developers.safebreach.com/analyze/simulation-results/returns-the-executions-history-results.md): Returns the executions history results
• [Returns the executions of a specific test](https://developers.safebreach.com/analyze/simulation-results/returns-the-executions-of-a-specific-test.md): Returns the executions of the test specified by the id
• [Returns the executions history suggestions](https://developers.safebreach.com/analyze/simulation-results/returns-the-executions-history-suggestions.md): Returns the executions suggestions
• [Returns the executions history suggestions using post](https://developers.safebreach.com/analyze/simulation-results/returns-the-executions-history-suggestions-using-post.md): Returns the executions suggestions
• [Get simulations labels](https://developers.safebreach.com/analyze/simulation-results/get-simulations-labels.md): Returns simulations labels
• [Drift by Security Control](https://developers.safebreach.com/analyze/simulation-results/drift-analysis/drift-by-security-control.md): Use this endpoint to query tracking IDs whose status transitions match specific drift patterns within a defined time window. It is designed for detection and mitigation workflows, allowing you to isolate regressions or improvements, scope results by a security control, and control how strictly transitions are matched (contains vs. starts/ends). #### **Filters:** It is highly recommended to use a narrow time window and apply filters, as this can significantly improve response time and reduce payload size. - **securityControl** (string, required): The security control to scan. - **windowStart** (string, ISO-8601 UTC, optional): Start of the search window. Default is 7 days before `windowEnd`. - **windowEnd** (string, ISO-8601 UTC, optional): End of the search window. Default is now. - **earliestSearchTime** (string, ISO-8601 UTC, optional): Earliest time to search before `windowStart` per tracking ID. Default is 30 days before `windowStart`. Strongly recommended to narrow this to improve performance under heavy load. - **maxOutsideWindowExecutions** (integer ≥ 0, optional): Number of executions outside the window to include per tracking ID for context. Default is 1. Reducing this improves performance and response size - **fromStatus / toStatus** (optional): Define the specific status transition to match. - **attackId** (integer, optional): Filter by a specific attack or move ID (query-level filter). - **attackName** (string, optional): Filter by attack name (query-level filter). Must be non-empty. - **attackType** (string, optional): Filter by attack type display name (for example, "Malware Drop"). Query-level filter. Must be non-empty. - **driftType** (enum, optional): Filter by drift type, such as `regression`, `improvement`, or `mixedDrift`. - **containsTransition** (boolean, optional): Match if the specified transition appears anywhere in the execution sequence. - **startsAndEndsWithTransition** (boolean, optional): Match only if the execution starts with `fromStatus` and ends with `toStatus`. **Notes:** - `containsTransition` and `startsAndEndsWithTransition` are mutually exclusive. Only one may be set to true. - All timestamps must be in ISO-8601 UTC format (for example: `2025-10-24T00:00:00.000Z`).
• [Drift by Simulation Status](https://developers.safebreach.com/analyze/simulation-results/drift-analysis/drift-by-simulation-status.md): Returns drift analysis for simulations' statuses/results in a window. #### Filters: It is highly recommended to use a narrow time window and apply filters, as it can significantly improve response time. - **windowStart** (string, ISO-8601 in UTC (e.g., `2025-10-24T00:00:00.000Z`), optional): Start of time window. Default: 7 days before windowEnd. - **windowEnd** (string, ISO-8601 in UTC (e.g., 2025-10-24T00:00:00.000Z), optional): End of time window. Default: now. - **earliestSearchTime** (number|string, optional): Earliest time to search per tracking ID. Default: 30 days before windowStart. - **maxOutsideWindowExecutions** (integer >= 0, optional): Simulations to include before windowStart per tracking ID. Default: 1. - **attackId** (integer, optional): Filter by a specific attack or move ID (query-level filter). - **attackName** (string, optional): Filter by attack name (query-level filter). Must be non-empty. - **attackType** (string, optional): Filter by attack type display name (for example, "Malware Drop"). Query-level filter. Must be non-empty. - **driftType** (enum, optional): Improvement | Regression | NotApplicable #### Status filters (choose ONE pair type): A) Final status: - fromFinalStatus / toFinalStatus (enum): prevented | stopped | detected | logged | missed | inconsistent B) Simple status: - fromStatus / toStatus (enum): FAIL | SUCCESS Mutual exclusion: - If you set fromFinalStatus/toFinalStatus, do NOT set fromStatus/toStatus (and vice-versa).
• [Get Event Logs](https://developers.safebreach.com/analyze/simulation-results/get-event-logs.md): Get all security events logs for a specific simulation
• [Delete Event Logs](https://developers.safebreach.com/analyze/simulation-results/delete-event-logs.md): Delete all Security Events logs related to a specific planRunId or simulationId or purge all logs
• [Send Simulation Result](https://developers.safebreach.com/analyze/simulation-results/send-simulation-result.md): Mobilize Simulation Results details to external Workflow and Automation products
• [MITRE ATT&CK](https://developers.safebreach.com/analyze/mitre-att-and-ck.md): The MITRE ATT&CK object represents SafeBreach's mapping of simulation data to MITRE ATT&CK’s database of tactics and techniques, providing industry-standard visibility into attack coverage.
  • [Returns Mitre stats](https://developers.safebreach.com/analyze/mitre-att-and-ck/returns-mitre-stats.md): Returns Mitre stats
• [Insights](https://developers.safebreach.com/mobilize/insights.md): Insights surface high-priority findings derived from aggregations of simulation results, such as exploitable gaps, failed detections, and recurring weaknesses, that may be used for threat mitigation.
  • [Return insight list](https://developers.safebreach.com/mobilize/insights/return-insight-list.md): Fetch a list of insights specifications.
  • [Return insight list with filters](https://developers.safebreach.com/mobilize/insights/return-insight-list-with-filters.md): Get insights
  • [Return remediation data](https://developers.safebreach.com/mobilize/insights/return-remediation-data.md): Return the remediation data for a specified insight
  • [Return remediation data through post](https://developers.safebreach.com/mobilize/insights/return-remediation-data-through-post.md): Get remediation data through post
  • [Return insights through post with filters](https://developers.safebreach.com/mobilize/insights/return-insights-through-post-with-filters.md): Return the list of insights through POST action
• [Dashboards](https://developers.safebreach.com/mobilize/dashboards.md): A Dashboard presents visual summaries of simulation outcomes, threat coverage, and organizational security posture.
  • [Return dashboard list](https://developers.safebreach.com/mobilize/dashboards/return-dashboard-list.md): Provide the list of dashboards
  • [Returns the dashboards query](https://developers.safebreach.com/mobilize/dashboards/returns-the-dashboards-query.md): Returns the dashboards query
• [Reports](https://developers.safebreach.com/mobilize/reports.md): Reports are scheduled or on-demand PDFs summarizing simulation activity, insights, or compliance alignment. These can be used for audits or stakeholder communication.
  • [Generate a report](https://developers.safebreach.com/mobilize/reports/generate-a-report.md): Run a single report, with specified parameters.
  • [Return report layout](https://developers.safebreach.com/mobilize/reports/return-report-layout.md): Returns the report layout.
  • [Return report parameters](https://developers.safebreach.com/mobilize/reports/return-report-parameters.md): Returns a list of report parameters.
  • [Return report definitions](https://developers.safebreach.com/mobilize/reports/return-report-definitions.md): Returns a list of report definitions.
  • [Retrieve Peer Benchmark Scores](https://developers.safebreach.com/mobilize/reports/retrieve-peer-benchmark-scores.md): Use this endpoint to retrieve peer benchmark scores with precise control over time range, test scope, and industry comparison. It is designed for reporting and analytics workflows, enabling consistent score retrieval for external systems. **Filters:** It is recommended to define a precise time range and test scope to ensure accurate and consistent benchmark calculations. - **startTime** (string, ISO-8601 UTC, required): Start of the time range for benchmark calculation. - **endTime** (string, ISO-8601 UTC, required): End of the time range for benchmark calculation. - **includeTestIds\[\]** (array of integers, conditionally required): List of test IDs to include in the calculation. When provided, only these tests are used. - **excludeTestIds\[\]** (array of integers, conditionally required): List of test IDs to exclude from the calculation. **Notes:** - `includeTestIds[]` and `excludeTestIds[]` cannot be used together. Exactly one must be provided. - Time filtering is strict. Only data within `startTime` and `endTime` is used for score calculation. - All timestamps must be in ISO-8601 UTC format (for example: `2025-10-24T00:00:00.000Z`).
• [Delete setting](https://developers.safebreach.com/settings/settings-actions/delete-setting.md): This will revert the setting to is default value, and will not show the setting as part of the changed settings in the 'get all settings' API
• [Return setting details](https://developers.safebreach.com/settings/settings-actions/return-setting-details.md): Return the setting value. This will return the setting only if it is a non-default value
• [Set structured settings](https://developers.safebreach.com/settings/settings-actions/set-structured-settings.md): Set multiple settings by providing an object. Key path parameter is used as the namespace (root) of all settings provided
• [Return structured settings JSON](https://developers.safebreach.com/settings/settings-actions/return-structured-settings-json.md): Get settings as hierarchical JSON instead of a flat list. The JSON root is the provided key
• [Return setting list](https://developers.safebreach.com/settings/settings-actions/return-setting-list.md): Return the list of all settings that are not default and were changed
• [Update system setting](https://developers.safebreach.com/settings/settings-actions/update-system-setting.md): Updates a system setting. If it is a new setting it will override the default value
• [Change user's password](https://developers.safebreach.com/settings/users/change-user-s-password.md): Update the password. This can only be done for the user initiating the call and therefore doesn't require a user Id as a parameter
• [Get user details](https://developers.safebreach.com/settings/users/get-user-details.md): Return attributes for a specific user
• [Get the users list](https://developers.safebreach.com/settings/users/get-the-users-list.md): Returns all the users associated with the given account
• [Delete API key](https://developers.safebreach.com/settings/authentication/api-keys/delete-api-key.md): This API revokes an API key and subsequent API calls using it will fail
• [Return API key](https://developers.safebreach.com/settings/authentication/api-keys/return-api-key.md): Return an API key details. Using this API the user can create new access token that can be used to access APIs that require authentication. Accessing such APIs is done by setting a header in the request with the key 'x-apitoken' to the key's value
• [Return API key list](https://developers.safebreach.com/settings/authentication/api-keys/return-api-key-list.md): Return a list of all the API keys available in the system. These keys can be used to access APIs that require authentication and will never expire unless deleted
• [Create API key](https://developers.safebreach.com/settings/authentication/api-keys/create-api-key.md): Add an API key. Using this API the user can create new access token that can be used to access APIs that require authentication. Accessing such APIs is done by setting a header in the request with the key 'x-apitoken' to the key's value
• [Create new certificate](https://developers.safebreach.com/settings/authentication/sso/certificates/create-new-certificate.md): Creates a new certificate, public key and a private key, and store everything in vault. Returns the certificate and paths for the vault to the rest
• [Return certificate](https://developers.safebreach.com/settings/authentication/sso/certificates/return-certificate.md): get certificate by provided type. This API will return the 'current' certificate by the key stored in settings, 'auth.sso.saml.assertionEncryption.certificate' for the assertionEncryption and 'auth.sso.saml.spCert'
• [Test connection with IdP](https://developers.safebreach.com/settings/authentication/sso/idptestconnection/test-connection-with-idp.md): Test connection with IdP
• [Sync with IdP](https://developers.safebreach.com/settings/authentication/sso/idpsync/sync-with-idp.md): Sync with IdP
• [Return Idp Groups](https://developers.safebreach.com/settings/authentication/sso/idpgroups/return-idp-groups.md): Get All IdP Groups
• [Reset user password with Password Reset Token](https://developers.safebreach.com/settings/authentication/passwordreset/reset-user-password-with-password-reset-token.md): This API reset the user's password. It will require a valid token from the reset password API
• [Return Password Reset Token Valid](https://developers.safebreach.com/settings/authentication/passwordreset/return-password-reset-token-valid.md): This API checks if the token is valid for password reset. This token can be generated by the reset password API
• [Send password reset email](https://developers.safebreach.com/settings/authentication/passwordreset/send-password-reset-email.md): Sends an email to the given address with a reset passowrd link. This should be used in case the user forgets his password and require recovery
• [Send password reset email](https://developers.safebreach.com/settings/authentication/passwordreset/send-password-reset-email.md): Sends an email to the given address with a reset passowrd link. This should be used in case the user forgets his password and require recovery
• [Send password reset email](https://developers.safebreach.com/settings/authentication/passwordreset/send-password-reset-email-1.md): Sends an email to the given address with a reset password link. This should be used in case the user forgets his password and require recovery
• [Download installation links](https://developers.safebreach.com/settings/installation-links/download-installation-links.md): Download installation links
• [Return system status](https://developers.safebreach.com/settings/status/return-system-status.md): Return whether the SafeBreach platform is up and running
• [Get service's readiness status](https://developers.safebreach.com/settings/status/get-service-s-readiness-status.md): Return if service is available and online
• [Get service's live status](https://developers.safebreach.com/settings/status/get-service-s-live-status.md): Get service's live status
• [Get service status](https://developers.safebreach.com/settings/status/get-service-status.md): Return the current connection status of all system services
• [Debugging tool for getting methods in snapshot storage](https://developers.safebreach.com/toolbox/debug/debugging-tool-for-getting-methods-in-snapshot-storage.md): Returns the list of methods for the requested filters.
• [SafeBreach auditing log](https://developers.safebreach.com/toolbox/audit-logs/safebreach-auditing-log.md): Returns audit data
• [Hard Delete SafeBreach Management data](https://developers.safebreach.com/toolbox/data-management/hard-delete-safebreach-management-data.md): This API deletes all simulation data from the SafeBreach Management console, including all risk scores and metrics.