io.enterpriseai.resources.SocClient
Source: sdks/java/enterprise-ai-java/src/main/java/io/enterpriseai/resources/SocClient.java. Back to the Java SDK reference index.
This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.
Class SocClient
SOC detections, containment orders, kill switches, recoveries and chain of custody.
Constructor SocClient
SocClient(Transport transport)
Creates the client on the shared transport; EnterpriseAIClient builds it and exposes it through the accessor of the same name.
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
transport | Transport | yes | Transport shared by the sub-clients of one client. |
SocClient.addEvidence
JsonNode addEvidence(String incidentId, Object body)
Seal evidence on an incident. Appends a sealed record to the evidence chain of the incident: the content hash and the hash of the previous record, so that a removed, reordered or modified record breaks the chain. Records can never be updated nor deleted. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.evidence.seal and a custody entry. Answers 201 with seq, kind, content_sha256, prev_hash, hash, sealed_by and sealed_at.
Route: /v1/soc/incidents/{incident_id}/evidence (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. | |
body | Object | yes | Kind and content of the evidence. |
Returns: JsonNode. Decoded JSON answer of the operation "Seal evidence on an incident".
Raises: the typed errors of the transport (Errors).
SocClient.addEvidence
JsonNode addEvidence(String incidentId, Object body, RequestOptions options)
Seal evidence on an incident. Appends a sealed record to the evidence chain of the incident: the content hash and the hash of the previous record, so that a removed, reordered or modified record breaks the chain. Records can never be updated nor deleted. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.evidence.seal and a custody entry. Answers 201 with seq, kind, content_sha256, prev_hash, hash, sealed_by and sealed_at.
Route: /v1/soc/incidents/{incident_id}/evidence (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. | |
body | Object | yes | Kind and content of the evidence. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Seal evidence on an incident".
Raises: the typed errors of the transport (Errors).
SocClient.approveOrder
JsonNode approveOrder(String orderId)
Approve a containment order. Approves an order waiting for a second person and applies it (kill switch written, adapter run). Needs security_officer or tenant_admin (SOC lead), who is not the requester (409 separation_of_duties). An order that is not pending answers 409 order_not_pending; an unknown one 404.
Route: /v1/soc/orders/{order_id}/approve (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
orderId | String | yes | Identifier (UUID) of the containment order. |
Returns: JsonNode. Decoded JSON answer of the operation "Approve a containment order".
Raises: the typed errors of the transport (Errors).
SocClient.approveOrder
JsonNode approveOrder(String orderId, RequestOptions options)
Approve a containment order. Approves an order waiting for a second person and applies it (kill switch written, adapter run). Needs security_officer or tenant_admin (SOC lead), who is not the requester (409 separation_of_duties). An order that is not pending answers 409 order_not_pending; an unknown one 404.
Route: /v1/soc/orders/{order_id}/approve (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
orderId | String | yes | Identifier (UUID) of the containment order. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Approve a containment order".
Raises: the typed errors of the transport (Errors).
SocClient.approveRecovery
JsonNode approveRecovery(String recoveryId, Object body)
Approve a recovery. Records one approval of a pending recovery; two distinct SOC leads are required, neither being the requester (409 separation_of_duties), each approving once (409 already_approved). Needs security_officer or tenant_admin (SOC lead). A request that is not pending answers 409 recovery_not_pending.
Route: /v1/soc/recoveries/{recovery_id}/approve (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
recoveryId | String | yes | Identifier (UUID) of the recovery request. | |
body | Object | yes | Optional note of the approval. |
Returns: JsonNode. Decoded JSON answer of the operation "Approve a recovery".
Raises: the typed errors of the transport (Errors).
SocClient.approveRecovery
JsonNode approveRecovery(String recoveryId, Object body, RequestOptions options)
Approve a recovery. Records one approval of a pending recovery; two distinct SOC leads are required, neither being the requester (409 separation_of_duties), each approving once (409 already_approved). Needs security_officer or tenant_admin (SOC lead). A request that is not pending answers 409 recovery_not_pending.
Route: /v1/soc/recoveries/{recovery_id}/approve (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
recoveryId | String | yes | Identifier (UUID) of the recovery request. | |
body | Object | yes | Optional note of the approval. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Approve a recovery".
Raises: the typed errors of the transport (Errors).
SocClient.catalog
JsonNode catalog()
Get the SOC catalogue. Returns the allowlists: reactions, the target types allowed per reaction (targets), the detection kinds with their base severity and playbook (detections), the limits of the proportionality guard (response: minimum confidence, maximum automatic blast radius, blast radius needing a manual approval, reactions always needing approval) and the SOC roles. Open to any member of the tenant.
Route: /v1/soc/catalog (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "Get the SOC catalogue".
Raises: the typed errors of the transport (Errors).
SocClient.createDetection
JsonNode createDetection(Object body)
Report a detection. Ingests a detection. Needs a credential granted the scope soc:detections explicitly (the global * does not count), or security_officer, agent or soc_analyst.
Route: /v1/soc/detections (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | The detection to ingest. |
Returns: JsonNode. Decoded JSON answer of the operation "Report a detection".
Raises: the typed errors of the transport (Errors).
SocClient.createDetection
JsonNode createDetection(Object body, RequestOptions options)
Report a detection. Ingests a detection. Needs a credential granted the scope soc:detections explicitly (the global * does not count), or security_officer, agent or soc_analyst.
Route: /v1/soc/detections (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | The detection to ingest. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Report a detection".
Raises: the typed errors of the transport (Errors).
SocClient.createOrder
JsonNode createOrder(Object body)
Order a containment. Creates a manual containment order. Needs security_officer, soc_analyst or tenant_admin.
Route: /v1/soc/orders (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Reaction, target, incident, reason, parameters and limits of the order. |
Returns: JsonNode. Decoded JSON answer of the operation "Order a containment".
Raises: the typed errors of the transport (Errors).
SocClient.createOrder
JsonNode createOrder(Object body, RequestOptions options)
Order a containment. Creates a manual containment order. Needs security_officer, soc_analyst or tenant_admin.
Route: /v1/soc/orders (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Reaction, target, incident, reason, parameters and limits of the order. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Order a containment".
Raises: the typed errors of the transport (Errors).
SocClient.createRecovery
JsonNode createRecovery(Object body)
Request the recovery of a kill switch. Opens a four eyes recovery request for one active kill switch. Needs security_officer, soc_analyst or tenant_admin. An unknown switch answers 404, a switch no longer suspended 409 kill_switch_not_active, a switch with an open request 409 recovery_already_open. Answers 201 with the request.
Route: /v1/soc/recoveries (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Kill switch and reason. |
Returns: JsonNode. Decoded JSON answer of the operation "Request the recovery of a kill switch".
Raises: the typed errors of the transport (Errors).
SocClient.createRecovery
JsonNode createRecovery(Object body, RequestOptions options)
Request the recovery of a kill switch. Opens a four eyes recovery request for one active kill switch. Needs security_officer, soc_analyst or tenant_admin. An unknown switch answers 404, a switch no longer suspended 409 kill_switch_not_active, a switch with an open request 409 recovery_already_open. Answers 201 with the request.
Route: /v1/soc/recoveries (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Kill switch and reason. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Request the recovery of a kill switch".
Raises: the typed errors of the transport (Errors).
SocClient.custody
JsonNode custody(String incidentId)
Read the chain of custody. Returns the custody log of the incident evidence (who sealed, read or exported what, and when) with the verification of both hash chains. Needs security_officer, tenant_admin, auditor or soc_analyst. The read itself is added to the custody log. Answers 404 not_found for an unknown incident.
Route: /v1/soc/incidents/{incident_id}/custody (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. |
Returns: JsonNode. Decoded JSON answer of the operation "Read the chain of custody".
Raises: the typed errors of the transport (Errors).
SocClient.exportEvidence
JsonNode exportEvidence(String incidentId)
Export the evidence of an incident. Returns the incident, its evidence records, both chains verified and the custody log. The bundle is scanned for credentials before any byte leaves: when one is found the export is refused with 422 secret_detected, the refusal is recorded in the custody log and a secret_leak detection is raised. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/incidents/{incident_id}/evidence/export (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. |
Returns: JsonNode. Decoded JSON answer of the operation "Export the evidence of an incident".
Raises: the typed errors of the transport (Errors).
SocClient.exportEvidence
JsonNode exportEvidence(String incidentId, RequestOptions options)
Export the evidence of an incident. Returns the incident, its evidence records, both chains verified and the custody log. The bundle is scanned for credentials before any byte leaves: when one is found the export is refused with 422 secret_detected, the refusal is recorded in the custody log and a secret_leak detection is raised. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/incidents/{incident_id}/evidence/export (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Export the evidence of an incident".
Raises: the typed errors of the transport (Errors).
SocClient.getOrder
JsonNode getOrder(String orderId)
Get a containment order. Returns the order with its latest kill switch and the receipts received for it. Needs security_officer, tenant_admin, auditor or soc_analyst. Answers 404 not_found.
Route: /v1/soc/orders/{order_id} (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
orderId | String | yes | Identifier (UUID) of the containment order. |
Returns: JsonNode. Decoded JSON answer of the operation "Get a containment order".
Raises: the typed errors of the transport (Errors).
SocClient.listDetections
JsonNode listDetections()
List the detections. Lists the detections of the tenant, newest first, optionally for one incident or one kind. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.
Route: /v1/soc/detections (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "List the detections".
Raises: the typed errors of the transport (Errors).
SocClient.listDetections
JsonNode listDetections(Map<String, ?> query)
List the detections. Lists the detections of the tenant, newest first, optionally for one incident or one kind. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.
Route: /v1/soc/detections (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
query | Map<String, ?> | yes | Query string parameters of the route. |
Returns: JsonNode. Decoded JSON answer of the operation "List the detections".
Raises: the typed errors of the transport (Errors).
SocClient.listEvidence
JsonNode listEvidence(String incidentId)
Read the evidence of an incident. Returns the sealed evidence records of the incident (detections, orders, receipts, notes), the verification of their chain and custody_seq, the custody entry this read created. Needs security_officer, tenant_admin, auditor or soc_analyst. Answers 404 not_found.
Route: /v1/soc/incidents/{incident_id}/evidence (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
incidentId | String | yes | Identifier (UUID) of the incident. |
Returns: JsonNode. Decoded JSON answer of the operation "Read the evidence of an incident".
Raises: the typed errors of the transport (Errors).
SocClient.listKillSwitches
JsonNode listKillSwitches()
List the kill switches. Lists the kill switches of the tenant, newest first, at most 500: by default only those whose desired state is SUSPENDED. Each gives reaction, target, desired and observed state, last receipt and release. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.
Route: /v1/soc/kill-switches (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "List the kill switches".
Raises: the typed errors of the transport (Errors).
SocClient.listKillSwitches
JsonNode listKillSwitches(Map<String, ?> query)
List the kill switches. Lists the kill switches of the tenant, newest first, at most 500: by default only those whose desired state is SUSPENDED. Each gives reaction, target, desired and observed state, last receipt and release. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.
Route: /v1/soc/kill-switches (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
query | Map<String, ?> | yes | Query string parameters of the route. |
Returns: JsonNode. Decoded JSON answer of the operation "List the kill switches".
Raises: the typed errors of the transport (Errors).
SocClient.listOrders
JsonNode listOrders()
List the containment orders. Lists the containment orders of the tenant, newest first, optionally by status (pending_approval, applied, rejected...) or incident. Each gives reaction, target, blast radius, confidence, severity, mode (manual or automatic), status and the decision of the Response Policy Engine. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/orders (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "List the containment orders".
Raises: the typed errors of the transport (Errors).
SocClient.listOrders
JsonNode listOrders(Map<String, ?> query)
List the containment orders. Lists the containment orders of the tenant, newest first, optionally by status (pending_approval, applied, rejected...) or incident. Each gives reaction, target, blast radius, confidence, severity, mode (manual or automatic), status and the decision of the Response Policy Engine. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/orders (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
query | Map<String, ?> | yes | Query string parameters of the route. |
Returns: JsonNode. Decoded JSON answer of the operation "List the containment orders".
Raises: the typed errors of the transport (Errors).
SocClient.listRecoveries
JsonNode listRecoveries()
List the recovery requests. Lists the recovery requests of the tenant, newest first, at most 500, optionally by status, with their approvals. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/recoveries (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "List the recovery requests".
Raises: the typed errors of the transport (Errors).
SocClient.listRecoveries
JsonNode listRecoveries(Map<String, ?> query)
List the recovery requests. Lists the recovery requests of the tenant, newest first, at most 500, optionally by status, with their approvals. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/recoveries (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
query | Map<String, ?> | yes | Query string parameters of the route. |
Returns: JsonNode. Decoded JSON answer of the operation "List the recovery requests".
Raises: the typed errors of the transport (Errors).
SocClient.listTransactions
JsonNode listTransactions()
List the side effecting transactions. Lists the side effecting tool and connector calls of the tenant, newest first, at most 500: idempotency key, operation, status (in_flight, committed, interrupted, reconciled, compensating, compensated...) and reconciliation. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/transactions (GET).
This element takes no parameter.
Returns: JsonNode. Decoded JSON answer of the operation "List the side effecting transactions".
Raises: the typed errors of the transport (Errors).
SocClient.listTransactions
JsonNode listTransactions(Map<String, ?> query)
List the side effecting transactions. Lists the side effecting tool and connector calls of the tenant, newest first, at most 500: idempotency key, operation, status (in_flight, committed, interrupted, reconciled, compensating, compensated...) and reconciliation. Needs security_officer, tenant_admin, auditor or soc_analyst.
Route: /v1/soc/transactions (GET).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
query | Map<String, ?> | yes | Query string parameters of the route. |
Returns: JsonNode. Decoded JSON answer of the operation "List the side effecting transactions".
Raises: the typed errors of the transport (Errors).
SocClient.reauthorizeRecovery
JsonNode reauthorizeRecovery(String recoveryId)
Re-authorize and recover. Final step of a recovery, by one of the approvers (403 reauthorization_by_approver otherwise) once both approvals are in (409 recovery_not_approved). The switch is released, the target is re-evaluated by the policy, which must allow it (403 reauthorization_denied, everything rolled back), and only then the owning plane is restored, for example an agent resumed. A revoked API key stays revoked: issue a new one. Needs security_officer or tenant_admin (SOC lead).
Route: /v1/soc/recoveries/{recovery_id}/reauthorize (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
recoveryId | String | yes | Identifier (UUID) of the recovery request. |
Returns: JsonNode. Decoded JSON answer of the operation "Re-authorize and recover".
Raises: the typed errors of the transport (Errors).
SocClient.reauthorizeRecovery
JsonNode reauthorizeRecovery(String recoveryId, RequestOptions options)
Re-authorize and recover. Final step of a recovery, by one of the approvers (403 reauthorization_by_approver otherwise) once both approvals are in (409 recovery_not_approved). The switch is released, the target is re-evaluated by the policy, which must allow it (403 reauthorization_denied, everything rolled back), and only then the owning plane is restored, for example an agent resumed. A revoked API key stays revoked: issue a new one. Needs security_officer or tenant_admin (SOC lead).
Route: /v1/soc/recoveries/{recovery_id}/reauthorize (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
recoveryId | String | yes | Identifier (UUID) of the recovery request. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Re-authorize and recover".
Raises: the typed errors of the transport (Errors).
SocClient.receipt
JsonNode receipt(Object body)
Receive an in-cluster containment receipt. Receipt sent from the cluster (Cilium policy observed, workload scaled to zero) for a cluster reaction: JSON {kill_switch_id, verified, adapter, evidence}. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. A verified receipt moves the observed state to SUSPENDED_VERIFIED; a receipt for a reaction that expects none answers 409 receipt_not_expected. No user credential is needed: the signature authenticates the sender. Answers 202 with the kill switch.
Route: /v1/soc/receipts (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Raw signed JSON body of the receipt (application/octet-stream), verified byte for byte. |
Returns: JsonNode. Decoded JSON answer of the operation "Receive an in-cluster containment receipt".
Raises: the typed errors of the transport (Errors).
SocClient.receipt
JsonNode receipt(Object body, RequestOptions options)
Receive an in-cluster containment receipt. Receipt sent from the cluster (Cilium policy observed, workload scaled to zero) for a cluster reaction: JSON {kill_switch_id, verified, adapter, evidence}. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. A verified receipt moves the observed state to SUSPENDED_VERIFIED; a receipt for a reaction that expects none answers 409 receipt_not_expected. No user credential is needed: the signature authenticates the sender. Answers 202 with the kill switch.
Route: /v1/soc/receipts (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
body | Object | yes | Raw signed JSON body of the receipt (application/octet-stream), verified byte for byte. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Receive an in-cluster containment receipt".
Raises: the typed errors of the transport (Errors).
SocClient.receiptSigned
JsonNode receiptSigned(byte[] payload, String secret, String tenant)
Receive an in-cluster containment receipt. Receipt sent from the cluster (Cilium policy observed, workload scaled to zero) for a cluster reaction: JSON {kill_switch_id, verified, adapter, evidence}. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. A verified receipt moves the observed state to SUSPENDED_VERIFIED; a receipt for a reaction that expects none answers 409 receipt_not_expected. No user credential is needed: the signature authenticates the sender. Answers 202 with the kill switch.
Route: /v1/soc/receipts (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
payload | byte[] | yes | Raw signed JSON body of the receipt (application/octet-stream), verified byte for byte. | |
secret | String | yes | Shared secret of the HMAC-SHA256 signature put in X-EAI-Signature. | |
tenant | String | yes | Tenant slug sent in X-EAI-Tenant. |
Returns: JsonNode. Decoded JSON answer of the operation "Receive an in-cluster containment receipt".
Raises: the typed errors of the transport (Errors).
SocClient.reconcileTransaction
JsonNode reconcileTransaction(String transactionId, Object body)
Reconcile a transaction. Records the real outcome of a side effecting call whose result is unknown (interrupted by a kill, a crash or a timeout): committed (it happened at the provider) or not_executed. A retry with the same idempotency key then returns the stored result instead of calling the provider again. Needs security_officer or tenant_admin (SOC lead). An unknown outcome answers 400, a transaction that cannot be reconciled 409 transaction_not_reconcilable, an unknown one 404.
Route: /v1/soc/transactions/{transaction_id}/reconcile (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
transactionId | String | yes | Identifier of the side effecting transaction. | |
body | Object | yes | Outcome, provider reference and note. |
Returns: JsonNode. Decoded JSON answer of the operation "Reconcile a transaction".
Raises: the typed errors of the transport (Errors).
SocClient.reconcileTransaction
JsonNode reconcileTransaction(String transactionId, Object body, RequestOptions options)
Reconcile a transaction. Records the real outcome of a side effecting call whose result is unknown (interrupted by a kill, a crash or a timeout): committed (it happened at the provider) or not_executed. A retry with the same idempotency key then returns the stored result instead of calling the provider again. Needs security_officer or tenant_admin (SOC lead). An unknown outcome answers 400, a transaction that cannot be reconciled 409 transaction_not_reconcilable, an unknown one 404.
Route: /v1/soc/transactions/{transaction_id}/reconcile (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
transactionId | String | yes | Identifier of the side effecting transaction. | |
body | Object | yes | Outcome, provider reference and note. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Reconcile a transaction".
Raises: the typed errors of the transport (Errors).
SocClient.rejectOrder
JsonNode rejectOrder(String orderId, Object body)
Reject a containment order. Rejects an order waiting for approval, with an optional reason. Needs security_officer or tenant_admin (SOC lead). An order that is not pending answers 409 order_not_pending; an unknown one 404.
Route: /v1/soc/orders/{order_id}/reject (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
orderId | String | yes | Identifier (UUID) of the containment order. | |
body | Object | yes | Optional reason of the decision. |
Returns: JsonNode. Decoded JSON answer of the operation "Reject a containment order".
Raises: the typed errors of the transport (Errors).
SocClient.rejectOrder
JsonNode rejectOrder(String orderId, Object body, RequestOptions options)
Reject a containment order. Rejects an order waiting for approval, with an optional reason. Needs security_officer or tenant_admin (SOC lead). An order that is not pending answers 409 order_not_pending; an unknown one 404.
Route: /v1/soc/orders/{order_id}/reject (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
orderId | String | yes | Identifier (UUID) of the containment order. | |
body | Object | yes | Optional reason of the decision. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Reject a containment order".
Raises: the typed errors of the transport (Errors).
SocClient.verifyKillSwitch
JsonNode verifyKillSwitch(String switchId)
Verify a kill switch. Runs the Containment Verifier probe of the switch: on success the observed state becomes SUSPENDED_VERIFIED. Cluster reactions (ISOLATE_NETWORK, TERMINATE_WORKLOAD) are verified only by a signed in-cluster receipt. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.kill_switch.verify. Answers 404 not_found.
Route: /v1/soc/kill-switches/{switch_id}/verify (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
switchId | String | yes | Identifier (UUID) of the kill switch. |
Returns: JsonNode. Decoded JSON answer of the operation "Verify a kill switch".
Raises: the typed errors of the transport (Errors).
SocClient.verifyKillSwitch
JsonNode verifyKillSwitch(String switchId, RequestOptions options)
Verify a kill switch. Runs the Containment Verifier probe of the switch: on success the observed state becomes SUSPENDED_VERIFIED. Cluster reactions (ISOLATE_NETWORK, TERMINATE_WORKLOAD) are verified only by a signed in-cluster receipt. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.kill_switch.verify. Answers 404 not_found.
Route: /v1/soc/kill-switches/{switch_id}/verify (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
switchId | String | yes | Identifier (UUID) of the kill switch. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Verify a kill switch".
Raises: the typed errors of the transport (Errors).
SocClient.webhook
JsonNode webhook(String source, Object body)
Receive external security findings. Webhook of external detectors: Falco, Tetragon or OpenSearch Security Analytics. The body is one event or a list (at most 200 processed), normalized into detections (Falco priorities and eai_* tags mapped to kinds and severities) and ingested like POST /v1/soc/detections. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. An unknown source answers 404. Answers 202 with received and the detections.
Route: /v1/soc/webhooks/{source} (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
source | String | yes | Detector: falco, tetragon or opensearch. | |
body | Object | yes | Raw signed JSON body (application/octet-stream): one event or a list of events of the detector. |
Returns: JsonNode. Decoded JSON answer of the operation "Receive external security findings".
Raises: the typed errors of the transport (Errors).
SocClient.webhook
JsonNode webhook(String source, Object body, RequestOptions options)
Receive external security findings. Webhook of external detectors: Falco, Tetragon or OpenSearch Security Analytics. The body is one event or a list (at most 200 processed), normalized into detections (Falco priorities and eai_* tags mapped to kinds and severities) and ingested like POST /v1/soc/detections. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. An unknown source answers 404. Answers 202 with received and the detections.
Route: /v1/soc/webhooks/{source} (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
source | String | yes | Detector: falco, tetragon or opensearch. | |
body | Object | yes | Raw signed JSON body (application/octet-stream): one event or a list of events of the detector. | |
options | RequestOptions | yes | Per call options (idempotency key, traceparent, headers, abort signal). |
Returns: JsonNode. Decoded JSON answer of the operation "Receive external security findings".
Raises: the typed errors of the transport (Errors).
SocClient.webhookSigned
JsonNode webhookSigned(String source, byte[] payload, String secret, String tenant)
Receive external security findings. Webhook of external detectors: Falco, Tetragon or OpenSearch Security Analytics. The body is one event or a list (at most 200 processed), normalized into detections (Falco priorities and eai_* tags mapped to kinds and severities) and ingested like POST /v1/soc/detections. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. An unknown source answers 404. Answers 202 with received and the detections.
Route: /v1/soc/webhooks/{source} (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
source | String | yes | Detector: falco, tetragon or opensearch. | |
payload | byte[] | yes | Raw signed JSON body (application/octet-stream): one event or a list of events of the detector. | |
secret | String | yes | Shared secret of the HMAC-SHA256 signature put in X-EAI-Signature. | |
tenant | String | yes | Tenant slug sent in X-EAI-Tenant. |
Returns: JsonNode. Decoded JSON answer of the operation "Receive external security findings".
Raises: the typed errors of the transport (Errors).