# Exfiltration Prevention APIs

You can use the exfiltration APIs to search exfiltration events, fetch exfiltration events and also event details. Additionally, you can also view details of the user (actor) whose actions triggered an event, and details of the asset that triggered an event. 

## Search exfiltration events

> Fetch a list of exfiltration events based on some filters

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ExfiltrationSearchSortKey":{"type":"string","enum":["TIME_ASC","TIME_DESC","RELEVANCE"]},"ExfiltrationEvent":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the exfiltration event"},"integration":{"type":"string","description":"Integration type that generated the event (e.g., GDRIVE, ES_WINDOWS, ES_MAC)"},"createdAt":{"type":"integer","description":"Unix timestamp in seconds indicating when the event was created"},"state":{"type":"string","description":"Current state of the event (e.g., ACTIVE, RESOLVED, EXPIRED, PENDING)"},"eventType":{"type":"string","description":"Type of exfiltration event (e.g., DOWNLOAD, ENDPOINTDLP_BROWSER_UPLOAD)"},"policyUUIDs":{"type":"array","description":"List of policy UUIDs that triggered the event","items":{"type":"string","format":"uuid"}},"assetsCount":{"type":"integer","description":"Number of assets involved in the exfiltration event"},"userInfo":{"type":"object","description":"Information about the user involved in the event","properties":{"username":{"type":"string","description":"Username of the associated user"},"userEmail":{"type":"string","format":"email","description":"Email of the associated user"},"userProfileLink":{"type":"string","format":"uri","description":"Link to the user's profile"},"deviceId":{"type":"string","description":"Device identifier for endpoint events"},"machineName":{"type":"string","description":"Machine name for endpoint events"},"isExternal":{"type":"boolean","description":"Whether the user is external to the organization"}}},"appInfo":{"type":"object","description":"Information about the application involved in the event","properties":{"id":{"type":"string","description":"Identifier of the application"},"name":{"type":"string","description":"Name of the application"}}},"risk":{"$ref":"#/components/schemas/ViolationRisk","description":"The risk label associated to this event"},"riskSource":{"$ref":"#/components/schemas/ViolationRiskSource","description":"The source of calculation of risk associated to this event"},"riskScore":{"type":"number","format":"float","description":"The calculated score of the risk for this event"}}},"ViolationRisk":{"type":"string","enum":["UNSPECIFIED","LOW","MEDIUM","HIGH","CRITICAL","NO_RISK"]},"ViolationRiskSource":{"type":"string","enum":["NIGHTFALL","CUSTOM","OVERRIDDEN"]},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/events/search":{"get":{"summary":"Search exfiltration events","description":"Fetch a list of exfiltration events based on some filters","parameters":[{"name":"createdAfter","in":"query","description":"Unix timestamp in seconds, filters records created ≥ the value, defaults to -180 days UTC","required":false,"schema":{"type":"integer"}},{"name":"createdBefore","in":"query","description":"Unix timestamp in seconds, filters records created < the value, defaults to end of the current day UTC","required":false,"schema":{"type":"integer"}},{"name":"updatedAfter","in":"query","description":"Unix timestamp in seconds, filters records updated > the value","required":false,"schema":{"type":"integer"}},{"name":"limit","in":"query","description":"The maximum number of records to be returned in the response","required":false,"schema":{"type":"integer","maximum":100,"default":50}},{"name":"pageToken","in":"query","description":"Cursor for getting the next page of results","required":false,"schema":{"type":"string"}},{"name":"sort","in":"query","description":"Sort key and direction, defaults to descending order by creation time","required":false,"schema":{"$ref":"#/components/schemas/ExfiltrationSearchSortKey","default":"TIME_DESC"}},{"name":"query","in":"query","description":"The query containing filter clauses\n### **Search query language**\n**Query structure and terminology**\n\nA query **`clause`** consists of a **`field`** followed by an **`operator`** followed by a **`value`**:\n\n| term | value |\n| --- | --- |\n| clause | user_email:\"amy@rocketrides.io\" |\n| field | user_email |\n| operator | : |\n| value | amy@rocketrides.io |\n\nYou can combine multiple query clauses in a search by separating them with a space.\n\n**Field types, substring matching, and numeric comparators**\n\nEvery search field supports exact matching with a **`:`**. Certain fields such as **`user_email`** and **`user_name`** support substring matching.\n\n**Quotes**\n\nYou may use quotation marks around string values. Quotation marks are required in case the value contains spaces. For example:\n\n- **`user_mail:john@example.com`**\n- **`user_name:\"John Doe\"`**\n\n**Special Characters**\n\n`+ - && || ! ( ) { } [ ] ^ \" ~ * ? :` are special characters need to be escaped using `\\`. For example:\n\n- a value like `(1+1):2` should be searched for using `\\(1\\+1)\\:2`\n\n**Search Syntax**\n\nThe following table lists the syntax that you can use to construct a query.\n\n| SYNTAX | USAGE | DESCRIPTION | EXAMPLES |\n| --- | --- | --- | --- |\n| `:` | field:value | Exact match operator (case insensitive) | `state:\"pending\"` returns records where the currency is exactly `\"PENDING\"` in a case-insensitive comparison |\n| ` ` (space) | field1:value1 field2:value2 | The query returns only records that match both clauses | `state:active slack.channel_name:general` |\n| `OR` | field:(value1 OR value2) | The query returns records that match either of the values (case insensitive) | `state:(active OR pending)` |\n\n**Query Fields**\n\n| param | description |\n| --- | --- |\n| event_id | the unique identifier of the exfiltration event to filter on |\n| integration_name | the name of the integration to filter on |\n| state | the state of the event to filter on (active, pending, resolved, expired) |\n| event_type | the type of exfiltration event to filter on | \n| actor_name | the name of the actor who performed the action to filter on |\n| actor_email | the email of the actor who performed the action to filter on |\n| user_name | the username of the user to filter on (backward compatibility) |\n| user_email | the email of the user to filter on (backward compatibility) |\n| notes | the comment or notes associated with the event to filter on |\n| risk_label | the risk label to filter on |\n| risk_source | the risk determination source to filter on |\n| policy_id | the unique identifier of the policy to filter on | \n| policy_name | the name of the policy to filter on | \n| resource_id | the identifier of the resource to filter on | \n| resource_name | the name of the resource to filter on | \n| resource_owner_name | the name of the resource owner to filter on |\n| resource_owner_email | the email of the resource owner to filter on | \n| resource_content_type | the content type of the resource to filter on | \n| endpoint.device_id | the device identifier for endpoint events to filter on |\n| endpoint.machine_name | the machine name for endpoint events to filter on |\n| gdrive.permission | the permission setting for Google Drive files to filter on |\n| gdrive.shared_internal_email | the internal emails with which the file is shared to filter on |\n| gdrive.shared_external_email | the external emails with which the file is shared to filter on | \n| gdrive.drive | the Google Drive name to filter on |\n| gdrive.file_owner | the owner of the Google Drive file to filter on |\n| gdrive.label_name | the label name applied to Google Drive files to filter on |\n| salesforce.report.scope | the scope of the Salesforce report to filter on |\n| salesforce.report.event_source | the event source of the Salesforce report to filter on |\n| salesforce.report.source_ip | the source IP address of the Salesforce report to filter on |\n| salesforce.report.session_level | the session level of the Salesforce report to filter on |\n| salesforce.report.operation | the operation type of the Salesforce report to filter on | \n| salesforce.report.description | the description of the Salesforce report to filter on |\n| salesforce.file.source_ip | the source IP address for Salesforce file events to filter on |\n| salesforce.file.session_level | the session level for Salesforce file events to filter on |\n| last_actioned_by | the entity that performed the last action on the violation, can be one of NIGHTFALL, ADMIN or END_USER |\n","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/ExfiltrationEvent"}},"nextPageToken":{"type":"string","description":"Next page cursor, omitted if end of results reached"}}}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Fetch exfiltration events

> Fetch a list of exfiltration events for a period

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ExfiltrationEvent":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the exfiltration event"},"integration":{"type":"string","description":"Integration type that generated the event (e.g., GDRIVE, ES_WINDOWS, ES_MAC)"},"createdAt":{"type":"integer","description":"Unix timestamp in seconds indicating when the event was created"},"state":{"type":"string","description":"Current state of the event (e.g., ACTIVE, RESOLVED, EXPIRED, PENDING)"},"eventType":{"type":"string","description":"Type of exfiltration event (e.g., DOWNLOAD, ENDPOINTDLP_BROWSER_UPLOAD)"},"policyUUIDs":{"type":"array","description":"List of policy UUIDs that triggered the event","items":{"type":"string","format":"uuid"}},"assetsCount":{"type":"integer","description":"Number of assets involved in the exfiltration event"},"userInfo":{"type":"object","description":"Information about the user involved in the event","properties":{"username":{"type":"string","description":"Username of the associated user"},"userEmail":{"type":"string","format":"email","description":"Email of the associated user"},"userProfileLink":{"type":"string","format":"uri","description":"Link to the user's profile"},"deviceId":{"type":"string","description":"Device identifier for endpoint events"},"machineName":{"type":"string","description":"Machine name for endpoint events"},"isExternal":{"type":"boolean","description":"Whether the user is external to the organization"}}},"appInfo":{"type":"object","description":"Information about the application involved in the event","properties":{"id":{"type":"string","description":"Identifier of the application"},"name":{"type":"string","description":"Name of the application"}}},"risk":{"$ref":"#/components/schemas/ViolationRisk","description":"The risk label associated to this event"},"riskSource":{"$ref":"#/components/schemas/ViolationRiskSource","description":"The source of calculation of risk associated to this event"},"riskScore":{"type":"number","format":"float","description":"The calculated score of the risk for this event"}}},"ViolationRisk":{"type":"string","enum":["UNSPECIFIED","LOW","MEDIUM","HIGH","CRITICAL","NO_RISK"]},"ViolationRiskSource":{"type":"string","enum":["NIGHTFALL","CUSTOM","OVERRIDDEN"]},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/events":{"get":{"summary":"Fetch exfiltration events","description":"Fetch a list of exfiltration events for a period","parameters":[{"name":"createdAfter","in":"query","description":"Unix timestamp in seconds, filters records created ≥ the value, defaults to -90 days UTC","required":false,"schema":{"type":"integer"}},{"name":"createdBefore","in":"query","description":"Unix timestamp in seconds, filters records created < the value, defaults to end of the current day UTC","required":false,"schema":{"type":"integer"}},{"name":"updatedAfter","in":"query","description":"Unix timestamp in seconds, filters records updated > the value","required":false,"schema":{"type":"integer"}},{"name":"limit","in":"query","description":"The maximum number of records to be returned in the response","required":false,"schema":{"type":"integer","maximum":100,"default":50}},{"name":"pageToken","in":"query","description":"Cursor for getting the next page of results","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/ExfiltrationEvent"}},"nextPageToken":{"type":"string","description":"Next page cursor, omitted if end of results reached"}}}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Fetch exfiltration event details

> Fetch an exfiltration event details by ID

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ExfiltrationEventDetails":{"type":"object","properties":{"assets":{"type":"array","description":"List of assets involved in the exfiltration event","items":{"$ref":"#/components/schemas/Asset"}},"actor":{"type":"object","$ref":"#/components/schemas/Actor"},"events":{"type":"array","description":"List of events associated with the exfiltration event","items":{"$ref":"#/components/schemas/Event"}}}},"Asset":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier for the asset"},"name":{"type":"string","description":"Name of the asset"},"path":{"type":"string","description":"Path to the asset"},"sizeBytes":{"type":"integer","description":"Size of the asset in bytes"},"mimetype":{"type":"string","description":"MIME type of the asset"},"owner":{"type":"object","description":"Details of the asset owner","$ref":"#/components/schemas/Actor"},"comment":{"type":"string","description":"Comment or notes associated with the asset"},"ddrViolationIDs":{"type":"array","description":"DDR violations IDs associated with the resource","items":{"type":"string","format":"uuid"}},"metadata":{"type":"object","description":"Metadata associated with the asset","$ref":"#/components/schemas/AssetMetadata"}}},"Actor":{"type":"object","description":"Details of the actor involved in the event","properties":{"id":{"type":"string","description":"Unique identifier for the actor in Nightfall"},"email":{"type":"string","format":"email","description":"Email of the actor"},"comment":{"type":"string","description":"Comment or notes associated with the event"},"metadata":{"type":"object","description":"Metadata associated with the actor","$ref":"#/components/schemas/ActorMetadata"}}},"ActorMetadata":{"type":"object","properties":{"gdrive":{"$ref":"#/components/schemas/GdriveUserMetadata"},"salesforce":{"$ref":"#/components/schemas/SalesforceUserMetadata"},"endpointAgent":{"$ref":"#/components/schemas/AgentUserMetadata"}}},"GdriveUserMetadata":{"type":"object","properties":{"userBelongsToGroups":{"type":"array","items":{"type":"string"},"description":"Groups the user belongs to"},"isAdmin":{"type":"boolean","description":"Whether the user is an admin"},"isSuspended":{"type":"boolean","description":"Whether the user is suspended"},"createdAt":{"type":"integer","nullable":true,"description":"Timestamp when the user was created"}}},"SalesforceUserMetadata":{"type":"object","description":"Salesforce user metadata (currently empty as per spec)"},"AgentUserMetadata":{"type":"object","properties":{"deviceID":{"type":"string","description":"ID of the device"},"machineName":{"type":"string","description":"Name of the machine/device"}}},"AssetMetadata":{"type":"object","properties":{"gdrive":{"$ref":"#/components/schemas/GdriveResourceMetadata"},"salesforce":{"$ref":"#/components/schemas/SalesforceResourceMetadata"},"endpointAgent":{"$ref":"#/components/schemas/EndpointAgentResourceMetadata"}}},"GdriveResourceMetadata":{"type":"object","properties":{"fileID":{"type":"string","description":"ID of the file"},"fileName":{"type":"string","description":"Name of the file"},"fileSize":{"type":"string","description":"Size of the file"},"fileLink":{"type":"string","description":"Link to the file"},"permissionSetting":{"type":"string","description":"Permission setting for the file"},"sharingExternalUsers":{"type":"array","items":{"type":"string"},"description":"External users with whom the file is shared"},"sharingInternalUsers":{"type":"array","items":{"type":"string"},"description":"Internal users with whom the file is shared"},"canViewersDownload":{"type":"boolean","description":"Whether viewers can download the file"},"fileOwner":{"type":"string","description":"Owner of the file"},"isInTrash":{"type":"boolean","description":"Whether the file is in trash"},"createdAt":{"type":"integer","nullable":true,"description":"Timestamp when the file was created"},"updatedAt":{"type":"integer","nullable":true,"description":"Timestamp when the file was last updated"},"drive":{"type":"string","description":"Drive where the file is located"},"labels":{"type":"array","items":{"type":"string"},"description":"Labels associated with the file"},"filePermissionType":{"type":"string","description":"Type of file permission"}}},"SalesforceResourceMetadata":{"type":"object","properties":{"resourceType":{"type":"string","description":"Type of Salesforce resource"},"fileResourceMetadata":{"$ref":"#/components/schemas/SalesforceFileResourceMetadata"},"reportResourceMetadata":{"$ref":"#/components/schemas/SalesforceReportResourceMetadata"},"bulkApiResourceMetadata":{"$ref":"#/components/schemas/SalesforceBulkApiResourceMetadata"}}},"SalesforceFileResourceMetadata":{"type":"object","properties":{"fileAction":{"type":"string","description":"Action performed on the file"},"sourceIP":{"type":"string","description":"Source IP address"},"sessionLevel":{"type":"string","description":"Level of the session"}}},"SalesforceReportResourceMetadata":{"type":"object","properties":{"description":{"type":"string","description":"Description of the report"},"displayEntityFields":{"type":"array","items":{"type":"string","description":"Entity fields displayed in the report"}},"dashboardName":{"type":"string","description":"Name of the dashboard"},"scope":{"type":"string","description":"Scope of the report"},"operation":{"type":"string","description":"Operation performed"},"recordCount":{"type":"integer","format":"int64","description":"Number of records"},"queriedEntities":{"type":"array","items":{"type":"string"},"description":"Entities queried in the report"},"groupedColumnHeaders":{"type":"array","items":{"type":"string"},"description":"Grouped column headers"},"columnCount":{"type":"integer","format":"int64","description":"Number of columns"},"processedRowCount":{"type":"integer","format":"int64","description":"Number of rows processed"},"sourceIP":{"type":"string","description":"Source IP address"},"eventSource":{"type":"string","description":"Source of the event"},"sessionLevel":{"type":"string","description":"Level of the session"}}},"SalesforceBulkApiResourceMetadata":{"type":"object","properties":{"query":{"type":"string","description":"Query executed"},"eventIdentifier":{"type":"string","description":"Identifier of the event"},"sourceIP":{"type":"string","description":"Source IP address"},"sessionKey":{"type":"string","description":"Key of the session"},"sessionLevel":{"type":"string","description":"Level of the session"}}},"EndpointAgentResourceMetadata":{"type":"object","properties":{"medium":{"type":"string","description":"Medium used","$ref":"#/components/schemas/EndpointAgentMedium"},"mediumName":{"type":"string","description":"Name of the medium"},"user":{"type":"string","description":"User of the endpoint agent"}}},"EndpointAgentMedium":{"type":"string","enum":["EXFIL_MEDIUM_USB","EXFIL_MEDIUM_BROWSER","MEDIUM_CLOUD_SYNC","MEDIUM_FILE_DRAG_DROP","MEDIUM_FILE_PRINT","MEDIUM_FILE_COPY","MEDIUM_FILE_MOVE","MEDIUM_FILE_DELETE","MEDIUM_FILE_RENAME"]},"Event":{"type":"object","description":"the events in SaaS app / endpoint which lead to creation of the exfiltration event","properties":{"type":{"type":"string","description":"Type of the event","$ref":"#/components/schemas/EventType"},"timestamp":{"type":"integer","description":"Timestamp of the event"},"metadata":{"type":"object","description":"Metadata associated with the event","$ref":"#/components/schemas/EventMetadata"},"assetIDs":{"type":"array","description":"asset IDs associated with the event","items":{"type":"string"}}}},"EventType":{"type":"string","enum":["DOWNLOAD","ENDPOINTDLP_BROWSER_UPLOAD","ENDPOINTDLP_CLOUD_SYNC","PASTE"]},"EventMetadata":{"type":"object","properties":{"endpointAgent":{"$ref":"#/components/schemas/EndpointEventMetadata"},"gdrive":{"$ref":"#/components/schemas/GdriveEventMetadata"},"salesforce":{"$ref":"#/components/schemas/SalesforceEventMetadata"}}},"EndpointEventMetadata":{"type":"object","properties":{"endpointBrowserUploadMetadata":{"$ref":"#/components/schemas/EndpointBrowserUploadMetadata"},"endpointCloudSyncMetadata":{"$ref":"#/components/schemas/EndpointCloudSyncMetadata"},"endpointClipboardMetadata":{"$ref":"#/components/schemas/EndpointClipboardMetadata"}}},"EndpointBrowserUploadMetadata":{"type":"object","properties":{"browserName":{"type":"string","description":"Name of the browser"},"browserVersion":{"type":"string","description":"Version of the browser"},"domain":{"type":"string","description":"Domain where the upload occurred"},"browserTabURL":{"type":"string","description":"URL of the active browser tab"},"browserTabTitle":{"type":"string","description":"Title of the active browser tab"},"uploadStartTime":{"type":"integer","description":"Unix timestamp when the upload started"},"uploadEndTime":{"type":"integer","description":"Unix timestamp when the upload ended"},"fileName":{"type":"string","description":"Name of the uploaded file"},"originMetadata":{"type":"array","items":{"$ref":"#/components/schemas/EndpointOriginMetadata"},"description":"Metadata about the origin of the file"}}},"EndpointOriginMetadata":{"type":"object","properties":{"timestamp":{"type":"integer","description":"Unix timestamp of the origin event"},"browserDownloadMetadata":{"$ref":"#/components/schemas/EndpointOriginBrowserDownloadMetadata","description":"Metadata about browser download origin"},"clipboardCopyMetadata":{"$ref":"#/components/schemas/EndpointClipboardCopyMetadata","description":"Metadata about clipboard copy origin"}}},"EndpointOriginBrowserDownloadMetadata":{"type":"object","properties":{"browserName":{"type":"string","description":"Name of the browser"},"browserVersion":{"type":"string","description":"Version of the browser"},"domain":{"type":"string","description":"Domain where the download occurred"},"browserTabURL":{"type":"string","description":"URL of the browser tab"},"browserTabTitle":{"type":"string","description":"Title of the browser tab"},"downloadStartTime":{"type":"integer","format":"int64","description":"Unix timestamp when the download started"},"downloadEndTime":{"type":"integer","format":"int64","description":"Unix timestamp when the download ended"}}},"EndpointClipboardCopyMetadata":{"type":"object","properties":{"contentType":{"type":"string","description":"Type of content copied to clipboard","$ref":"#/components/schemas/ClipboardContentType"},"browserMetadata":{"$ref":"#/components/schemas/BrowserMetadata","description":"Browser metadata related to the clipboard operation"}}},"ClipboardContentType":{"type":"string","enum":["CCT_TEXT","CCT_IMAGE"]},"BrowserMetadata":{"type":"object","properties":{"browserName":{"type":"string","description":"Name of the browser"},"browserVersion":{"type":"string","description":"Version of the browser"},"domain":{"type":"string","description":"Domain of the browser"},"browserTabURL":{"type":"string","description":"URL of the browser tab"},"browserTabTitle":{"type":"string","description":"Title of the browser tab"}}},"EndpointCloudSyncMetadata":{"type":"object","properties":{"app":{"type":"string","description":"Cloud sync application"},"accountType":{"type":"string","description":"Type of account"},"accountName":{"type":"string","description":"Name of the account"},"email":{"type":"string","description":"Email associated with the account"},"destinationFilePath":{"type":"string","description":"Path where the file was synced"},"uploadStartTime":{"type":"integer","description":"Unix timestamp when the upload started"},"uploadEndTime":{"type":"integer","description":"Unix timestamp when the upload ended"},"fileName":{"type":"string","description":"Name of the synced file"}}},"EndpointClipboardMetadata":{"type":"object","properties":{"contentType":{"type":"string","description":"Type of content in the clipboard"},"originMetadata":{"type":"array","items":{"$ref":"#/components/schemas/EndpointOriginMetadata"},"description":"Metadata about the origin of the clipboard content"},"destinationMetadata":{"$ref":"#/components/schemas/EndpointClipboardDestinationMetadata","description":"Metadata about the destination of the clipboard content"}}},"EndpointClipboardDestinationMetadata":{"type":"object","properties":{"browserMetadata":{"$ref":"#/components/schemas/BrowserMetadata","description":"Browser metadata for the destination"}}},"GdriveEventMetadata":{"type":"object","properties":{"originatingAppId":{"type":"string","description":"ID of the originating app"},"originatingAppName":{"type":"string","description":"Name of the originating app"},"isClientSyncEvent":{"type":"boolean","description":"Whether this is a client sync event"}}},"SalesforceEventMetadata":{"type":"object","properties":{"sourceIP":{"type":"string","description":"Source IP address"},"sessionLevel":{"type":"string","description":"Level of the session"},"sessionKey":{"type":"string","description":"Key of the session"},"sfUserId":{"type":"string","description":"Salesforce user ID"}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/events/{eventId}":{"get":{"summary":"Fetch exfiltration event details","description":"Fetch an exfiltration event details by ID","parameters":[{"name":"eventId","in":"path","description":"The UUID of the event to fetch","required":true,"schema":{"type":"string","format":"uuid"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExfiltrationEventDetails"}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Event does not exist","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Fetch exfiltration event activity feed

> Fetch the activity feed for a specific exfiltration event

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"ActivityFeedLog":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Unique identifier for the activity log entry"},"message":{"type":"string","description":"Human-readable message describing the activity"},"timestamp":{"type":"integer","description":"Unix timestamp in seconds when the activity occurred"},"type":{"allOf":[{"$ref":"#/components/schemas/ActivityLogType"}],"description":"Type of activity"},"data":{"allOf":[{"$ref":"#/components/schemas/LogData"}],"description":"Optional structured data for the activity log"}}},"ActivityLogType":{"type":"string","enum":["CREATION","ANALYST_ACTION","STATUS_CHANGE","ANALYST_COMMENT","ANALYST_ANNOTATION","DATA_EXPOSURE","END_USER_VIOLATION_ANNOTATION","AUTOMATED_ACTION","DELAYED_REMEDIATION","END_USER_ACTION","ANALYST_USER_INFO_ANNOTATION","RISK_SCORE_UPDATE","ANALYST_ACTION_FAILED","AUTOMATED_ACTION_FAILED","POLICIES_UPDATE","DELAYED_REMEDIATION_UPDATE","AUTOMATED_ACTION_SKIPPED"]},"LogData":{"oneOf":[{"$ref":"#/components/schemas/AnalystActionLog"},{"$ref":"#/components/schemas/StatusChangeLog"},{"$ref":"#/components/schemas/AnalystCommentLog"},{"$ref":"#/components/schemas/AnalystAnnotationLog"},{"$ref":"#/components/schemas/DataExposureLog"},{"$ref":"#/components/schemas/EndUserViolationAnnotationLog"},{"$ref":"#/components/schemas/AutomatedActionLog"},{"$ref":"#/components/schemas/DelayedRemediationLog"},{"$ref":"#/components/schemas/EndUserActionLog"},{"$ref":"#/components/schemas/AnalystUserInfoAnnotationLog"},{"$ref":"#/components/schemas/RiskScoreUpdateLog"},{"$ref":"#/components/schemas/AnalystActionFailedLogData"},{"$ref":"#/components/schemas/AutomatedActionFailedLogData"},{"$ref":"#/components/schemas/PoliciesUpdateLogData"},{"$ref":"#/components/schemas/DelayedRemediationUpdateLogData"},{"$ref":"#/components/schemas/AutomatedActionSkippedLog"}]},"AnalystActionLog":{"type":"object","description":"Log entry for an action taken by an analyst.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The action taken by the analyst"},"userUUID":{"type":"string","format":"uuid","description":"UUID of the user who took the action"},"userName":{"type":"string","description":"Name of the user who took the action"},"userEmail":{"type":"string","description":"Email of the user who took the action"},"receiverEmail":{"type":"string","description":"Email of the receiver (if applicable)"},"actionLogData":{"allOf":[{"$ref":"#/components/schemas/ActionLogData"}],"description":"Additional data related to the action log"}}},"DisplayAction":{"type":"string","enum":["ACKNOWLEDGE","NOTIFY","REDACT","QUARANTINE","ALLOW_QUARANTINE","REJECT_QUARANTINE","REMOVE_INTERNAL_USERS","REMOVE_EXTERNAL_USERS","DOMAIN_WIDE_LINK","RESTRICTED_LINK","DELETE","IGNORE","NOTIFY_SLACK","NOTIFY_EMAIL","UNACKNOWLEDGE","DISABLE_DOWNLOAD","ENCRYPT","BLOCK","CREATE_JIRA_ISSUE","MARK_AS_PRIVATE","DELETE_ATTACHMENT","RELEASE","UNDO","BULK_ANNOTATE_FALSE_POSITIVE","BULK_ANNOTATE_BUSINESS_JUSTIFICATION","RESOLVE","MANUAL_UNDO","NOTIFY_TEAMS","NOTIFY_GITHUB","SUSPEND_ACCOUNT","RELEASE_EMAIL","QUARANTINE_EMAIL","HARD_DELETE","SOFT_DELETE","RESTRICT_TO_OWNER","APPLY_LABELS","DISABLE_FORWARDING","SET_EXPIRATION","PERSISTENT_PROTECTION","FREEZE_USER","RESTRICT_DOWNLOAD_PROFILE","UNFREEZE_USER","REVOKE_ACCESS","ANNOTATE_VIOLATION_FALSE_POSITIVE_AND_RESOLVE","DELETE_FILE","BLOCK_UPLOAD","RISK_ANNOTATION","BLOCK_TRANSFER","NOTIFY_DEVICE","APPROVE_BUSINESS_JUSTIFICATION"]},"ActionLogData":{"type":"object","description":"Additional data related to the action log","properties":{"applyLabelsActionLogData":{"$ref":"#/components/schemas/ApplyLabelsActionLogData"},"setExpirationActionLogData":{"$ref":"#/components/schemas/SetExpirationActionLogData"},"revokeAccessActionLogData":{"$ref":"#/components/schemas/RevokeAccessActionLogData"},"notifyEmailActionLogData":{"$ref":"#/components/schemas/NotifyEmailActionLogData"},"genericActionLogData":{"$ref":"#/components/schemas/GenericActionLogData"},"blockActionActionLogData":{"$ref":"#/components/schemas/BlockActionActionLogData"}}},"ApplyLabelsActionLogData":{"type":"object","properties":{"activityType":{"description":"The type of label activity performed","allOf":[{"$ref":"#/components/schemas/LabelingActivityType"}]},"labels":{"type":"array","items":{"type":"string"},"description":"List of labels applied"},"labelUpdatesOnResource":{"type":"object","additionalProperties":{"type":"string"},"description":"Map of resource to label updates"},"failureReason":{"type":"string","description":"Reason for failure, if any"}}},"LabelingActivityType":{"type":"string","enum":["LABELS_SUCCESSFULLY_APPLIED","LABELS_FAILED_TO_APPLY","LABELS_UPDATED_ON_RESOURCE","LABELING_ACTIVITY_TYPE_UNSPECIFIED"]},"SetExpirationActionLogData":{"type":"object","properties":{"expirationTime":{"type":"integer","description":"Expiration time as a Unix timestamp (seconds)"}}},"RevokeAccessActionLogData":{"type":"object","properties":{"revokedEmails":{"type":"array","items":{"type":"string"},"description":"List of emails whose access was revoked"},"unRevokedEmails":{"type":"array","items":{"type":"string"},"description":"List of emails whose access was restored"}}},"NotifyEmailActionLogData":{"type":"object","properties":{"receiverEmail":{"type":"string","description":"Email of the receiver of the notification"}}},"GenericActionLogData":{"type":"object","properties":{"additionalContext":{"type":"string","description":"Additional context about the action taken"}}},"BlockActionActionLogData":{"type":"object","description":"Additional data related to a block action","properties":{"isBlocked":{"type":"boolean","description":"Whether the action was a hard block"},"blockReason":{"type":"string","description":"Reason the block was applied (set when isBlocked is true)"},"skippedReason":{"type":"string","description":"Reason the block was skipped (set when isBlocked is false)"}}},"StatusChangeLog":{"type":"object","description":"Log entry for a change in status of a violation or finding.","properties":{"newStatus":{"allOf":[{"$ref":"#/components/schemas/ViolationStatus"}],"description":"The new status after the change"}}},"ViolationStatus":{"type":"string","enum":["ACTIVE","PENDING","QUARANTINED","ACTIONED","ARCHIVED","REPORTED","IGNORED","PENDING_ACTION","REVIEWING","SCHEDULED_REMEDIATION","ACTION_FAILED"]},"AnalystCommentLog":{"type":"object","description":"Log entry for a comment made by an analyst.","properties":{"userUUID":{"type":"string","format":"uuid","description":"UUID of the user who made the comment (if the comment is made by non system user)"},"userName":{"type":"string","description":"System user if comment added by system"}}},"AnalystAnnotationLog":{"type":"object","description":"Log entry for an annotation made by an analyst.","properties":{"userUUID":{"type":"string","format":"uuid","description":"UUID of the user who made the annotation (if the annotation is made by non system user)"},"userName":{"type":"string","description":"System user if comment added by system"},"annotationType":{"description":"The type of annotation","allOf":[{"$ref":"#/components/schemas/AnnotationType"}]},"detectorUUID":{"type":"string","description":"Detector UUID associated with the annotation"},"findingCount":{"type":"integer","description":"Number of findings affected"},"autoApplied":{"type":"boolean","description":"Whether the annotation was auto-applied"},"logType":{"description":"The log type","allOf":[{"$ref":"#/components/schemas/AnalystAnnotationLogType"}]},"redactedQuote":{"type":"string","description":"Redacted sensitive data"}}},"AnnotationType":{"type":"string","enum":["DETECTOR_FALSE_POSITIVE","COMPANY_IGNORED_FALSE_POSITIVE","DETECTOR_TRUE_POSITIVE"]},"AnalystAnnotationLogType":{"type":"string","enum":["ANNOTATION_ADDED","ANNOTATION_UPDATED","ANNOTATION_REMOVED"]},"DataExposureLog":{"type":"object","description":"Log entry for a data exposure event.","properties":{"userName":{"type":"string","description":"Name of the user who triggered the data exposure event"},"userEmail":{"type":"string","description":"Email of the user who triggered the data exposure event"},"detectorUUID":{"type":"string","description":"Detector UUID associated with the data exposure event"},"findingCount":{"type":"integer","description":"Number of findings affected by the data exposure event"},"redactedQuote":{"type":"string","description":"Redacted sensitive data involved in the exposure"},"dataExposureType":{"description":"The type of data exposure","allOf":[{"$ref":"#/components/schemas/DataExposureType"}]}}},"DataExposureType":{"type":"string","enum":["FINDINGS_ADDED","FINDINGS_REMOVED"]},"EndUserViolationAnnotationLog":{"type":"object","description":"Log entry for an annotation made by an end user on a violation.","properties":{"annotationType":{"description":"The type of annotation","allOf":[{"$ref":"#/components/schemas/AnnotationType"}]},"userName":{"type":"string","description":"Name of the end user who made the annotation"},"userEmail":{"type":"string","description":"Email of the end user who made the annotation"}}},"AutomatedActionLog":{"type":"object","description":"Log entry for an automated action taken by the system.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The automated action performed"},"policyUUIDs":{"type":"array","items":{"type":"string"},"description":"List of policy UUIDs associated with the automated action"},"receiverEmail":{"type":"string","description":"Email address of the receiver of the automated action"},"actionLogData":{"$ref":"#/components/schemas/ActionLogData"}}},"DelayedRemediationLog":{"type":"object","description":"Log entry for a delayed remediation event.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The delayed remediation action performed"},"policyUUIDs":{"type":"array","items":{"type":"string"},"description":"List of policy UUIDs associated with the delayed remediation action"},"expectedRemediationTime":{"type":"integer","description":"Expected remediation time in seconds"}}},"EndUserActionLog":{"type":"object","description":"Log entry for an action taken by an end user.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The action taken by the end user"},"userName":{"type":"string","description":"Name of the end user who took the action"},"userEmail":{"type":"string","description":"Email of the end user who took the action"},"actionLogData":{"$ref":"#/components/schemas/ActionLogData"}}},"AnalystUserInfoAnnotationLog":{"type":"object","description":"Log entry for an annotation of user info by an analyst.","properties":{"userUUID":{"type":"string","format":"uuid","description":"UUID of the user who made the annotation (if the annotation is made by non system user)"},"userName":{"type":"string","description":"System user if comment added by system"}}},"RiskScoreUpdateLog":{"type":"object","description":"Log entry for an update to the risk score label.","properties":{"prevLabel":{"description":"The previous risk score label before the update","allOf":[{"$ref":"#/components/schemas/ViolationRisk"}]},"newLabel":{"description":"The new risk score label after the update","allOf":[{"$ref":"#/components/schemas/ViolationRisk"}]},"cause":{"description":"The cause or reason for the risk score label update","allOf":[{"$ref":"#/components/schemas/RiskScoreUpdateCause"}]}}},"ViolationRisk":{"type":"string","enum":["UNSPECIFIED","LOW","MEDIUM","HIGH","CRITICAL","NO_RISK"]},"RiskScoreUpdateCause":{"type":"string","enum":["FINDINGS_DEDUPED","FINDINGS_ANNOTATION","USER_OVERRIDE","UNSPECIFIED"]},"AnalystActionFailedLogData":{"type":"object","properties":{"action":{"type":"string","description":"The action that failed"},"userUUID":{"type":"string","format":"uuid","description":"UUID of the user who attempted the action"},"userName":{"type":"string","description":"Name of the user who attempted the action"},"userEmail":{"type":"string","description":"Email of the user who attempted the action"},"failureReason":{"type":"string","description":"Reason for the failure"}}},"AutomatedActionFailedLogData":{"type":"object","properties":{"action":{"type":"string","description":"The automated action that failed"},"policyUUIDs":{"type":"array","items":{"type":"string","format":"uuid"},"description":"List of policy UUIDs associated with the action"},"failureReason":{"type":"string","description":"Reason for the failure"}}},"PoliciesUpdateLogData":{"type":"object","description":"Log entry for policy changes","properties":{"addedPolicyUUIDs":{"type":"array","items":{"type":"string","format":"uuid"},"description":"List of policy UUIDs that were added on a violation update"},"removedPolicyUUIDs":{"type":"array","items":{"type":"string","format":"uuid"},"description":"List of policy UUIDs that were removed on a violation update"}}},"DelayedRemediationUpdateLogData":{"type":"object","description":"Log entry for a delayed remediation action update event.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The delayed remediation action that was updated"},"policyUUIDs":{"type":"array","items":{"type":"string","format":"uuid"},"description":"List of policy UUIDs associated with the delayed remediation action, empty implies remediation was canceled"},"removedPolicyUUIDs":{"type":"array","items":{"type":"string","format":"uuid"},"description":"List of policy UUIDs that were removed from the delayed remediation action"},"expectedRemediationTime":{"type":"integer","description":"Expected remediation time in seconds"}}},"AutomatedActionSkippedLog":{"type":"object","description":"Log entry for an automated action that was skipped by the system.","properties":{"action":{"allOf":[{"$ref":"#/components/schemas/DisplayAction"}],"description":"The automated action that was skipped"},"policyUUIDs":{"type":"array","items":{"type":"string"},"description":"List of policy UUIDs associated with the skipped action"},"actionLogData":{"$ref":"#/components/schemas/ActionLogData"}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/events/{eventId}/activity":{"get":{"summary":"Fetch exfiltration event activity feed","description":"Fetch the activity feed for a specific exfiltration event","parameters":[{"name":"eventId","in":"path","description":"The UUID of the exfiltration event","required":true,"schema":{"type":"string","format":"uuid"}},{"name":"limit","in":"query","description":"Number of activity items to fetch in one page","schema":{"type":"integer","format":"int32","maximum":100,"default":50}},{"name":"createdAfter","in":"query","description":"Unix timestamp in seconds, filters activity created > the value","schema":{"type":"integer"}},{"name":"createdBefore","in":"query","description":"Unix timestamp in seconds, filters activity created < the value","schema":{"type":"integer"}},{"name":"descending","in":"query","description":"Whether to sort results in descending order (default false)","schema":{"type":"boolean","default":false}},{"name":"pageToken","in":"query","description":"Cursor for getting the next page of results","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"activities":{"type":"array","items":{"$ref":"#/components/schemas/ActivityFeedLog"}},"nextPageToken":{"type":"string","description":"Next page cursor, omitted if end of results reached"}}}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Event does not exist","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Fetch asset activity

> Fetch the activity history for a specific asset

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Activity":{"type":"object","properties":{"type":{"type":"string","description":"Type of the activity","$ref":"#/components/schemas/ActivityType"},"userEmail":{"type":"string","format":"email","description":"Email of the user who performed the activity"},"eventTime":{"type":"integer","description":"Unix timestamp in seconds indicating when the activity occurred"},"assetNames":{"type":"array","items":{"type":"string"},"description":"Names of assets involved in the activity"},"metadata":{"$ref":"#/components/schemas/ActivityMetadata","description":"Metadata associated with the activity"}}},"ActivityType":{"type":"string","enum":["DOWNLOAD","PERMISSION_CHANGE","ADD_EXTERNAL_USER","ENDPOINTDLP_CONNECTION","ENDPOINTDLP_FILE_TRANSFER","VIEW","EDIT","PRINT","COPY","CREATE","ENDPOINTDLP_BROWSER_UPLOAD","ENDPOINTDLP_CLOUD_SYNC","PASTE","UPLOAD","TARGET_COPY"]},"ActivityMetadata":{"type":"object","properties":{"downloadEventMetadata":{"$ref":"#/components/schemas/DownloadActivityMetadata"},"browserUploadMetadata":{"$ref":"#/components/schemas/BrowserUploadActivityMetadata"},"cloudSyncMetadata":{"$ref":"#/components/schemas/CloudSyncActivityMetadata"},"clipboardMetadata":{"$ref":"#/components/schemas/ClipboardActivityMetadata"}}},"DownloadActivityMetadata":{"type":"object","properties":{"source":{"type":"string","description":"Source of the download"},"fileName":{"type":"string","description":"Name of the downloaded file"}}},"BrowserUploadActivityMetadata":{"type":"object","properties":{"domain":{"type":"string","description":"Domain where the upload occurred"},"fileName":{"type":"string","description":"Name of the uploaded file"}}},"CloudSyncActivityMetadata":{"type":"object","properties":{"cloudApp":{"type":"string","description":"Cloud application used for synchronization"},"fileName":{"type":"string","description":"Name of the synchronized file"}}},"ClipboardActivityMetadata":{"type":"object","properties":{"browserMetadata":{"$ref":"#/components/schemas/BrowserActivityMetadata"},"thickAppMetadata":{"$ref":"#/components/schemas/ThickAppActivityMetadata"},"genericAppMetadata":{"$ref":"#/components/schemas/GenericAppActivityMetadata"},"appType":{"type":"string","description":"Type of app involved in the clipboard event (e.g. CAT_BROWSER, CAT_THICK_APP, CAT_GENERIC_APP)"}}},"BrowserActivityMetadata":{"type":"object","properties":{"domain":{"type":"string","description":"Domain related to the clipboard activity"}}},"ThickAppActivityMetadata":{"type":"object","properties":{"thickApp":{"type":"string","description":"Thick app identifier (e.g. THICK_APP_SLACK, THICK_APP_OUTLOOK)"}}},"GenericAppActivityMetadata":{"type":"object","properties":{"appName":{"type":"string","description":"Name of the generic application"}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/asset/activity":{"get":{"summary":"Fetch asset activity","description":"Fetch the activity history for a specific asset","parameters":[{"name":"assetID","in":"query","description":"The ID of the asset to fetch activities for","required":true,"schema":{"type":"string"}},{"name":"rangeStart","in":"query","description":"Unix timestamp in seconds, filters activities created ≥ the value","required":true,"schema":{"type":"integer"}},{"name":"rangeEnd","in":"query","description":"Unix timestamp in seconds, filters activities created < the value","required":true,"schema":{"type":"integer"}},{"name":"pageToken","in":"query","description":"Cursor for getting the next page of results","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"activities":{"type":"array","items":{"$ref":"#/components/schemas/Activity"}},"nextPageToken":{"type":"string","description":"Next page cursor, omitted if end of results reached"}}}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Fetch actor activity

> Fetch the activity history for a specific actor

```json
{"openapi":"3.0.3","info":{"title":"Nightfall Workflow Exfiltration API","version":"1.0.0"},"servers":[{"url":"https://api.nightfall.ai/exfiltration/v1"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Activity":{"type":"object","properties":{"type":{"type":"string","description":"Type of the activity","$ref":"#/components/schemas/ActivityType"},"userEmail":{"type":"string","format":"email","description":"Email of the user who performed the activity"},"eventTime":{"type":"integer","description":"Unix timestamp in seconds indicating when the activity occurred"},"assetNames":{"type":"array","items":{"type":"string"},"description":"Names of assets involved in the activity"},"metadata":{"$ref":"#/components/schemas/ActivityMetadata","description":"Metadata associated with the activity"}}},"ActivityType":{"type":"string","enum":["DOWNLOAD","PERMISSION_CHANGE","ADD_EXTERNAL_USER","ENDPOINTDLP_CONNECTION","ENDPOINTDLP_FILE_TRANSFER","VIEW","EDIT","PRINT","COPY","CREATE","ENDPOINTDLP_BROWSER_UPLOAD","ENDPOINTDLP_CLOUD_SYNC","PASTE","UPLOAD","TARGET_COPY"]},"ActivityMetadata":{"type":"object","properties":{"downloadEventMetadata":{"$ref":"#/components/schemas/DownloadActivityMetadata"},"browserUploadMetadata":{"$ref":"#/components/schemas/BrowserUploadActivityMetadata"},"cloudSyncMetadata":{"$ref":"#/components/schemas/CloudSyncActivityMetadata"},"clipboardMetadata":{"$ref":"#/components/schemas/ClipboardActivityMetadata"}}},"DownloadActivityMetadata":{"type":"object","properties":{"source":{"type":"string","description":"Source of the download"},"fileName":{"type":"string","description":"Name of the downloaded file"}}},"BrowserUploadActivityMetadata":{"type":"object","properties":{"domain":{"type":"string","description":"Domain where the upload occurred"},"fileName":{"type":"string","description":"Name of the uploaded file"}}},"CloudSyncActivityMetadata":{"type":"object","properties":{"cloudApp":{"type":"string","description":"Cloud application used for synchronization"},"fileName":{"type":"string","description":"Name of the synchronized file"}}},"ClipboardActivityMetadata":{"type":"object","properties":{"browserMetadata":{"$ref":"#/components/schemas/BrowserActivityMetadata"},"thickAppMetadata":{"$ref":"#/components/schemas/ThickAppActivityMetadata"},"genericAppMetadata":{"$ref":"#/components/schemas/GenericAppActivityMetadata"},"appType":{"type":"string","description":"Type of app involved in the clipboard event (e.g. CAT_BROWSER, CAT_THICK_APP, CAT_GENERIC_APP)"}}},"BrowserActivityMetadata":{"type":"object","properties":{"domain":{"type":"string","description":"Domain related to the clipboard activity"}}},"ThickAppActivityMetadata":{"type":"object","properties":{"thickApp":{"type":"string","description":"Thick app identifier (e.g. THICK_APP_SLACK, THICK_APP_OUTLOOK)"}}},"GenericAppActivityMetadata":{"type":"object","properties":{"appName":{"type":"string","description":"Name of the generic application"}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"A status code to uniquely describe this error."},"message":{"type":"string","description":"A message associated with the status code."},"description":{"type":"string","description":"Additional details to explain what may have occurred. Omitted if empty."}}}}},"paths":{"/actor/activity":{"get":{"summary":"Fetch actor activity","description":"Fetch the activity history for a specific actor","parameters":[{"name":"actorID","in":"query","description":"The Nightfall ID of the actor to fetch activities for","required":true,"schema":{"type":"string"}},{"name":"rangeStart","in":"query","description":"Unix timestamp in seconds, filters activities created ≥ the value","required":true,"schema":{"type":"integer"}},{"name":"rangeEnd","in":"query","description":"Unix timestamp in seconds, filters activities created < the value","required":true,"schema":{"type":"integer"}},{"name":"pageToken","in":"query","description":"Cursor for getting the next page of results","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","headers":{"X-Rate-Limit-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next second before being throttled"}},"X-Quota-Remaining":{"schema":{"type":"integer","description":"How many remaining requests you can make within the next quota period"}},"X-Quota-Period-End":{"schema":{"type":"string","format":"date-time","description":"When the current quota period expires"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"activities":{"type":"array","items":{"$ref":"#/components/schemas/Activity"}},"nextPageToken":{"type":"string","description":"Next page cursor, omitted if end of results reached"}}}}}},"400":{"description":"Invalid request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate Limit Exceeded or Daily Quota Exceeded","headers":{"Retry-After":{"schema":{"type":"integer","description":"Seconds after which to retry the request"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Nightfall Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```