1 of 12

DLP APIs - Native SaaS Apps

The native SaaS app APIs can be utilized by customers using Nightfall’s SaaS apps, supported natively, to fetch violations, search violations by app meta-data attributes, and fetch findings within violations. These DLP APIs do not provide access to violations for apps scanned via the developer platform. These APIs require you to create an API key as outlined in the . However, to use these APIs, you need not create any detectors, detection rules, and policies in the developer platform.

If you are using Nightfall SaaS apps, you can use APIs to fetch violations, search through the violations, and fetch specific findings within the Violations. To scan data in any custom apps or cloud infrastructure services like AWS S3, you must use the APIs in the section.

Fetch Violations

Fetch Violations by ID

Search Violations

Fetch Violation Findings

Take Action on Violations

Fetch Annotations

Annotate Findings

Remove Annotation Findings

Fetch GitHub Repositories

Policy User Scope Update API

Rate Limits for Native SaaS app APIs

To prevent misuse and ensure the stability of our platform, we enforce a rate limit on an API Key and endpoint basis, similar to the way many other APIs enforce rate limits.

When operating under our Free plan, accounts and their corresponding API Keys have a rate limit of 5 requests per second on average, with support for bursts of 15 requests per second. If you upgrade to a paid plan – the Enterprise plan – this rate increases to a limit of 10 requests per second on average and bursts of 50 requests per second.

Plan

Requests Per Second (Avg)

Burst

Free

Enterprise

The Nightfall API follows standard practices and conventions to signal when these rate limits have been exceeded.

Successful requests return a header X-Rate-Limit-Remaining with the integer number of requests remaining before errors will be returned to the client.

When your application exceeds the rate limit for a given API endpoint, the Nightfall API will return an HTTP response code of 429 "Too Many Requests.” If your use case requires increased rate limiting, please reach out to support@nightfall.ai.

Additionally, these unsuccessful requests return the number of seconds to wait before retrying the request in a Retry-After Header.

Request Rate Limiting

Your Request Rate Limiting throttles how frequently you can make requests to the API. You can monitor your rate limit usage via the `X-Rate-Limit-Remaining` header, which tells you how many remaining requests you can make within the next second before being throttled.

Quotas

Your Quota limits how many requests you can make within a given period. Your current remaining quota and the end of your current quota period are denoted by the following response headers.

Response Headers

Type

Description

X-Quota-Remaining

string

The requests remaining in your quota for this period. Will be reset to the amount specified in your billing plan at the end of your quota cycle.

X-Quota-Period-End

datetime

The date and time at which your quota will be reset, encoded as a string in the RFS-3339 format.

For the free plan, we allow 5 requests per second and 10000 requests in a day.

Rate Limits for Native SaaS app APIs

To prevent misuse and ensure the stability of our platform, we enforce a rate limit on an API Key and endpoint basis, similar to the way many other APIs enforce rate limits.

Plan

Requests Per Second (Avg)

Burst

Free

Enterprise

The Nightfall API follows standard practices and conventions to signal when these rate limits have been exceeded.

Successful requests return a header X-Rate-Limit-Remaining with the integer number of requests remaining before errors will be returned to the client.

Additionally, these unsuccessful requests return the number of seconds to wait before retrying the request in a Retry-After Header.

Request Rate Limiting

Quotas

Your Quota limits how many requests you can make within a given period. Your current remaining quota and the end of your current quota period are denoted by the following response headers.

Response Headers

Type

Description

X-Quota-Remaining

string

The requests remaining in your quota for this period. Will be reset to the amount specified in your billing plan at the end of your quota cycle.

X-Quota-Period-End

datetime

The date and time at which your quota will be reset, encoded as a string in the RFS-3339 format.

For the free plan, we allow 5 requests per second and 10000 requests in a day.

Fetch violation

Fetch a violation by ID

get

/violations/{violationId}

Authorizations

Path parameters

violationIdstring uuidrequired

The UUID of the violation to fetch

Responses

application/json

cURL

JavaScript

Python

HTTP

curl -L \
  --url 'https://api.nightfall.ai/dlp/v1/violations/{violationId}' \
  --header 'Authorization: Bearer YOUR_SECRET_TOKEN'

200

400

401

404

429

500

{
  "userInfo": {
    "username": "text",
    "userEmail": "text"
  },
  "id": "text",
  "integration": "SLACK",
  "createdAt": 1,
  "updatedAt": 1,
  "state": "ACTIVE",
  "resourceLink": "text",
  "metadata": {
    "slackMetadata": {
      "location": "text",
      "locationType": "text",
      "username": "text",
      "userID": "text",
      "messagePermalink": "text",
      "locationMemberCount": 1,
      "channelID": "text",
      "workspaceName": "text",
      "locationMembers": [
        "text"
      ]
    },
    "confluenceMetadata": {
      "itemName": "text",
      "itemType": "text",
      "isArchived": true,
      "createdAt": 1,
      "updatedAt": 1,
      "spaceName": "text",
      "spaceKey": "text",
      "spaceNameLink": "text",
      "parentPageName": "text",
      "authorName": "text",
      "authorEmail": "text",
      "authorNameLink": "text",
      "permalink": "text",
      "confluenceID": "text",
      "confluenceUserID": "text",
      "itemVersion": 1,
      "parentPageID": "text",
      "parentVersion": 1,
      "labels": [
        "text"
      ]
    },
    "gdriveMetadata": {
      "fileID": "text",
      "fileName": "text",
      "fileType": "text",
      "fileSize": "text",
      "fileLink": "text",
      "permissionSetting": "text",
      "canViewersDownload": true,
      "fileOwner": "text",
      "isInTrash": true,
      "createdAt": 1,
      "updatedAt": 1,
      "drive": "text",
      "updatedBy": "text",
      "sharingExternalUsers": [
        "text"
      ],
      "sharingInternalUsers": [
        "text"
      ]
    },
    "jiraMetadata": {
      "projectName": "text",
      "ticketNumber": "text",
      "projectType": "text",
      "issueID": "text",
      "projectLink": "text",
      "ticketLink": "text",
      "commentLink": "text",
      "attachmentLink": "text"
    },
    "githubMetadata": {
      "branchName": "text",
      "organization": "text",
      "repository": "text",
      "authorEmail": "text",
      "authorUsername": "text",
      "createdAt": 1,
      "isRepoPrivate": true,
      "filePath": "text",
      "githubPermalink": "text",
      "repositoryOwner": "text",
      "githubRepoLink": "text"
    },
    "salesforceMetadata": {
      "orgName": "text",
      "recordID": "text",
      "objectName": "text",
      "contentType": "text",
      "userID": "text",
      "userName": "text",
      "updatedAt": 1,
      "fileType": "text",
      "attachmentLink": "text",
      "attachmentName": "text",
      "objectLink": "text",
      "fields": [
        "text"
      ]
    },
    "zendeskMetadata": {
      "ticketStatus": "text",
      "ticketTitle": "text",
      "ticketRequestor": "text",
      "ticketGroupAssignee": "text",
      "ticketAgentAssignee": "text",
      "currentUserRole": "text",
      "ticketID": 1,
      "ticketTags": "text",
      "createdAt": 1,
      "UpdatedAt": 1,
      "location": "text",
      "subLocation": "text",
      "ticketCommentID": 1,
      "ticketGroupID": 1,
      "ticketGroupLink": "text",
      "ticketAgentID": 1,
      "ticketAgentLink": "text",
      "ticketEvent": "text",
      "userRole": "text",
      "attachmentName": "text",
      "attachmentLink": "text",
      "ticketFollowers": [
        "text"
      ]
    },
    "notionMetadata": {
      "createdBy": "text",
      "updatedBy": "text",
      "workspaceName": "text",
      "workspaceLink": "text",
      "pageID": "text",
      "pageTitle": "text",
      "createdAt": 1,
      "updatedAt": 1,
      "privatePageLink": "text",
      "publicPageLink": "text",
      "sharedExternally": true,
      "attachmentID": "text"
    },
    "browserMetadata": {
      "location": "text",
      "subLocation": "text",
      "browserName": "text",
      "userComment": "text"
    },
    "m365TeamsMetadata": {
      "teamName": "text",
      "tenantID": "text",
      "tenantDomain": "text",
      "teamID": "text",
      "teamVisibility": "text",
      "teamWebURL": "text",
      "channelID": "text",
      "channelName": "text",
      "channelType": "text",
      "channelWebURL": "text",
      "messageID": "text",
      "createdAt": 1,
      "updatedAt": 1,
      "chatMessageSender": "text",
      "userID": "text",
      "userPrincipalName": "text",
      "chatMessageImportance": "text",
      "chatID": "text",
      "chatType": "text",
      "chatTopic": "text",
      "chatParticipants": [
        {
          "userID": "text",
          "email": "text",
          "displayName": "text"
        }
      ],
      "attachments": [
        {
          "attachmentID": "text",
          "attachmentName": "text",
          "attachmentURL": "text"
        }
      ]
    },
    "m365OnedriveMetadata": {
      "tenantID": "text",
      "tenantDomain": "text",
      "driveItemID": "text",
      "driveItemName": "text",
      "driveItemURL": "text",
      "driveItemMimeType": "text",
      "driveItemSize": 1,
      "parentPath": "text",
      "createdByID": "text",
      "updatedByEmail": "text",
      "updatedByID": "text",
      "updatedByName": "text",
      "createdAt": 1,
      "updatedAt": 1,
      "specialFolderName": "text",
      "driveID": "text",
      "driveOwnerName": "text",
      "driveOwnerEmail": "text",
      "driveOwnerID": "text"
    },
    "inlineEmailMetadata": {
      "domain": "text",
      "user_name": "text",
      "from": "text",
      "subject": "text",
      "sent_at": 1,
      "thread_id": "text",
      "attachment_name": "text",
      "attachment_type": "text",
      "to": [
        "text"
      ],
      "cc": [
        "text"
      ],
      "bcc": [
        "text"
      ]
    }
  },
  "fileDetails": {
    "fileName": "text",
    "mimeType": "text",
    "permalink": "text"
  },
  "risk": "UNSPECIFIED",
  "riskSource": "NIGHTFALL",
  "riskScore": 1,
  "possibleActions": [
    "ACKNOWLEDGE"
  ],
  "policyUUIDs": [
    "text"
  ],
  "detectionRuleUUIDs": [
    "text"
  ],
  "detectorUUIDs": [
    "text"
  ]
}

Successful response

Take an action on Violations

Perform an action on a list of violations. If an action can't be performed on a violation, that violation is ignored. Depending on the action, it could be processed immediately or queued.

post

/violations/actions

Authorizations

Body

actionenumrequired

The action to perform on the violations

Options: ACKNOWLEDGE, REDACT, QUARANTINE, ALLOW_QUARANTINE, REJECT_QUARANTINE, REMOVE_INTERNAL_USERS, REMOVE_EXTERNAL_USERS, DOMAIN_WIDE_LINK, RESTRICTED_LINK, DELETE, IGNORE, NOTIFY_SLACK, NOTIFY_EMAIL, UNACKNOWLEDGE, DISABLE_DOWNLOAD, CREATE_JIRA_ISSUE, MARK_AS_PRIVATE, DELETE_ATTACHMENT, MANUAL_UNDO, RESOLVE, NOTIFY_TEAMS, NOTIFY_GITHUB, SOFT_DELETE, HARD_DELETE, RESTRICT_TO_OWNER

violationUUIDsstring uuid[]required

The UUIDs of the violations to perform the action on

Responses

application/json

cURL

JavaScript

Python

HTTP

curl -L \
  --request POST \
  --url 'https://api.nightfall.ai/dlp/v1/violations/actions' \
  --header 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{"action":"ACKNOWLEDGE","violationUUIDs":[null]}'

200

202

400

401

429

500

{
  "submitted": [
    "123e4567-e89b-12d3-a456-426614174000"
  ]
}

Successful response (processed immediately)

Search violations

Fetch a list of violations based on some filters

get

/violations/search

Authorizations

Query parameters

createdAfterinteger

Unix timestamp in seconds, filters records created ≥ the value, defaults to -90 days UTC

createdBeforeinteger

Unix timestamp in seconds, filters records created < the value, defaults to end of the current day UTC

updatedAfterinteger

Unix timestamp in seconds, filters records updated > the value

limitinteger

The maximum number of records to be returned in the response

pageTokenstring

Cursor for getting the next page of results

sortenum

Sort key and direction, defaults to descending order by creation time

Options: TIME_ASC, TIME_DESC, RELEVANCE, RISK_ASC, RISK_DESC

querystringrequired

The query containing filter clauses

Search query language

Query structure and terminology

A query clause consists of a field followed by an operator followed by a value:

term	value
clause	user_email:"amy@rocketrides.io"
field	user_email
operator	:
value	amy@rocketrides.io

You can combine multiple query clauses in a search by separating them with a space.

Field types, substring matching, and numeric comparators

Every search field supports exact matching with a :. Certain fields such as user_email and user_name support substring matching.

Quotes

You may use quotation marks around string values. Quotation marks are required in case the value contains spaces. For example:

user_mail:john@example.com
user_name:"John Doe"

Special Characters

+ - && || ! ( ) { } [ ] ^ " ~ * ? : are special characters need to be escaped using \. For example:

a value like (1+1):2 should be searched for using \(1\+1)\:2

Search Syntax

The following table lists the syntax that you can use to construct a query.

SYNTAX	USAGE	DESCRIPTION	EXAMPLES
`:`	field:value	Exact match operator (case insensitive)	`state:"pending"` returns records where the currency is exactly `"PENDING"` in a case-insensitive comparison
(space)	field1:value1 field2:value2	The query returns only records that match both clauses	`state:active slack.channel_name:general`
`OR`	field:(value1 OR value2)	The query returns records that match either of the values (case insensitive)	`state:(active OR pending)`

Query Fields

param	description
state	the violation states to filter on
user_email	the emails of users updating the resource resulting in the violation
user_name	the usernames of users updating the resource resulting in the violation
integration_name	the integration to filter on
confidence	one or more likelihoods/confidences
policy_id	one or more policy IDs
detection_rule_id	one or more detection rule IDs
detector_id	one or more detector IDs
risk_label	the risk label to filter on
risk_source	the risk determination source to filter on
slack.channel_name	the slack channel names to filter on
slack.channel_id	the slack channel IDs to filter on
slack.workspace	the slack workspaces to filter on
confluence.parent_page_name	the names of the parent pages in confluence to filter on
confluence.space_name	the names of the spaces in confluence to filter on
gdrive.drive	the drive names in gdrive to filter on
jira.project_name	the jira project names to filter on
jira.ticket_number	the jira ticket numbers to filter on
salesforce.org_name	the salesforce organization names to filter on
salesforce.object	the salesforce object names to filter on
salesforce.record_id	the salesforce record IDs to filter on
github.author_email	the github author emails to filter on
github.branch	the github branches to filter on
github.commit	the github commit ids to filter on
github.org	the github organizations to filter on
github.repository	the github repositories to filter on
github.repository_owner	the github repository owners to filter on
teams.team_name	the m365 teams team names to filter on
teams.channel_name	the m365 teams channels to filter on
teams.channel_type	the m365 teams channel types to filter on
teams.team_sensitivity	the m365 teams sensitivities to filter on
teams.sender	the m365 teams senders to filter on
teams.msg_importance	the m365 teams importance to filter on
teams.msg_attachment	the m365 teams attachment names to filter on
teams.chat_id	the m365 teams chat ID to filter on
teams.chat_type	the m365 teams chat type to filter on
teams.chat_topic	the m365 teams chat topic to filter on
teams.chat_participant	the m365 teams chat participant's display name to filter on
onedrive.drive_owner	drive owner's display name to filter on
onedrive.drive_owner_email	drive owner's email to filter on
onedrive.file_name	the file name to filter on
onedrive.created_by	the m365 user, who created the file in the drive, display name to filter on
onedrive.created_by_email	the m365 users, who created the file in the drive, email to filter on
onedrive.modified_by	the m365 users, who last modified the file in the drive, display name to filter on
onedrive.modified_by_email	the m365 users, who last modified the file in the drive, email to filter on
zendesk.ticket_status	the zendesk ticket status to filter on
zendesk.ticket_title	the zendesk ticket titles to filter on
zendesk.ticket_group_assignee	the zendesk ticket assignee groups to filter on
zendesk.current_user_role	the zendesk ticket current assignee user's roles to filter on
notion.created_by	the names of the users creating a resource in notion to filter on
notion.last_edited_by	the names of the users editing a resource in notion to filter on
notion.page_title	the page names in notion to filter on
notion.workspace_name	the workspace names in notion to filter on
gmail.user_name	the names of the sender to filter on
gmail.from	the email of sender to filter on
gmail.to	the email or name of recipients to filter on
gmail.cc	the email or name of cc to filter on
gmail.bcc	the email or name of bcc to filter on
gmail.thread_id	the thread id of email to filter on
gmail.subject	the subject of email to filter on
gmail.attachment_name	the name of attachment to filter on
gmail.attachment_type	the type of attachment to filter on

Responses

application/json

cURL

JavaScript

Python

HTTP

curl -L \
  --url 'https://api.nightfall.ai/dlp/v1/violations/search?query=text' \
  --header 'Authorization: Bearer YOUR_SECRET_TOKEN'

200

400

401

429

500

{
  "nextPageToken": "text",
  "violations": [
    {
      "userInfo": {
        "username": "text",
        "userEmail": "text"
      },
      "id": "text",
      "integration": "SLACK",
      "createdAt": 1,
      "updatedAt": 1,
      "state": "ACTIVE",
      "resourceLink": "text",
      "metadata": {
        "slackMetadata": {
          "location": "text",
          "locationType": "text",
          "username": "text",
          "userID": "text",
          "messagePermalink": "text",
          "locationMemberCount": 1,
          "channelID": "text",
          "workspaceName": "text",
          "locationMembers": [
            "text"
          ]
        },
        "confluenceMetadata": {
          "itemName": "text",
          "itemType": "text",
          "isArchived": true,
          "createdAt": 1,
          "updatedAt": 1,
          "spaceName": "text",
          "spaceKey": "text",
          "spaceNameLink": "text",
          "parentPageName": "text",
          "authorName": "text",
          "authorEmail": "text",
          "authorNameLink": "text",
          "permalink": "text",
          "confluenceID": "text",
          "confluenceUserID": "text",
          "itemVersion": 1,
          "parentPageID": "text",
          "parentVersion": 1,
          "labels": [
            "text"
          ]
        },
        "gdriveMetadata": {
          "fileID": "text",
          "fileName": "text",
          "fileType": "text",
          "fileSize": "text",
          "fileLink": "text",
          "permissionSetting": "text",
          "canViewersDownload": true,
          "fileOwner": "text",
          "isInTrash": true,
          "createdAt": 1,
          "updatedAt": 1,
          "drive": "text",
          "updatedBy": "text",
          "sharingExternalUsers": [
            "text"
          ],
          "sharingInternalUsers": [
            "text"
          ]
        },
        "jiraMetadata": {
          "projectName": "text",
          "ticketNumber": "text",
          "projectType": "text",
          "issueID": "text",
          "projectLink": "text",
          "ticketLink": "text",
          "commentLink": "text",
          "attachmentLink": "text"
        },
        "githubMetadata": {
          "branchName": "text",
          "organization": "text",
          "repository": "text",
          "authorEmail": "text",
          "authorUsername": "text",
          "createdAt": 1,
          "isRepoPrivate": true,
          "filePath": "text",
          "githubPermalink": "text",
          "repositoryOwner": "text",
          "githubRepoLink": "text"
        },
        "salesforceMetadata": {
          "orgName": "text",
          "recordID": "text",
          "objectName": "text",
          "contentType": "text",
          "userID": "text",
          "userName": "text",
          "updatedAt": 1,
          "fileType": "text",
          "attachmentLink": "text",
          "attachmentName": "text",
          "objectLink": "text",
          "fields": [
            "text"
          ]
        },
        "zendeskMetadata": {
          "ticketStatus": "text",
          "ticketTitle": "text",
          "ticketRequestor": "text",
          "ticketGroupAssignee": "text",
          "ticketAgentAssignee": "text",
          "currentUserRole": "text",
          "ticketID": 1,
          "ticketTags": "text",
          "createdAt": 1,
          "UpdatedAt": 1,
          "location": "text",
          "subLocation": "text",
          "ticketCommentID": 1,
          "ticketGroupID": 1,
          "ticketGroupLink": "text",
          "ticketAgentID": 1,
          "ticketAgentLink": "text",
          "ticketEvent": "text",
          "userRole": "text",
          "attachmentName": "text",
          "attachmentLink": "text",
          "ticketFollowers": [
            "text"
          ]
        },
        "notionMetadata": {
          "createdBy": "text",
          "updatedBy": "text",
          "workspaceName": "text",
          "workspaceLink": "text",
          "pageID": "text",
          "pageTitle": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "privatePageLink": "text",
          "publicPageLink": "text",
          "sharedExternally": true,
          "attachmentID": "text"
        },
        "browserMetadata": {
          "location": "text",
          "subLocation": "text",
          "browserName": "text",
          "userComment": "text"
        },
        "m365TeamsMetadata": {
          "teamName": "text",
          "tenantID": "text",
          "tenantDomain": "text",
          "teamID": "text",
          "teamVisibility": "text",
          "teamWebURL": "text",
          "channelID": "text",
          "channelName": "text",
          "channelType": "text",
          "channelWebURL": "text",
          "messageID": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "chatMessageSender": "text",
          "userID": "text",
          "userPrincipalName": "text",
          "chatMessageImportance": "text",
          "chatID": "text",
          "chatType": "text",
          "chatTopic": "text",
          "chatParticipants": [
            {
              "userID": "text",
              "email": "text",
              "displayName": "text"
            }
          ],
          "attachments": [
            {
              "attachmentID": "text",
              "attachmentName": "text",
              "attachmentURL": "text"
            }
          ]
        },
        "m365OnedriveMetadata": {
          "tenantID": "text",
          "tenantDomain": "text",
          "driveItemID": "text",
          "driveItemName": "text",
          "driveItemURL": "text",
          "driveItemMimeType": "text",
          "driveItemSize": 1,
          "parentPath": "text",
          "createdByID": "text",
          "updatedByEmail": "text",
          "updatedByID": "text",
          "updatedByName": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "specialFolderName": "text",
          "driveID": "text",
          "driveOwnerName": "text",
          "driveOwnerEmail": "text",
          "driveOwnerID": "text"
        },
        "inlineEmailMetadata": {
          "domain": "text",
          "user_name": "text",
          "from": "text",
          "subject": "text",
          "sent_at": 1,
          "thread_id": "text",
          "attachment_name": "text",
          "attachment_type": "text",
          "to": [
            "text"
          ],
          "cc": [
            "text"
          ],
          "bcc": [
            "text"
          ]
        }
      },
      "fileDetails": {
        "fileName": "text",
        "mimeType": "text",
        "permalink": "text"
      },
      "risk": "UNSPECIFIED",
      "riskSource": "NIGHTFALL",
      "riskScore": 1,
      "possibleActions": [
        "ACKNOWLEDGE"
      ],
      "policyUUIDs": [
        "text"
      ],
      "detectionRuleUUIDs": [
        "text"
      ],
      "detectorUUIDs": [
        "text"
      ]
    }
  ]
}

Successful response

Fetch violations

Fetch a list of violations for a period

get

/violations

Authorizations

Query parameters

createdAfterinteger

Unix timestamp in seconds, filters records created ≥ the value, defaults to -90 days UTC

createdBeforeinteger

Unix timestamp in seconds, filters records created < the value, defaults to end of the current day UTC

updatedAfterinteger

Unix timestamp in seconds, filters records updated > the value

limitinteger

The maximum number of records to be returned in the response

pageTokenstring

Cursor for getting the next page of results

Responses

application/json

cURL

JavaScript

Python

HTTP

curl -L \
  --url 'https://api.nightfall.ai/dlp/v1/violations' \
  --header 'Authorization: Bearer YOUR_SECRET_TOKEN'

200

400

401

429

500

{
  "nextPageToken": "text",
  "violations": [
    {
      "userInfo": {
        "username": "text",
        "userEmail": "text"
      },
      "id": "text",
      "integration": "SLACK",
      "createdAt": 1,
      "updatedAt": 1,
      "state": "ACTIVE",
      "resourceLink": "text",
      "metadata": {
        "slackMetadata": {
          "location": "text",
          "locationType": "text",
          "username": "text",
          "userID": "text",
          "messagePermalink": "text",
          "locationMemberCount": 1,
          "channelID": "text",
          "workspaceName": "text",
          "locationMembers": [
            "text"
          ]
        },
        "confluenceMetadata": {
          "itemName": "text",
          "itemType": "text",
          "isArchived": true,
          "createdAt": 1,
          "updatedAt": 1,
          "spaceName": "text",
          "spaceKey": "text",
          "spaceNameLink": "text",
          "parentPageName": "text",
          "authorName": "text",
          "authorEmail": "text",
          "authorNameLink": "text",
          "permalink": "text",
          "confluenceID": "text",
          "confluenceUserID": "text",
          "itemVersion": 1,
          "parentPageID": "text",
          "parentVersion": 1,
          "labels": [
            "text"
          ]
        },
        "gdriveMetadata": {
          "fileID": "text",
          "fileName": "text",
          "fileType": "text",
          "fileSize": "text",
          "fileLink": "text",
          "permissionSetting": "text",
          "canViewersDownload": true,
          "fileOwner": "text",
          "isInTrash": true,
          "createdAt": 1,
          "updatedAt": 1,
          "drive": "text",
          "updatedBy": "text",
          "sharingExternalUsers": [
            "text"
          ],
          "sharingInternalUsers": [
            "text"
          ]
        },
        "jiraMetadata": {
          "projectName": "text",
          "ticketNumber": "text",
          "projectType": "text",
          "issueID": "text",
          "projectLink": "text",
          "ticketLink": "text",
          "commentLink": "text",
          "attachmentLink": "text"
        },
        "githubMetadata": {
          "branchName": "text",
          "organization": "text",
          "repository": "text",
          "authorEmail": "text",
          "authorUsername": "text",
          "createdAt": 1,
          "isRepoPrivate": true,
          "filePath": "text",
          "githubPermalink": "text",
          "repositoryOwner": "text",
          "githubRepoLink": "text"
        },
        "salesforceMetadata": {
          "orgName": "text",
          "recordID": "text",
          "objectName": "text",
          "contentType": "text",
          "userID": "text",
          "userName": "text",
          "updatedAt": 1,
          "fileType": "text",
          "attachmentLink": "text",
          "attachmentName": "text",
          "objectLink": "text",
          "fields": [
            "text"
          ]
        },
        "zendeskMetadata": {
          "ticketStatus": "text",
          "ticketTitle": "text",
          "ticketRequestor": "text",
          "ticketGroupAssignee": "text",
          "ticketAgentAssignee": "text",
          "currentUserRole": "text",
          "ticketID": 1,
          "ticketTags": "text",
          "createdAt": 1,
          "UpdatedAt": 1,
          "location": "text",
          "subLocation": "text",
          "ticketCommentID": 1,
          "ticketGroupID": 1,
          "ticketGroupLink": "text",
          "ticketAgentID": 1,
          "ticketAgentLink": "text",
          "ticketEvent": "text",
          "userRole": "text",
          "attachmentName": "text",
          "attachmentLink": "text",
          "ticketFollowers": [
            "text"
          ]
        },
        "notionMetadata": {
          "createdBy": "text",
          "updatedBy": "text",
          "workspaceName": "text",
          "workspaceLink": "text",
          "pageID": "text",
          "pageTitle": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "privatePageLink": "text",
          "publicPageLink": "text",
          "sharedExternally": true,
          "attachmentID": "text"
        },
        "browserMetadata": {
          "location": "text",
          "subLocation": "text",
          "browserName": "text",
          "userComment": "text"
        },
        "m365TeamsMetadata": {
          "teamName": "text",
          "tenantID": "text",
          "tenantDomain": "text",
          "teamID": "text",
          "teamVisibility": "text",
          "teamWebURL": "text",
          "channelID": "text",
          "channelName": "text",
          "channelType": "text",
          "channelWebURL": "text",
          "messageID": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "chatMessageSender": "text",
          "userID": "text",
          "userPrincipalName": "text",
          "chatMessageImportance": "text",
          "chatID": "text",
          "chatType": "text",
          "chatTopic": "text",
          "chatParticipants": [
            {
              "userID": "text",
              "email": "text",
              "displayName": "text"
            }
          ],
          "attachments": [
            {
              "attachmentID": "text",
              "attachmentName": "text",
              "attachmentURL": "text"
            }
          ]
        },
        "m365OnedriveMetadata": {
          "tenantID": "text",
          "tenantDomain": "text",
          "driveItemID": "text",
          "driveItemName": "text",
          "driveItemURL": "text",
          "driveItemMimeType": "text",
          "driveItemSize": 1,
          "parentPath": "text",
          "createdByID": "text",
          "updatedByEmail": "text",
          "updatedByID": "text",
          "updatedByName": "text",
          "createdAt": 1,
          "updatedAt": 1,
          "specialFolderName": "text",
          "driveID": "text",
          "driveOwnerName": "text",
          "driveOwnerEmail": "text",
          "driveOwnerID": "text"
        },
        "inlineEmailMetadata": {
          "domain": "text",
          "user_name": "text",
          "from": "text",
          "subject": "text",
          "sent_at": 1,
          "thread_id": "text",
          "attachment_name": "text",
          "attachment_type": "text",
          "to": [
            "text"
          ],
          "cc": [
            "text"
          ],
          "bcc": [
            "text"
          ]
        }
      },
      "fileDetails": {
        "fileName": "text",
        "mimeType": "text",
        "permalink": "text"
      },
      "risk": "UNSPECIFIED",
      "riskSource": "NIGHTFALL",
      "riskScore": 1,
      "possibleActions": [
        "ACKNOWLEDGE"
      ],
      "policyUUIDs": [
        "text"
      ],
      "detectionRuleUUIDs": [
        "text"
      ],
      "detectorUUIDs": [
        "text"
      ]
    }
  ]
}

Successful response

DLP APIs - Native SaaS Apps

Fetch Violations

Fetch Violations by ID

Search Violations

Fetch Violation Findings

Take Action on Violations

Fetch Annotations

Annotate Findings

Remove Annotation Findings

Fetch GitHub Repositories

Policy User Scope Update API

Rate Limits for Native SaaS app APIs

Request Rate Limiting

Quotas

Fetch Violations

Fetch Violation Findings

DLP APIs - Native SaaS Apps

Fetch Violations by ID

Take Action on Violations

Search Violations

Rate Limits for Native SaaS app APIs

Request Rate Limiting

Quotas

Annotate Findings

Fetch GitHub Repositories

Remove Annotation Findings

Fetch Annotations

Policy User Scope Update API

Fetch violation findings

Fetch violation

Take an action on Violations

Search violations

Search query language

Annotate finding

Remove finding annotation

Fetch annotation

Fetch violations

Update a policy user scope

Fetch Github repositories