Threat Intelligence API (threatintelligence:v1beta)

2026-01-23

22 new methods | New API

Additions

    Methods
  • threatintelligence.projects.configurations.revisions.list

      Parameter Order : parent

      Description : List configuration revisions that meet the filter criteria.

      Path : v1beta/{+parent}/revisions

      Scopes : https://www.googleapis.com/auth/cloud-platform

      HTTP Method : GET

      Parameters :

        parent

          Description : Required. The name of the Configuration to retrieve Revisions for

          Location : path

          Required : Yes

          Pattern : ^projects/[^/]+/configurations/[^/]+$

          Type : string

        pageSize

          Description : Optional. Page Size

          Type : integer

          Location : query

          Format : int32

        pageToken

          Type : string

          Description : Optional. A page token provided by the API

          Location : query

        orderBy

          Type : string

          Description : Optional. Specify ordering of response

          Location : query

        filter

          Type : string

          Description : Optional. An AIP-160 filter string

          Location : query

      Flat Path : v1beta/projects/{projectsId}/configurations/{configurationsId}/revisions

  • threatintelligence.projects.configurations.upsert

      Flat Path : v1beta/projects/{projectsId}/configurations:upsert

      HTTP Method : POST

      Description : Creates or updates a configuration.

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameters :

        parent

          Description : Required. Parent of the configuration.

          Required : Yes

          Location : path

          Pattern : ^projects/[^/]+$

          Type : string

        publishTime

          Location : query

          Description : Optional. Time that the configuration should be considered to have been published. This is an advanced feature used when onboarding and bulk loading data from other systems. Do not set this field without consulting with the API team.

          Format : google-datetime

          Type : string

      Parameter Order : parent

      Path : v1beta/{+parent}/configurations:upsert

  • threatintelligence.projects.configurations.get

      HTTP Method : GET

      Parameters :

        name

          Pattern : ^projects/[^/]+/configurations/[^/]+$

          Description : Required. Name of the configuration to get. Format: vaults/{vault}/configurations/{configuration}

          Type : string

          Location : path

          Required : Yes

      Parameter Order : name

      Path : v1beta/{+name}

      Flat Path : v1beta/projects/{projectsId}/configurations/{configurationsId}

      Description : Get a configuration by name.

      Scopes : https://www.googleapis.com/auth/cloud-platform

  • threatintelligence.projects.configurations.list

      Parameter Order : parent

      HTTP Method : GET

      Parameters :

        orderBy

          Description : Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2".

          Type : string

          Location : query

        filter

          Location : query

          Description : Optional. Filter criteria.

          Type : string

        pageToken

          Location : query

          Type : string

          Description : Optional. Page token.

        pageSize

          Format : int32

          Description : Optional. Page size.

          Type : integer

          Location : query

        parent

          Pattern : ^projects/[^/]+$

          Description : Required. Parent of the configuration. Format: vaults/{vault}

          Required : Yes

          Type : string

          Location : path

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Flat Path : v1beta/projects/{projectsId}/configurations

      Path : v1beta/{+parent}/configurations

      Description : Get a list of configurations that meet the filter criteria.

  • threatintelligence.projects.findings.search

      Path : v1beta/{+parent}/findings:search

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameter Order : parent

      Parameters :

        parent

          Pattern : ^projects/[^/]+$

          Required : Yes

          Location : path

          Type : string

          Description : Required. Parent of the findings. Format: vaults/{vault}

        orderBy

          Description : Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2".

          Location : query

          Type : string

        query

          Location : query

          Type : string

          Description : Optional. Query on what findings will be returned. This supports the same filter criteria as FindingService.ListFindings as well as the following relationship queries `has_issue` and `has_asset`. Examples: - has_issue("name=\"vaults/vault-12345/issues/issue-12345\"") - has_asset("name=\"vaults/vault-12345/assets/asset-12345\"")

        pageSize

          Location : query

          Format : int32

          Description : Optional. Page size.

          Type : integer

        pageToken

          Description : Optional. Page token.

          Location : query

          Type : string

      Flat Path : v1beta/projects/{projectsId}/findings:search

      Description : SearchFindings is a more powerful version of ListFindings that supports complex queries like "findings for issues" using functions such as `has_issue` and `has_asset` in the query string. Example to search for findings for a specific issue: `has_issue("name=\"vaults/vault-12345/issues/issue-12345\"")`)

      HTTP Method : GET

  • threatintelligence.projects.findings.get

      Path : v1beta/{+name}

      HTTP Method : GET

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameters :

        name

          Required : Yes

          Description : Required. Name of the finding to get.

          Type : string

          Pattern : ^projects/[^/]+/findings/[^/]+$

          Location : path

      Parameter Order : name

      Description : Get a finding by name.

      Flat Path : v1beta/projects/{projectsId}/findings/{findingsId}

  • threatintelligence.projects.findings.list

      Path : v1beta/{+parent}/findings

      Parameters :

        pageSize

          Type : integer

          Format : int32

          Location : query

          Description : Optional. Page size.

        pageToken

          Description : Optional. Page token.

          Location : query

          Type : string

        orderBy

          Type : string

          Description : Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2".

          Location : query

        filter

          Location : query

          Type : string

          Description : Optional. Filter criteria.

        parent

          Pattern : ^projects/[^/]+$

          Type : string

          Location : path

          Description : Required. Parent of the findings.

          Required : Yes

      HTTP Method : GET

      Parameter Order : parent

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Flat Path : v1beta/projects/{projectsId}/findings

      Description : Get a list of findings that meet the filter criteria.

  • threatintelligence.projects.alerts.reportAlertUri

      Parameter Order : name

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:reportAlertUri

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameters :

        name

          Location : path

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Description : Required. Name of alert to submit to WebRisk.

          Required : Yes

      HTTP Method : POST

      Path : v1beta/{+name}:reportAlertUri

      Description : Report the URI associated with an alert to Google WebRisk.

  • threatintelligence.projects.alerts.triage

      HTTP Method : POST

      Description : Marks an alert as triaged - TRIAGED.

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:triage

      Parameters :

        name

          Type : string

          Required : Yes

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Description : Required. Name of the alert to mark as a triaged. Format: projects/{project}/alerts/{alert}

          Location : path

      Path : v1beta/{+name}:triage

      Parameter Order : name

      Scopes : https://www.googleapis.com/auth/cloud-platform

  • threatintelligence.projects.alerts.resolve

      Path : v1beta/{+name}:resolve

      Description : Marks an alert to closed state - RESOLVED.

      Parameters :

        name

          Location : path

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Type : string

          Required : Yes

          Description : Required. Name of the alert to mark as resolved. Format: projects/{project}/alerts/{alert}

      HTTP Method : POST

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:resolve

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameter Order : name

  • threatintelligence.projects.alerts.benign

      Parameter Order : name

      Path : v1beta/{+name}:benign

      Scopes : https://www.googleapis.com/auth/cloud-platform

      HTTP Method : POST

      Description : Marks an alert as benign - BENIGN.

      Parameters :

        name

          Required : Yes

          Description : Required. Name of the alert to mark as a benign. Format: projects/{project}/alerts/{alert}

          Location : path

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:benign

  • threatintelligence.projects.alerts.notActionable

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Description : Marks an alert as not actionable - NOT_ACTIONABLE.

      Parameter Order : name

      HTTP Method : POST

      Parameters :

        name

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Description : Required. Name of the alert to mark as a not actionable. Format: projects/{project}/alerts/{alert}

          Location : path

          Required : Yes

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:notActionable

      Path : v1beta/{+name}:notActionable

  • threatintelligence.projects.alerts.get

      Parameter Order : name

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameters :

        name

          Required : Yes

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Location : path

          Description : Required. Name of the alert to get. Format: projects/{project}/alerts/{alert}

      HTTP Method : GET

      Description : Get an alert by name.

      Path : v1beta/{+name}

  • threatintelligence.projects.alerts.falsePositive

      Path : v1beta/{+name}:falsePositive

      Description : Marks an alert as a false positive - FALSE_POSITIVE.

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:falsePositive

      Parameter Order : name

      HTTP Method : POST

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameters :

        name

          Description : Required. Name of the alert to mark as a false positive. Format: projects/{project}/alerts/{alert}

          Type : string

          Location : path

          Required : Yes

          Pattern : ^projects/[^/]+/alerts/[^/]+$

  • threatintelligence.projects.alerts.escalate

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:escalate

      Description : Marks an alert as escalated - ESCALATED.

      HTTP Method : POST

      Parameters :

        name

          Type : string

          Required : Yes

          Location : path

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Description : Required. Name of the alert to mark as escalated. Format: projects/{project}/alerts/{alert}

      Path : v1beta/{+name}:escalate

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameter Order : name

  • threatintelligence.projects.alerts.enumerateFacets

      Flat Path : v1beta/projects/{projectsId}/alerts:enumerateFacets

      Parameter Order : parent

      Description : EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that value for each facet.

      HTTP Method : GET

      Parameters :

        filter

          Location : query

          Type : string

          Description : Optional. Filter on what alerts will be enumerated.

        parent

          Type : string

          Description : Required. Parent of the alerts.

          Pattern : ^projects/[^/]+$

          Required : Yes

          Location : path

      Path : v1beta/{+parent}/alerts:enumerateFacets

      Scopes : https://www.googleapis.com/auth/cloud-platform

  • threatintelligence.projects.alerts.trackExternally

      Path : v1beta/{+name}:trackExternally

      Parameter Order : name

      Description : Marks an alert as tracked externally - TRACKED_EXTERNALLY.

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:trackExternally

      Parameters :

        name

          Description : Required. Name of the alert to mark as tracked externally. Format: projects/{project}/alerts/{alert}

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Required : Yes

          Location : path

      HTTP Method : POST

  • threatintelligence.projects.alerts.read

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:read

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Path : v1beta/{+name}:read

      Parameter Order : name

      Parameters :

        name

          Type : string

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Description : Required. Name of the alert to mark as read. Format: projects/{project}/alerts/{alert}

          Required : Yes

          Location : path

      HTTP Method : POST

      Description : Marks an alert as read - READ.

  • threatintelligence.projects.alerts.duplicate

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:duplicate

      HTTP Method : POST

      Path : v1beta/{+name}:duplicate

      Description : Marks an alert as a duplicate of another alert. - DUPLICATE.

      Parameters :

        name

          Required : Yes

          Type : string

          Description : Required. Name of the alert to mark as a duplicate. Format: projects/{project}/alerts/{alert}

          Location : path

          Pattern : ^projects/[^/]+/alerts/[^/]+$

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Parameter Order : name

  • threatintelligence.projects.alerts.refreshUriStatus

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}:refreshUriStatus

      Parameter Order : name

      Parameters :

        name

          Required : Yes

          Pattern : ^projects/[^/]+/alerts/[^/]+$

          Location : path

          Description : Required. Name of alert to refresh status from WebRisk

          Type : string

      Path : v1beta/{+name}:refreshUriStatus

      HTTP Method : POST

      Description : Return the status of a URI submitted to Google WebRisk.

  • threatintelligence.projects.alerts.list

      Parameters :

        pageSize

          Location : query

          Type : integer

          Format : int32

          Description : Optional. Page size.

        filter

          Location : query

          Type : string

          Description : Optional. Filter criteria.

        parent

          Type : string

          Required : Yes

          Description : Required. Parent of the alerts. Format: projects/{project}

          Location : path

          Pattern : ^projects/[^/]+$

        pageToken

          Description : Optional. Page token.

          Location : query

          Type : string

        orderBy

          Type : string

          Location : query

          Description : Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2".

      Description : Get a list of alerts that meet the filter criteria.

      HTTP Method : GET

      Scopes : https://www.googleapis.com/auth/cloud-platform

      Path : v1beta/{+parent}/alerts

      Flat Path : v1beta/projects/{projectsId}/alerts

      Parameter Order : parent

  • threatintelligence.projects.alerts.documents.get

      HTTP Method : GET

      Path : v1beta/{+name}

      Description : Gets a specific document associated with an alert.

      Parameters :

        name

          Description : Required. Name of the alert document to get. Format: projects/{project}/alerts/{alert}/documents/{document}

          Type : string

          Required : Yes

          Location : path

          Pattern : ^projects/[^/]+/alerts/[^/]+/documents/[^/]+$

      Parameter Order : name

      Flat Path : v1beta/projects/{projectsId}/alerts/{alertsId}/documents/{documentsId}

      Scopes : https://www.googleapis.com/auth/cloud-platform