---
title: "Read one detection library entry"
method: GET
path: "/api/detection-library/{slug}"
tags: ["Detections"]
---

# Read one detection library entry

`GET /api/detection-library/{slug}`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/detection-library/{slug}`
- Auth: HTTP bearer

Returns the entry with its notebook source and the globally cached logic summary, for review before adding. Requires tool.read.

## Path parameters

- `slug` string, required

## Response `200`

Successful response

- object
  - `slug` string, required: Kebab-case library entry identity
  - `name` string, required
  - `summary` string, required: 1–3 sentence plain-prose headline of what the detection is meant to detect
  - `description` string, required: Operational GitHub-flavored markdown covering the signal and the fire condition
  - `revision` string, required: SHA-256 of the entry notebook
  - `toolNames` string[], required: Tool actions the entry notebook calls
  - `requiredLogSources` string[], required: Cotool Logs warehouse sources the notebook queries (e.g. okta); eligibility requires the org to have their log ingest enabled
  - `missingLogSources` object[]: Required log sources the organization is not ingesting
    - `id` string, required: Ingest source registry id
    - `displayName` string, required: Human-readable log source name
  - `missingTools` object[]: Required integration tool actions the organization cannot run
    - `name` string, required: Tool action called by the entry notebook
    - `displayName` string, required: Human-readable integration name from the tools registry
  - `mitreTechniqueIds` string[], required
  - `defaultIntervalMinutes` union, required: Run interval enabled when the entry is added
    - 10
    - 30
    - 60
    - 360
    - 1440
  - `defaultMinSeverity` 'low' | 'medium' | 'high' | 'critical', required
  - `eligible` boolean, required: Whether missingLogSources and missingTools are both empty
  - `addedDetectionId` string, uuid, nullable, required: The org detection created from this entry, when already added
  - `deprecation` object, nullable: Set when the entry is deprecated; it can no longer be added
    - `since` string, required: The date the entry was deprecated, YYYY-MM-DD
    - `replacedBy` object[], required: The streaming detections that replace it; empty when none does
      - `slug` string, required
      - `name` string, required
    - `alerting` 'promotion' | 'compound' | 'none', required: What alerts in its place: promotions of its signal types, a compound detection over signals, or nothing
    - `signalTypes` string[], required: The promoted signal types that carry its alerts
    - `compound` object, nullable, required: The library compound detection that alerts in its place
      - `slug` string, required
      - `name` string, required
    - `reason` string, nullable, required: Why it is deprecated, when nothing replaces it
    - `retiresCopies` boolean, required: Whether organizations' copies are turned off: always once replacements run, and for an unreplaced entry only when it says so
    - `note` string, nullable, required
  - `content` string, required: The entry notebook source, for read-only preview
  - `interpretation` object, nullable, required: Logic summary computed once per notebook revision and cached globally; null until the interpretation job produces it
    - `status` 'ready' | 'empty' | 'updating', required: "empty" when there are no interpretable cells; "updating" when edits overtook generation
    - `interpretation` object, nullable, required
      - `notebookRevision` string, required: Notebook revision this interpretation describes
      - `lanes` object[], required: Disjoint simple paths over the semantic steps
        - `id` string, required
        - `steps` object[], required: Ordered steps; each step feeds the next
          - `id` string, required: Stable step identifier carried across regenerations
          - `title` string, required: 2-5 word verb-first objective
          - `summary` string, required: Plain-language explanation of this step only
          - `kind` 'source' | 'transform' | 'decision' | 'output', required
          - `cellHashes` string[], required: Content hashes of the cells this step owns
          - `substeps` object[], required
            - `id` string, required
            - `title` string, required: Short plain-language action, a few words
            - `detail` string, required: One or two sentences describing the concrete logic
            - `cellHash` string, required: Content hash of the cell this substep describes
    - `currentRevision` string, nullable: Source revision observed after generation; a different revision means the client should refresh, not report an error
    - `cells` object[], required: Cells of the interpreted revision, for code display and referencing
      - `name` string, required: Cell function name; "_" when anonymous
      - `code` string, required: Cell body source without the def/return scaffolding
      - `refs` string[], required: Variables the cell consumes from other cells
      - `defs` string[], required: Variables the cell defines for other cells
      - `params` object[], required: Tunable literal constants declared by this cell
        - `name` string, required: Constant name, e.g. LOOKBACK_HOURS
        - `value` union, required
          - number
          - string
          - boolean
        - `line` integer, required: Absolute notebook line of the assignment
      - `lineStart` integer, required: First line of the cell in the notebook file
      - `lineEnd` integer, required: Last line of the cell in the notebook file
      - `contentHash` string, required: SHA-256 of the cell body source

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Caller lacks tool.read
- `404`: Library entry not found
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)