---
title: "List the Cotool detection library"
method: GET
path: "/api/detection-library"
tags: ["Detections"]
---

# List the Cotool detection library

`GET /api/detection-library`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/detection-library`
- Auth: HTTP bearer

Returns every library entry with eligibility derived at request time from the organization's connected tools, and the org detection created from it when already added. Never includes notebook source. Requires tool.read; added detection IDs are limited to detections the caller can read.

## Response `200`

Successful response

- object
  - `entries` object[], required
    - `slug` string, required: Kebab-case library entry identity
    - `name` string, required
    - `summary` string, required: 1–3 sentence plain-prose headline of what the detection is meant to detect
    - `description` string, required: Operational GitHub-flavored markdown covering the signal and the fire condition
    - `revision` string, required: SHA-256 of the entry notebook
    - `toolNames` string[], required: Tool actions the entry notebook calls
    - `requiredLogSources` string[], required: Cotool Logs warehouse sources the notebook queries (e.g. okta); eligibility requires the org to have their log ingest enabled
    - `missingLogSources` object[]: Required log sources the organization is not ingesting
      - `id` string, required: Ingest source registry id
      - `displayName` string, required: Human-readable log source name
    - `missingTools` object[]: Required integration tool actions the organization cannot run
      - `name` string, required: Tool action called by the entry notebook
      - `displayName` string, required: Human-readable integration name from the tools registry
    - `mitreTechniqueIds` string[], required
    - `defaultIntervalMinutes` union, required: Run interval enabled when the entry is added
      - 10
      - 30
      - 60
      - 360
      - 1440
    - `defaultMinSeverity` 'low' | 'medium' | 'high' | 'critical', required
    - `eligible` boolean, required: Whether missingLogSources and missingTools are both empty
    - `addedDetectionId` string, uuid, nullable, required: The org detection created from this entry, when already added
    - `deprecation` object, nullable: Set when the entry is deprecated; it can no longer be added
      - `since` string, required: The date the entry was deprecated, YYYY-MM-DD
      - `replacedBy` object[], required: The streaming detections that replace it; empty when none does
        - `slug` string, required
        - `name` string, required
      - `alerting` 'promotion' | 'compound' | 'none', required: What alerts in its place: promotions of its signal types, a compound detection over signals, or nothing
      - `signalTypes` string[], required: The promoted signal types that carry its alerts
      - `compound` object, nullable, required: The library compound detection that alerts in its place
        - `slug` string, required
        - `name` string, required
      - `reason` string, nullable, required: Why it is deprecated, when nothing replaces it
      - `retiresCopies` boolean, required: Whether organizations' copies are turned off: always once replacements run, and for an unreplaced entry only when it says so
      - `note` string, nullable, required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Caller lacks tool.read
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)