--- title: "Update Security Event Connection" method: PUT path: "/security-event-connection/{id}" tags: ["Security Event Connection"] --- # Update Security Event Connection `PUT /security-event-connection/{id}` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-event-connection/{id}` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to update an existing Security Event Connection ## Path parameters - `id` string, uuid, required ## Request body - object - `data` SecurityEventConnectionUpdateSchema, required: Update schema for SecurityEventConnection model. Update - `name` string: Friendly name for this connection. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `description` string: What this connection imports and why. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `config` object: Provider-specific, non-secret settings such as tenant, workspace, region or base URL. Keys are defined by the provider catalog. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `secrets` string, password: Provider-specific secrets (client secret, API token, secret access key) as a JSON object. Encrypted at rest and never returned by the API. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [No access - you don't have permission for this operation], Update: [Project Owner, Project Admin, Security Admin] - `isEnabled` boolean: Whether this connection is polled on its schedule. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `pollIntervalInMinutes` number: How often new records are polled, in minutes. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `alertingOnly` boolean: For providers that distinguish alerting from non-alerting records: import only the alerting ones. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `caseMinimumSeverity` string: Imported alerts at or above this severity (Low, Medium, High or Critical) open security cases. Empty imports them as events only. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] ## Response `200` Updated successfully - object - `data` SecurityEventConnectionReadSchema: Read schema for SecurityEventConnection model. Read - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `projectId` string, uuid: ID of the project this connection belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `name` string, required: Friendly name for this connection. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `description` string: What this connection imports and why. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `provider` 'microsoft-sentinel' | 'microsoft-defender-xdr' | 'crowdstrike-falcon' | 'splunk' | 'elastic-security' | 'aws-security-hub' | 'okta' | 'google-secops' | 'microsoft-entra-id' | 'google-workspace', required: Which security product this connection polls, e.g. 'microsoft-sentinel' or 'crowdstrike-falcon'. Fixed once created. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `config` object: Provider-specific, non-secret settings such as tenant, workspace, region or base URL. Keys are defined by the provider catalog. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `isEnabled` boolean: Whether this connection is polled on its schedule. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `pollIntervalInMinutes` number: How often new records are polled, in minutes. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `alertingOnly` boolean: For providers that distinguish alerting from non-alerting records: import only the alerting ones. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `caseMinimumSeverity` string: Imported alerts at or above this severity (Low, Medium, High or Critical) open security cases. Empty imports them as events only. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `lastSuccessfulPollAt` object: When a complete poll last finished successfully, including an empty result. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastEventIngestedAt` object: When a new security event was last imported from this connection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastPollResult` object: The latest scheduled or on-demand poll result with counts and warnings. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastPolledAt` object: When this connection was last polled. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `cursor` string: Poll cursor: the end of the last completely processed creation-time window, as an ISO string. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastError` string: The most recent poll error with credentials redacted, if any. Cleared on the next successful poll. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the user who created this connection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the user who deleted this connection. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)