--- title: "Get Security Playbook" method: POST path: "/security-playbook/{id}/get-item" tags: ["Security Playbook"] --- # Get Security Playbook `POST /security-playbook/{id}/get-item` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-playbook/{id}/get-item` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to retrieve a single Security Playbook by ID ## Path parameters - `id` string, uuid, required ## Request body - object - `select` SecurityPlaybookSelectSchema: Select schema for SecurityPlaybook. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `name` boolean - `description` boolean - `isEnabled` boolean - `trigger` boolean - `minimumSecurityCasePriorityId` boolean - `detectionSource` boolean - `detectionRuleIds` boolean - `steps` boolean - `runCount` boolean - `lastRunAt` boolean - `createdByUserId` boolean - `deletedByUserId` boolean ## Response `200` Successful response - object - `data` SecurityPlaybook - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this playbook belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [No access - you don't have permission for this operation] - `name` string, required: What the playbook does, in a few words. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `description` string: When to use the playbook and what it is for. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `isEnabled` boolean, required: Whether the playbook runs on its own. A disabled playbook can still be run by hand from a case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `trigger` 'Case Opened' | 'Detection Added' | 'Triaged as Likely Malicious' | 'Manual', required: When the playbook runs on its own: Case Opened, Detection Added (a new detection joins an open case), or Manual (only when somebody runs it). Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `minimumSecurityCasePriorityId` string, uuid: ID of the lowest case priority the playbook runs on by itself. Empty runs on every priority. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `detectionSource` 'Detection Rule' | 'Threat Intel' | 'Connected Product' | 'Manual' | 'Entity Risk' | 'Data Security': Run only on cases raised by this source: a Detection Rule, Threat Intel, a Connected Product or Entity Risk. Empty runs on every source. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `detectionRuleIds` object: Run only on cases with a detection from one of these detection rules. Empty runs on cases from any rule. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `steps` object: The steps the playbook takes, in order. Each has an action, its settings, and whether it needs approval, may fail without stopping the run, or runs only when threat intel matched. Permissions - Create: [Project Owner, Project Admin, Security Admin, Create Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [Project Owner, Project Admin, Security Admin, Edit Security Playbook] - `runCount` number: How many times the playbook has been run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [No access - you don't have permission for this operation] - `lastRunAt` object: When the playbook last started a run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the person who created the playbook. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the playbook. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)