--- title: "Update Watchlist" method: PUT path: "/security-watchlist/{id}" tags: ["Watchlist"] --- # Update Watchlist `PUT /security-watchlist/{id}` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-watchlist/{id}` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to update an existing Watchlist ## Path parameters - `id` string, uuid, required ## Request body - object - `data` SecurityWatchlistUpdateSchema, required: Update schema for SecurityWatchlist model. Update - `name` string: What rules call the list, between % signs: a rule reads vip_users as principalUser|expand: '%vip_users%'. Letters, digits and underscores, starting with a letter; unique in the project whatever the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `description` string: What the list is for, for whoever reads it later. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `threatIntelFeedId` string, uuid: For a list that follows a feed: the ID of the feed whose active indicators are the list's values. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `importUrl` string: For a list read from an address: the https address of a text or CSV file, one value a line, with an optional note and when the value leaves the list. Read again on the list's schedule; the list is what the file held at its last read. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `importSchedule` 'Every Hour' | 'Every 6 Hours' | 'Every Day': For a list read from an address: how often it is read - Every Hour (the default), Every 6 Hours or Every Day. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] ## Response `200` Updated successfully - object - `data` SecurityWatchlistReadSchema: Read schema for SecurityWatchlist model. Read - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `projectId` string, uuid: ID of the project this watchlist belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `name` string, required: What rules call the list, between % signs: a rule reads vip_users as principalUser|expand: '%vip_users%'. Letters, digits and underscores, starting with a letter; unique in the project whatever the case. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `description` string: What the list is for, for whoever reads it later. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `entityType` 'User' | 'Host' | 'IP Address' | 'Domain' | 'URL' | 'File Hash' | 'Process' | 'Data Store' | 'Other', required: What the list holds: User, Host, IP Address, File Hash, Domain, URL, Process or Other. It decides which values the list takes - an IP address list takes addresses and ranges such as 10.20.0.0/16 - and which indicators a threat intel feed gives it. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `source` 'Values' | 'Threat Intel Feed' | 'URL': Where the values come from: Values (added by hand or imported), URL (a file at an https address, read again on a schedule) or Threat Intel Feed (the feed's active indicators of the list's kind). Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `threatIntelFeedId` string, uuid: For a list that follows a feed: the ID of the feed whose active indicators are the list's values. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `importUrl` string: For a list read from an address: the https address of a text or CSV file, one value a line, with an optional note and when the value leaves the list. Read again on the list's schedule; the list is what the file held at its last read. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `importSchedule` 'Every Hour' | 'Every 6 Hours' | 'Every Day': For a list read from an address: how often it is read - Every Hour (the default), Every 6 Hours or Every Day. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `nextImportAt` object: For a list read from an address: when it is next read. Empty for any other list. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastImportAt` object: For a list read from an address: when OneUptime last read it, or tried to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastImportSucceededAt` object: For a list read from an address: when it was last read without an error. The list holds what the file held then. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastImportError` string: For a list read from an address: why its last read failed. The list keeps the values of the read before. Empty when it worked. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastImportErrorDetail` string: For a list read from an address: what the address or the network said when its last read failed, as it said it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastImportLinesLeftOut` number: For a list read from an address: how many lines of the file its last read left out - lines that are not values of the list's kind, or whose date to leave the list had passed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `valueCount` number: How many values the list holds, counted by OneUptime as values are added and removed. 0 for a list that follows a threat intel feed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the person who created the watchlist. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the watchlist. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)