Get all server configurations

get https://{sandfly-api-host}/v4/config

Gets the current server configurations in the system.

Responses

Response body

object

agent_names

string

Comma-separated list of names to use for the Sandfly binary that is sent to target hosts.

config_revision

int64

required

Configuration revision number. Must be echoed back to the server. Provides optimistic concurrency control to prevent two users from altering configuration simultaneously.

data_retention_days

int64

Number of days to keep alert results and other data.

pass_retention_days

int64

Number of days to keep pass results.

shared_url_keep_days

int64

Number of days to keep "share" URL links generated in the UI.

elastic_replication

object

ElasticSearch replication settings.

ca_cert

string

required

Trusted CA certificate when connecting to HTTPS Elastic endpoint, in PEM format.

enabled

boolean

required

Whether or not ElasticSearch replication is enabled.

password

string | null

Login password for ElasticSearch. Will be stored encrypted in the Sandfly database and not returned in getconfig API calls. When updating configuration, leave null to not replace existing saved password.

url

string

required

ElasticSearch HTTP/HTTPS URL.

username

string

required

ElasticSearch login username.

llm_analysis

object

enabled

boolean

required

Indicates of LLM analysis integration is enabled or not.

provider

string

required

LLM API service to use.

custom Gemini OpenAI xAI

password

string | null

API key for the LLM provider. Will be stored encrypted in the Sandfly database and not returned in getconfig calls. Leave as null when updating configuration to not replace the existing saved password.

model

string

required

Model name to use.

available_models

array of strings

After saving the configuration with enabled=true, the server will make an API call to the selected provider to get the list of available models. The next time the config is retrieved, this array will have the updated list of available models.

available_models

url

string

URL of the custom API. Only allowed to be present when provider = custom

ca_cert

string

Optional trusted CA certificate, in PEM format, to use with the custom API. Ignored when provider is not custom

results_limit

integer

required

Maximum number of results a user is allowed to select for a single analysis.

maintenance_hour

int64

Hour of the day, on the 24-hour UTC clock, to perform daily system maintenance tasks.

postgres_replication

object

PostgreSQL replication settings.

enabled

boolean

required

Indicates if PostgreSQL replication is enabled or not.

database

string

required

Database name on the target PostgreSQL server.

extra_options

string

required

Extra options to include in the connection string to PostgreSQL. Must be in the 'option=value option2=value2 ...' format.

host

string

required

PostgreSQL hostname or IP address.

password

string | null

PostrgeSQL login password. Will be stored encrypted in the Sandfly database and not returned in getconfig calls. Leave as null when updating configuration to not replace the existing saved password.

username

string

required

PostgreSQL login username.

sentinel_replication

object

Microsoft Sentinel replication settings.

enabled

boolean

required

Indicates if Sentinel replication is enabled or not.

ssh_enabled

boolean

required

Indicates if Sentinel SSH Key replication is enabled or not.

host_enabled

boolean

required

Indicates if Sentinel Hosts replication is enabled or not.

tenant_id

string

required

Microsoft Azure Tenant ID GUID.

client_id

string

required

Microsoft Azure Application Client ID GUID.

ingest_url

string

required

Sentinel Data collection endpoint logs ingestion base URL.

dcr_id

string

required

Sentinel Data collection rule immutable ID.

stream_name

string

required

Sentinel Data collection rule Results custom table stream name.

ssh_stream_name

string

required

Sentinel Data collection rule SSH Key custom table stream name.

host_stream_name

string

required

Sentinel Data collection rule Hosts custom table stream name.

alerts_only

boolean

required

Indicates type of results to send to Sentinel. True sends only alert and error results, false sends all results.

auth_method

string

required

Whether to use a client secret or certificate credentials for authentication.

client_secret certificate_credentials

auth_certificate

string

Only used when auth_method is certificate_credentials. x509 certificate, in PEM format, that matches a certificate in the Azure app registration for Sandfly to authenticate with Azure. Azure requires that the certificate use RSA keys.

password

string | null

When auth_method is client_secret, this is the Client Secret value to log in to Azure with. When auth_method is certificate_credentials, this is an unencrypted private key in PEM format associated with auth_certificate. In both cases, will be stored encrypted in the Sandfly database and not returned in getconfig calls. Leave as null when updating configuration to not replace the existing saved secret value.

sso

object

SSO configuration options.

idp_certificate

string

required

IDP certificate (IDP X509 Certificate provided in the IDP's SAML metadata).

idp_entity_id

string

required

IDP entity ID (entityID attribute on the EntityDescriptor element of the IDP's SAML metadata).

idp_sso_binding

string

required

IDP SSO binding URL.

request_signature_method

string

required

Request signing method. Typically 'none'.

none sha1 sha256 sha512

sp_certificate

string

required

If request signing is used, this Sandfly system's certificate.

sp_entity_id

string

required

This Sandfly system's client entity ID.

sp_private_key

string

required

If request signing is used, this Sandfly system's private key.

saml_enabled

boolean

required

Is SAML SSO enabled for this Sandfly instance.

Language

Credentials

Bearer

JWT

URL


xxxxxxxxxx
1
curl --request GET \
2
     --url https://sandfly-api-host/v4/config \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Server configuration retrieved

404Server configuration not found.

defaultUnexpected error