> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Get AQL questions for detection



## OpenAPI

````yaml https://api.wirespeed.co/v1/openapi.json get /v1/detection/{id}/aql-questions
openapi: 3.0.0
info:
  title: Wirespeed API
  description: The public Wirespeed API. v1 is the first stable contract.
  version: '1.0'
  contact: {}
servers:
  - url: https://api.wirespeed.co
security: []
tags: []
paths:
  /v1/detection/{id}/aql-questions:
    get:
      tags:
        - Detection
      summary: Get AQL questions for detection
      operationId: DetectionController_getAQLQuestions
      parameters:
        - name: id
          required: true
          in: path
          description: Detection identifier
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AQLQuestion'
        '404':
          description: ''
        '422':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpError'
      security:
        - bearer: []
components:
  schemas:
    AQLQuestion:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the AQL question
        aqlSampleId:
          type: string
          description: ID of the AQL sample this question belongs to
        question:
          type: string
          enum:
            - ESCALATED_CORRECTLY
            - CATEGORIZED_CORRECTLY
            - DESCRIPTION_CORRECT
            - NEXT_STEPS_CORRECT
            - TIMELINE_CORRECT
            - ASSETS_EXTRACTED_CORRECTLY
            - REMEDIATION_CORRECT
            - TIMELINE_VERBIAGE_CORRECT
            - OTHER_DEFECTS
          description: The specific AQL question being asked
        defectReason:
          type: string
          enum:
            - SHOULD_HAVE_BEEN_ESCALATED
            - SHOULD_NOT_HAVE_BEEN_ESCALATED
            - INCORRECT_CATEGORY
            - INCORRECT_DESCRIPTION
            - INCORRECT_TIMELINE
            - INCORRECT_NEXT_STEPS
            - INCORRECT_EXTRACTIONS
            - INCORRECT_REMEDIATION
            - INCORRECT_TIMELINE_VERBIAGE
            - OTHER
          description: Reason for the defect if one exists
        aqlBatchId:
          type: string
          description: ID of the AQL batch this question belongs to
        detectionId:
          type: string
          description: ID of the detection being reviewed
        reviewedBy:
          type: string
          description: User ID who reviewed this question
        defect:
          type: boolean
          description: Whether this sample has a defect
        defectLevel:
          type: string
          enum:
            - NONE
            - CRITICAL
            - MAJOR
            - MINOR
          description: Severity level of the defect
        comment:
          type: string
          description: Additional comments about the inspection
        internalComment:
          type: string
          description: >-
            Internal notes visible only to reviewers in the AQL modal (not sent
            to customer)
        userEmail:
          type: string
          description: Email of the user who reviewed this question
        overrideCategory:
          type: string
          enum:
            - OTHER__DIAGNOSTIC
            - OTHER__INFORMATIONAL_EVENT
            - OTHER__WARNING
            - OTHER__UNKNOWN
            - OTHER__DECEPTION
            - OTHER__DECEPTION__SIMULATION
            - OTHER__CUSTOM_DETECTION
            - CLOUD__INVOCATION
            - CLOUD__DISCOVERY
            - CLOUD__DATA_TRANSFER
            - CLOUD__PERSISTENCE
            - CLOUD__PUBLIC_BUCKET
            - ENDPOINT__DISCOVERY
            - ENDPOINT__EXECUTION
            - ENDPOINT__LIVE_OFF_THE_LAND
            - ENDPOINT__NUISANCE
            - ENDPOINT__MALWARE_DISCOVERY
            - ENDPOINT__MALWARE_EXECUTION
            - ENDPOINT__LATE_STAGE
            - ENDPOINT__PERSISTENCE
            - ENDPOINT__REMOTE_MANAGEMENT
            - ENDPOINT__LATERAL_MOVEMENT
            - ENDPOINT__IMPACT
            - ENDPOINT__EVASION
            - ENDPOINT__EXPLOITATION
            - ENDPOINT__SIMULATION
            - ENDPOINT__PLANNED_CHANGE
            - IDENTITY__LOGIN
            - IDENTITY__REJECTED_MFA
            - IDENTITY__DISCOVERY
            - IDENTITY__BRUTE_FORCE
            - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE
            - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE
            - IDENTITY__PERSISTENCE
            - IDENTITY__ACCOUNT_COMPROMISE
            - IDENTITY__SIMULATION
            - NETWORK__INBOUND_CONNECTION
            - NETWORK__OUTBOUND_CONNECTION
            - NETWORK__PHISHING
            - NETWORK__NOISY
            - NETWORK__DISCOVERY
            - EMAIL__PHISHING
            - EMAIL__PHISHING_REPORTED
            - EMAIL__EVASION
            - EMAIL__MALWARE
            - EMAIL__MALICIOUS_LINK
            - EMAIL__GRAYMAIL
            - EMAIL__SPAM
            - EMAIL__BUSINESS_EMAIL_COMPROMISE
            - EMAIL__MAILBOX_RULE
            - DATA__DATA_TRANSFER
            - DATA__DATA_SHARE
            - POSTURE__POSTURE
            - POSTURE__HEALTH
          description: Correct category suggested when marking categorization as incorrect
      required:
        - id
        - aqlSampleId
        - question
        - aqlBatchId
        - detectionId
        - defect
    HttpError:
      type: object
      properties:
        message:
          type: string
        statusCode:
          type: number
      required:
        - message
        - statusCode
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````