> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Search groups



## OpenAPI

````yaml https://api.wirespeed.co/v1/openapi.json post /v1/group
openapi: 3.0.0
info:
  title: Wirespeed API
  description: The public Wirespeed API. v1 is the first stable contract.
  version: '1.0'
  contact: {}
servers:
  - url: https://api.wirespeed.co
security: []
tags: []
paths:
  /v1/group:
    post:
      tags:
        - Group
      summary: Search groups
      operationId: GroupController_search
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchGroupDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchGroupPage'
      security:
        - bearer: []
components:
  schemas:
    SearchGroupDto:
      type: object
      properties:
        size:
          type: number
        page:
          type: number
        filter:
          type: string
        search:
          type: string
        orderBy:
          type: string
        orderDir:
          type: string
          enum:
            - asc
            - desc
          x-extensible-enum: true
        isSystem:
          type: boolean
          description: Filter to system groups only
        managedBy:
          description: >-
            Filter by provenance: wirespeed, custom, or an integration platform
            slug
          allOf:
            - $ref: '#/components/schemas/GroupManagedBy'
    SearchGroupPage:
      type: object
      properties:
        totalCount:
          type: number
        data:
          type: array
          items:
            $ref: '#/components/schemas/GroupDto'
      required:
        - totalCount
        - data
    GroupManagedBy:
      type: string
      enum:
        - wirespeed
        - custom
        - acronis
        - admin-by-request
        - agger-labs
        - anthropic
        - aws
        - axonius
        - barracuda-cloudgen-firewall
        - bitwarden
        - box
        - checkpoint-firewall
        - checkpoint-harmony
        - cisco-asa
        - cisco-catalyst
        - cisco-duo
        - cisco-meraki
        - cisco-secure-access
        - cisco-umbrella
        - connectwise-psa
        - crowdstrike-falcon
        - cyberark
        - darktrace
        - dfir-iris
        - email
        - exium
        - fleet-dm
        - fortianalyzer
        - fortinet
        - freshservice
        - generic-json
        - generic-syslog
        - github
        - github-enterprise-cloud
        - google-alert-center
        - google-chronicle
        - google-directory
        - google-security-center
        - halcyon
        - halo-itsm
        - have-i-been-pwned
        - horizon3
        - hyas-protect
        - ipinfo
        - jamf-internet-security
        - jamf-pro
        - jamf-protect
        - jira-cloud
        - jira-data-center
        - jumpcloud
        - kandji
        - manage-engine-ad-audit-plus
        - microsoft
        - microsoft-entra
        - microsoft-teams
        - microsoft-teams-v2
        - mimecast
        - netskope
        - ninjaone
        - odoo-helpdesk
        - okta
        - one-password
        - onelogin
        - openai
        - orca-security
        - pager-duty
        - palo-alto-networks-cortex
        - palo-alto-ngfw
        - perception-point
        - picus
        - ping-one
        - proofpoint
        - reversing-labs
        - safebreach
        - sandfly
        - sentinel-one
        - service-now
        - slack
        - sms
        - smtp
        - sonic-wall
        - sophos
        - splunk
        - stairwell
        - sublime-security
        - tenable-nessus
        - thinkst-canary
        - tracebit
        - unifi
        - vectra
        - watchguard-firebox
        - windows-event-logs
        - wiz
        - wordfence
        - zabbix
        - zscaler-zpa
      x-extensible-enum: true
    GroupDto:
      type: object
      properties:
        id:
          type: string
        teamId:
          type: string
        name:
          type: string
        description:
          type: string
          nullable: true
        slug:
          type: string
        isSystem:
          type: boolean
        entityType:
          type: string
          enum:
            - user
            - endpoint
            - any
          x-extensible-enum: true
        color:
          type: string
          nullable: true
          enum:
            - gray
            - red
            - orange
            - amber
            - green
            - teal
            - blue
            - indigo
            - purple
            - pink
          x-extensible-enum: true
        chatOpsEnabled:
          type: boolean
        containmentEnabled:
          type: boolean
        sourceSystemUpdates:
          type: boolean
          description: >-
            When false, outbound updates to the source security product are
            skipped for detections linked to assets in this group
        alwaysNotify:
          type: boolean
          description: >-
            When true, detections involving assets in this group are always
            escalated for notification, even when the verdict rule would resolve
            or only run chat ops
        integrationId:
          type: string
          nullable: true
        externalId:
          type: string
          nullable: true
        platform:
          type: string
          nullable: true
          description: Integration platform slug when this group is vendor-synced
        createdAt:
          type: string
      required:
        - id
        - teamId
        - name
        - slug
        - isSystem
        - entityType
        - chatOpsEnabled
        - containmentEnabled
        - sourceSystemUpdates
        - alwaysNotify
        - createdAt
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Team API key sent as a Bearer token. Create a key in Wirespeed under
        Settings → Team. See
        https://docs.wirespeed.co/api-reference/authentication.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.