Skip to main content
GET
Get integration by ID

Authorizations

Authorization
string
header
required

Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.

Path Parameters

id
string<uuid>
required

Integration ID

Response

id
string
required

Unique identifier for the integration

platform
enum<string>
required

Integration platform type

Available options:
acronis,
action1,
admin-by-request,
agger-labs,
anthropic,
aws,
axonius,
barracuda-cloudgen-firewall,
bitwarden,
box,
checkpoint-firewall,
checkpoint-harmony,
cisco-asa,
cisco-catalyst,
cisco-duo,
cisco-meraki,
cisco-secure-access,
cisco-secure-endpoint,
cisco-umbrella,
cloudflare,
connectwise-psa,
crowdstrike-falcon,
cursor,
cyberark,
darktrace,
darktrace-email-security,
datto-edr,
dfir-iris,
email,
exium,
fleet-dm,
fortianalyzer,
fortinet,
freshservice,
generic-json,
generic-syslog,
github,
github-enterprise-cloud,
google-alert-center,
google-chronicle,
google-cloud-audit-logs,
google-directory,
google-security-center,
halcyon,
halo-itsm,
have-i-been-pwned,
horizon3,
hyas-protect,
ipinfo,
jamf-internet-security,
jamf-pro,
jamf-protect,
jira-cloud,
jira-data-center,
jumpcloud,
kandji,
manage-engine-ad-audit-plus,
microsoft,
microsoft-entra,
microsoft-teams,
microsoft-teams-v2,
mimecast,
netskope,
ninjaone,
odoo-helpdesk,
okta,
one-password,
onelogin,
openai,
openvpn-access-server,
orca-security,
pager-duty,
palo-alto-networks-cortex,
palo-alto-ngfw,
perception-point,
pfsense,
picus,
ping-one,
proofpoint,
reversing-labs,
safebreach,
sandfly,
sentinel-one,
service-now,
slack,
sms,
smtp,
sonic-wall,
sophos,
sophos-firewall,
splunk,
stairwell,
sublime-security,
tenable-nessus,
thinkst-canary,
threatlocker,
three-cx,
tracebit,
unifi,
upwind,
varonis-datadvantage,
vectra,
vmware-vsphere,
watchguard-firebox,
windows-event-logs,
wirespeed,
wiz,
wordfence,
zabbix,
zscaler-zpa
enabled
boolean
required

Whether the integration is enabled

teamId
string
required

ID of the team that owns this integration

config
object
required

Integration configuration metadata

permissionsUpdateAvailable
boolean
required

Whether a permissions update is available for this integration

permissionUpdateExplanation
string | null
required
deprecated

Explanation for why a permissions update is available. Deprecated: use permissionUpdates. Each pending permission is rendered as one permission: description line; null when no permissions update is pending.

permissionUpdates
object[]
required

Permissions the integration needs granted on reconnect. Empty when no permissions update is pending.

identityFields
object
required

Identity fields that uniquely identify this integration instance

createdAt
string
required

Timestamp when integration was created

lastEntitlementRefreshAt
string | null
required

Timestamp of the last successful entitlement refresh

credentialsExpireAt
string | null
required

Timestamp when the stored credentials expire, as reported by the provider or entered manually. Null when unknown or non-expiring.

publicEntitlements
object[]
required

Public entitlements with their current values and warning states

healthStatus
enum<string> | null
required

Current health status of the integration

Available options:
healthy,
unhealthy,
unstable,
unknown
healthDetails
object | null
required

Detailed health check information

sourceSystemUpdates
boolean
required

Whether outbound updates (verdict, status, notes, comments) are synced back to this integration

chatOpsEnabled
boolean
required

Whether this integration participates in Chat Ops delivery. Only meaningful for integrations that support sending messages; has no effect on notification delivery.

retentionType
enum<string>
required

Retention period for newly ingested raw data

Available options:
THIRTY_DAYS,
NINETY_DAYS,
ONE_YEAR,
THIRTEEN_MONTHS
teamName
string

Name of the team that owns this integration

requiresConfiguration
boolean

Whether the integration requires additional configuration

muteHourlyQuality
object

Mute hourly quality notifications by log type. Key is log type, value is timestamp until which it is muted.

authorizationPendingAt
string | null

When set, an OAuth install link was issued and authorization has not completed yet.

authMethod
string | null

Selected auth method id for this integration instance. Null means the first/default declared method. Corresponds to an entry in the metadata authMethods list.

syslogEndpoints
object[]

Automated syslog fleet endpoints (one per listener); domain/ip/port are null until deployed

syslogProtocolSettings
object

Syslog Forwarder protocol options (listeners, transport, TLS, framing) stored on the integration.