Playbook
/api/v1/soc/playbooksA reusable response runbook.
listgetcreateupdaterunSchema
| Field | Type | Notes |
|---|---|---|
| id* | uuid | Server-assigned ULID with type prefix (e.g. per_…). |
| tenant_id* | string | Tenant scope — auto-stamped from the caller's JWT. |
| app_id | string | App scope. Stamped ONLY when the caller's JWT was minted for a specific Application (integration API keys). Absent for human-user sessions. Filters reads when present. |
| created_at* | date-time | Server stamp. |
| updated_at* | date-time | Server stamp; updated on every patch. |
| created_by | uuid | Person id from the caller's JWT (sub). |
| updated_by | uuid | Person id from the last writer's JWT (sub). |
| source | string | Provenance tag — defaults to 'edm'. |
| source_type | enum | frontend | backend | server | system | apiWhere the write originated. Defaults to 'api'. |
| is_deleted | boolean | Soft-delete flag. Excluded from default list queries. |
| deleted_at | date-time | Stamped when soft-deleted; null otherwise. |
| deleted_by | uuid | Person id who soft-deleted; null otherwise. |
| schema_version | number | Document schema version. Bumped on incompatible writes. |
| name | string | Human-readable name of the playbook. |
| description | string | Description of what this playbook does and when to use it. |
| category | string | Incident response phase this playbook serves. |
| trigger_conditions | json | Conditions that must all be met to auto-fire this playbook. |
| auto_execute | boolean | Whether this playbook fires automatically when trigger conditions are met. |
| mitre_tactics | json | MITRE ATT&CK tactic IDs this playbook addresses. |
| mitre_techniques | json | MITRE ATT&CK technique IDs this playbook addresses. |
| steps | json | Ordered list of steps in the playbook. |
| required_connector_ids | json | IDs of Connectors that must be configured for this playbook to run. |
| owner_id | string | ID of the Person who owns this playbook. |
| enabled | boolean | Whether this playbook is active and eligible to run. |
| last_run_at | date-time | ISO 8601 timestamp of the most recent execution. |
| last_run_id | string | ID of the most recent playbook run instance. |
| run_stats | json | Aggregate execution statistics. |
| tags | json | Free-form tags for filtering. |
API
client.soc.playbooks.*Loading manifest…