Help us shape the future of Go! Take the 2026 Go Developer Survey

types

package
v0.6.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	StatusLog string = "status"
	ResultLog string = "result"
	QueryLog  string = "query"
)

Types of log types

Variables

View Source 
var SupportedLanguages = map[string]struct{}{
	"en": {}, "es": {}, "fr": {}, "de": {}, "pt": {},
	"ca": {}, "it": {}, "nl": {}, "ja": {}, "ko": {},
	"zh": {}, "pl": {}, "ru": {}, "fa": {}, "ar": {},
	"hi": {}, "he": {}, "tr": {}, "uk": {}, "el": {},
}

SupportedLanguages is the allowlist for preferred_language values — it MUST mirror the frontend registry in frontend/src/i18n/locales.ts. Adding a UI language requires updating both sides; the API rejects anything else so the column cannot be used to store arbitrary data.

Functions

This section is empty.

Types

type AcceleratedQueryReadResponse 

type AcceleratedQueryReadResponse struct {
	Queries     map[string]string `json:"queries"`
	NodeInvalid bool              `json:"node_invalid"`
	Accelerate  int               `json:"accelerate"`
}

AcceleratedQueryReadResponse for accelerated on-demand queries from nodes https://github.com/osquery/osquery/blob/master/osquery/distributed/distributed.cpp#L219-L231

type AdminUserView added in v0.5.2 

type AdminUserView struct {
	ID            uint      `json:"id"`
	CreatedAt     time.Time `json:"created_at"`
	UpdatedAt     time.Time `json:"updated_at"`
	Username      string    `json:"username"`
	Email         string    `json:"email"`
	Fullname      string    `json:"fullname"`
	Admin         bool      `json:"admin"`
	Service       bool      `json:"service"`
	UUID          string    `json:"uuid"`
	TokenExpire   time.Time `json:"token_expire"`
	EnvironmentID uint      `json:"environment_id"`
	// AuthSource is empty for the password-login path (the default)
	// and "oidc" for users JIT-provisioned through the federated
	// callback. Surfaced so the SPA Users page can show an "OIDC"
	// badge alongside the existing admin/service labels.
	AuthSource string `json:"auth_source"`
}

AdminUserView is the PII-minimized projection of an AdminUser for the GET /api/v1/users and GET /api/v1/users/{username} endpoints. Drops LastIPAddress / LastUserAgent / LastAccess / LastTokenUse: a super-admin reading another super-admin's record gets enough to manage them (username, email, fullname, admin/service flags, env scope) but not the network/timing metadata that helps an attacker who later compromises one super-admin profile target the others.

Users querying THEIR OWN record see the metadata they need via the pre-existing UserMeResponse from /api/v1/users/me — this view is strictly for the cross-user "list / inspect another admin" paths.

type AlertChannelCreateRequest added in v0.5.8 

type AlertChannelCreateRequest struct {
	Name          string          `json:"name"`
	EnvironmentID uint            `json:"environment_id"`
	Type          string          `json:"type"`
	Enabled       bool            `json:"enabled"`
	Config        json.RawMessage `json:"config" swaggertype:"object"`
	Info          string          `json:"info,omitempty"`
}

AlertChannelCreateRequest is the body for POST /api/v1/alerts/channels and PUT /api/v1/alerts/channels/{id}. A secret field set to "***" on update is merged from the previously stored value by the handler.

type AlertChannelTestRequest added in v0.5.8 

type AlertChannelTestRequest struct {
	ID     uint            `json:"id,omitempty"`
	Type   string          `json:"type"`
	Config json.RawMessage `json:"config" swaggertype:"object"`
}

AlertChannelTestRequest is the body for POST /api/v1/alerts/channels/test: deliver one synthetic notification through this config without storing it. ID, when set, names the stored channel whose secrets fill in any "***" placeholder the form did not touch.

type AlertChannelTypeSpec added in v0.5.8 

type AlertChannelTypeSpec struct {
	Type         string           `json:"type"`
	Description  string           `json:"description"`
	HasSecret    bool             `json:"has_secret"`
	SecretFields []string         `json:"secret_fields,omitempty"`
	Fields       []AlertFieldSpec `json:"fields,omitempty"`
}

AlertChannelTypeSpec is one entry in the GET /api/v1/alerts/channels/types response.

type AlertFieldSpec added in v0.5.8 

type AlertFieldSpec struct {
	Name        string `json:"name"`
	Label       string `json:"label"`
	Type        string `json:"type"`
	Required    bool   `json:"required"`
	Placeholder string `json:"placeholder,omitempty"`
	Help        string `json:"help,omitempty"`
	Default     any    `json:"default,omitempty"`
}

AlertFieldSpec is one field in an alert channel type's config schema.

type AlertRuleCreateRequest added in v0.5.8 

type AlertRuleCreateRequest struct {
	Name          string `json:"name"`
	EnvironmentID uint   `json:"environment_id"`
	Source        string `json:"source"`
	// NodeUUID optionally scopes the rule to one node (used by the node
	// detail page's "Alert on this node" button). Empty = all nodes.
	NodeUUID       string `json:"node_uuid,omitempty"`
	MatchType      string `json:"match_type"`
	MatchField     string `json:"match_field,omitempty"`
	MatchValue     string `json:"match_value"`
	StatusSeverity string `json:"status_severity,omitempty"`
	// VulnMinSeverity is the threshold of a "vuln_finding" rule: kev,
	// critical, high, medium, low or any.
	VulnMinSeverity string `json:"vuln_min_severity,omitempty"`
	CooldownMinutes int    `json:"cooldown_minutes,omitempty"`
	ChannelIDs      []uint `json:"channel_ids,omitempty"`
	Enabled         bool   `json:"enabled"`
	Info            string `json:"info,omitempty"`
}

AlertRuleCreateRequest is the body for POST /api/v1/alerts/rules and PUT /api/v1/alerts/rules/{id}. All fields are required on update.

type ApiActionsRequest 

type ApiActionsRequest struct {
	Certificate string `json:"certificate"`
	MacPkgURL   string `json:"url_mac_pkg"`
	MsiPkgURL   string `json:"url_msi_pkg"`
	RpmPkgURL   string `json:"url_rpm_pkg"`
	DebPkgURL   string `json:"url_deb_pkg"`
}

ApiActionsRequest to receive action requests

type ApiAddPackageRequest added in v0.5.6 

type ApiAddPackageRequest struct {
	Type      string `json:"type"`
	Arch      string `json:"architecture"`
	URL       string `json:"url"`
	IsDefault bool   `json:"is_default"`
}

ApiAddPackageRequest to add an enrolling package to an environment.

type ApiDataResponse 

type ApiDataResponse struct {
	Data string `json:"data"`
}

ApiDataResponse to be returned to API requests for generic data

type ApiDistributedQueryRequest 

type ApiDistributedQueryRequest struct {
	UUIDs        []string `json:"uuid_list"`
	Platforms    []string `json:"platform_list"`
	Environments []string `json:"environment_list"`
	Hosts        []string `json:"host_list"`
	Tags         []string `json:"tag_list"`
	Query        string   `json:"query"`
	Path         string   `json:"path"`
	Hidden       bool     `json:"hidden"`
	ExpHours     int      `json:"exp_hours"`
}

ApiDistributedQueryRequest to receive query requests

type ApiEnvRequest added in v0.5.2 

type ApiEnvRequest struct {
	Action   string `json:"action"`
	Name     string `json:"name"`
	UUID     string `json:"uuid"`
	Hostname string `json:"hostname"`
	Icon     string `json:"icon"`
	Type     string `json:"type"`
}

ApiEnvRequest to receive environment action requests

type ApiErrorResponse 

type ApiErrorResponse struct {
	Error string `json:"error"`
	Code  string `json:"code,omitempty"`
}

ApiErrorResponse to be returned to API requests with the error message

type ApiGenericResponse 

type ApiGenericResponse struct {
	Message string `json:"message"`
}

ApiGenericResponse to be returned to API requests for anything

type ApiLoginRequest 

type ApiLoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
	ExpHours int    `json:"exp_hours"`
}

ApiLoginRequest to receive login requests

type ApiLoginResponse 

type ApiLoginResponse struct {
	Token     string `json:"token"`
	CSRFToken string `json:"csrf_token,omitempty"`
}

ApiLoginResponse to be returned to API login requests with the generated token

type ApiLookupRequest added in v0.4.5 

type ApiLookupRequest struct {
	Identifier string `json:"identifier"`
}

ApiLookupRequest to receive lookup requests

type ApiNodeGenericRequest 

type ApiNodeGenericRequest struct {
	UUID string `json:"uuid"`
}

ApiNodeGenericRequest to receive generic node requests

type ApiNodeTagRequest added in v0.4.6 

type ApiNodeTagRequest struct {
	UUID   string `json:"uuid"`
	Tag    string `json:"tag"`
	Type   uint   `json:"type"`
	Custom string `json:"custom"`
}

ApiNodeTagRequest to receive tag node requests

type ApiQueriesResponse 

type ApiQueriesResponse struct {
	Name string `json:"query_name"`
}

ApiQueriesResponse to be returned to API requests for queries

type ApiTagsRequest 

type ApiTagsRequest struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Color       string `json:"color"`
	Icon        string `json:"icon"`
	Env         string `json:"env"`
	TagType     uint   `json:"tagtype"`
	Custom      string `json:"custom"`
}

ApiTagsRequest to receive tag requests

type ApiUpdatePackageRequest added in v0.5.6 

type ApiUpdatePackageRequest struct {
	URL string `json:"url"`
}

ApiUpdatePackageRequest to update an enrolling package URL.

type ApiUserRequest added in v0.4.6 

type ApiUserRequest struct {
	Username     string   `json:"username"`
	Password     string   `json:"password"`
	Email        string   `json:"email"`
	Fullname     string   `json:"fullname"`
	Admin        bool     `json:"admin"`
	NotAdmin     bool     `json:"not_admin"`
	Service      bool     `json:"service"`
	NotService   bool     `json:"not_service"`
	API          bool     `json:"api"`
	Environments []string `json:"environments"`
	UserAccess   *bool    `json:"user_access,omitempty"`
	QueryAccess  *bool    `json:"query_access,omitempty"`
	CarveAccess  *bool    `json:"carve_access,omitempty"`
	AdminAccess  *bool    `json:"admin_access,omitempty"`
}

ApiUserRequest to receive user requests

type AuditLogView added in v0.5.2 

type AuditLogView struct {
	ID            uint      `json:"id"`
	CreatedAt     time.Time `json:"created_at"`
	Service       string    `json:"service"`
	Username      string    `json:"username"`
	Line          string    `json:"line"`
	LogType       uint      `json:"log_type"`
	Severity      uint      `json:"severity"`
	SourceIP      string    `json:"source_ip"`
	EnvironmentID uint      `json:"environment_id"`
	EnvUUID       string    `json:"env_uuid,omitempty"`
}

AuditLogView is the SPA-canonical projection of one pkg/auditlog.AuditLog row. We use a hand-typed struct (rather than the storage struct directly) so the JSON envelope stays stable as the storage shape evolves. Timestamps are RFC3339 to match SavedQueryView / CarveFileView and the SPA's formatRelative parser.

type AuditLogsPagedResponse added in v0.5.2 

type AuditLogsPagedResponse struct {
	Items      []AuditLogView `json:"items"`
	Page       int            `json:"page"`
	PageSize   int            `json:"page_size"`
	TotalItems int64          `json:"total_items"`
	TotalPages int            `json:"total_pages"`
}

AuditLogsPagedResponse is the SPA-canonical paginated response for GET /api/v1/audit-logs.

type BIOSInfo added in v0.5.2 

type BIOSInfo struct {
	Vendor     string `json:"vendor,omitempty"`
	Version    string `json:"version,omitempty"`
	Date       string `json:"date,omitempty"`
	Revision   string `json:"revision,omitempty"`
	Address    string `json:"address,omitempty"`
	Size       string `json:"size,omitempty"`
	VolumeSize string `json:"volume_size,omitempty"`
}

BIOSInfo mirrors host_details.platform_info from the osquery enroll payload. "Platform info" in osquery's vocabulary is BIOS / firmware metadata; renamed here so the SPA naming aligns with what an operator expects to read.

type BuildMetadata added in v0.4.6 

type BuildMetadata struct {
	Version string
	Commit  string
	Date    string
}

BuildMetadata to show build metadata

type CarveBlockRequest 

type CarveBlockRequest struct {
	BlockID   int    `json:"block_id"`
	SessionID string `json:"session_id"`
	RequestID string `json:"request_id"`
	Data      string `json:"data"`
}

CarveBlockRequest received to begin a carve

type CarveBlockResponse 

type CarveBlockResponse struct {
	Success bool `json:"success"`
}

CarveBlockResponse for osquery nodes

type CarveDetailResponse added in v0.5.2 

type CarveDetailResponse struct {
	Query DistributedQueryView `json:"query"`
	Files []CarveFileView      `json:"files"`
}

CarveDetailResponse is the SPA-canonical response for GET /api/v1/carves/{env}/{name}. It pairs the carve QUERY metadata with the per-node CarvedFile rows produced by the carve.

type CarveFileView added in v0.5.2 

type CarveFileView struct {
	CarveID         string    `json:"carve_id"`
	SessionID       string    `json:"session_id"`
	UUID            string    `json:"uuid"`
	Path            string    `json:"path"`
	Status          string    `json:"status"`
	CarveSize       int       `json:"carve_size"`
	BlockSize       int       `json:"block_size"`
	TotalBlocks     int       `json:"total_blocks"`
	CompletedBlocks int       `json:"completed_blocks"`
	Archived        bool      `json:"archived"`
	CreatedAt       time.Time `json:"created_at"`
	CompletedAt     time.Time `json:"completed_at"`
}

CarveFileView is the SPA-canonical projection of a single carved file row (one per node that completed the carve). Timestamps are RFC3339 so the SPA's formatRelative parser handles them; CarveID is the disambiguator when downloading the archive of a multi-node carve.

type CarveInitRequest 

type CarveInitRequest struct {
	BlockCount int    `json:"block_count"`
	BlockSize  int    `json:"block_size"`
	CarveSize  int    `json:"carve_size"`
	CarveID    string `json:"carve_id"`
	RequestID  string `json:"request_id"`
	NodeKey    string `json:"node_key"`
}

CarveInitRequest received to begin a carve

type CarveInitResponse 

type CarveInitResponse struct {
	Success   bool   `json:"success"`
	SessionID string `json:"session_id"`
}

CarveInitResponse for osquery nodes

type CarvesPagedResponse added in v0.5.2 

type CarvesPagedResponse struct {
	Items      []queries.DistributedQuery `json:"items"`
	Page       int                        `json:"page"`
	PageSize   int                        `json:"page_size"`
	TotalItems int64                      `json:"total_items"`
	TotalPages int                        `json:"total_pages"`
}

CarvesPagedResponse is the SPA-canonical paginated response for GET /api/v1/carves/{env}. Items are carve-type DistributedQuery rows (one per carve operation, regardless of how many nodes the carve targeted).

type CertRequest 

type CertRequest FlagsRequest

CertRequest to retrieve certificate

type ConfigRequest 

type ConfigRequest GenericRequest

ConfigRequest received when nodes request configuration

type ConfigResponse 

type ConfigResponse GenericResponse

ConfigResponse for configuration requests from nodes

type DistributedQueryView added in v0.5.4 

type DistributedQueryView struct {
	queries.DistributedQuery
	Targets []QueryTargetView `json:"targets"`
}

DistributedQueryView augments a query row with its recorded targets.

type EnrollRequest 

type EnrollRequest struct {
	EnrollSecret   string `json:"enroll_secret"`
	HostIdentifier string `json:"host_identifier"`
	PlatformType   string `json:"platform_type"`
	HostDetails    struct {
		EnrollOSVersion    OSVersionTable    `json:"os_version"`
		EnrollOsqueryInfo  OsqueryInfoTable  `json:"osquery_info"`
		EnrollSystemInfo   SystemInfoTable   `json:"system_info"`
		EnrollPlatformInfo PlatformInfoTable `json:"platform_info"`
	} `json:"host_details"`
}

EnrollRequest received when nodes enroll

type EnrollResponse 

type EnrollResponse struct {
	NodeKey     string `json:"node_key"`
	NodeInvalid bool   `json:"node_invalid"`
}

EnrollResponse to be returned to agents

type EnvAccessView added in v0.5.2 

type EnvAccessView struct {
	User  bool `json:"user"`
	Query bool `json:"query"`
	Carve bool `json:"carve"`
	Admin bool `json:"admin"`
}

EnvAccessView mirrors users.EnvAccess but lives in the types package so the API request/response shapes don't pull in pkg/users for SPA-side codegen.

type EnvConfigPatchRequest added in v0.5.2 

type EnvConfigPatchRequest struct {
	Options    *string `json:"options,omitempty"`
	Schedule   *string `json:"schedule,omitempty"`
	Packs      *string `json:"packs,omitempty"`
	Decorators *string `json:"decorators,omitempty"`
	ATC        *string `json:"atc,omitempty"`
	Flags      *string `json:"flags,omitempty"`
}

EnvConfigPatchRequest is the body for PATCH /api/v1/environments/config/{env}. Pointer fields: nil means "leave this section alone", non-nil writes it. Each non-nil value is JSON-validated before persisting; the handler rejects the whole payload if any section is invalid (no partial writes).

type EnvConfigResponse added in v0.5.2 

type EnvConfigResponse struct {
	Options    string `json:"options"`
	Schedule   string `json:"schedule"`
	Packs      string `json:"packs"`
	Decorators string `json:"decorators"`
	ATC        string `json:"atc"`
	Flags      string `json:"flags"`
}

EnvConfigResponse is the GET /api/v1/environments/config/{env} payload — each field is the raw JSON string for that osquery config section so the SPA's Monaco editor can render and edit it as-is.

type EnvCreateRequest added in v0.5.2 

type EnvCreateRequest struct {
	Name     string `json:"name"`
	Hostname string `json:"hostname"`
	Type     string `json:"type,omitempty"`
	Icon     string `json:"icon,omitempty"`
}

EnvCreateRequest is the body for POST /api/v1/environments.

type EnvExpirationPatchRequest added in v0.5.2 

type EnvExpirationPatchRequest struct {
	Action string `json:"action"`
}

EnvExpirationPatchRequest is the body for PATCH /api/v1/environments/expiration/{env}. Action is one of: extend, expire, rotate, not-expire.

type EnvIntervalsPatchRequest added in v0.5.2 

type EnvIntervalsPatchRequest struct {
	ConfigInterval *int `json:"config_interval,omitempty"`
	LogInterval    *int `json:"log_interval,omitempty"`
	QueryInterval  *int `json:"query_interval,omitempty"`
}

EnvIntervalsPatchRequest is the body for PATCH /api/v1/environments/intervals/{env}. Each interval is in seconds; pointer semantics same as EnvConfigPatchRequest.

type EnvOsqueryResponse added in v0.6.1 

type EnvOsqueryResponse struct {
	Target *OsqueryTargetView        `json:"target"`
	Counts []OsqueryVersionHostCount `json:"counts"`
	// Available lists the library version names (no digests), ascending.
	Available []string `json:"available"`
	// Rollout is the environment's latest rollout, null when it never had one.
	Rollout *EnvOsqueryRollout `json:"rollout"`
	// WindowsHosts is the number of Windows hosts in the environment; Windows
	// upgrades cannot be rolled back automatically.
	WindowsHosts int `json:"windows_hosts"`
}

EnvOsqueryResponse is the osquery target of an environment with its host counts.

type EnvOsqueryRolledBackHost added in v0.6.1 

type EnvOsqueryRolledBackHost struct {
	Host   string    `json:"host"`
	Reason string    `json:"reason"`
	At     time.Time `json:"at"`
}

EnvOsqueryRolledBackHost is a host that rejected the rollout's version. Host and Reason are reported by the host and are untrusted.

type EnvOsqueryRollout added in v0.6.1 

type EnvOsqueryRollout struct {
	State         string                    `json:"state"`
	RequestID     string                    `json:"request_id"`
	Version       string                    `json:"version"`
	Stage         int                       `json:"stage"`
	Stages        []int                     `json:"stages"`
	StageOpenedAt time.Time                 `json:"stage_opened_at"`
	NextStageAt   *time.Time                `json:"next_stage_at"`
	Counts        EnvOsqueryRolloutCounts   `json:"counts"`
	Paused        *EnvOsqueryRolledBackHost `json:"paused"`
	// RolledBackHosts is newest first, at most 50.
	RolledBackHosts []EnvOsqueryRolledBackHost `json:"rolled_back_hosts"`
}

EnvOsqueryRollout is the staged rollout of an environment target. Stage is 1-based and Stages lists the share (percent) of hosts per stage.

type EnvOsqueryRolloutCounts added in v0.6.1 

type EnvOsqueryRolloutCounts struct {
	Eligible   int `json:"eligible"`
	Upgraded   int `json:"upgraded"`
	Waiting    int `json:"waiting"`
	RolledBack int `json:"rolled_back"`
}

EnvOsqueryRolloutCounts are the host counts of a rollout.

type EnvUpdateRequest added in v0.5.2 

type EnvUpdateRequest struct {
	Name          *string `json:"name,omitempty"`
	Hostname      *string `json:"hostname,omitempty"`
	Type          *string `json:"type,omitempty"`
	Icon          *string `json:"icon,omitempty"`
	DebugHTTP     *bool   `json:"debug_http,omitempty"`
	AcceptEnrolls *bool   `json:"accept_enrolls,omitempty"`
}

EnvUpdateRequest is the body for PATCH /api/v1/environments/{env}. Pointer fields distinguish "unset" from "set to empty"; only supplied fields are written.

type EnvironmentExtensionsResponse added in v0.6.1 

type EnvironmentExtensionsResponse struct {
	Assigned  []ExtensionSummary `json:"assigned"`
	Available []ExtensionSummary `json:"available"`
}

EnvironmentExtensionsResponse is what an environment runs and the ordinary extensions an environment admin can add to it.

type ExtensionCreateRequest added in v0.6.1 

type ExtensionCreateRequest struct {
	Name             string `json:"name"`
	Description      string `json:"description"`
	Version          string `json:"version"`
	CommandExecution bool   `json:"command_execution"`
}

ExtensionCreateRequest adds an extension to the library.

type ExtensionFileView added in v0.6.1 

type ExtensionFileView struct {
	Platform  string    `json:"platform"`
	Arch      string    `json:"arch"`
	Size      int64     `json:"size"`
	SHA256    string    `json:"sha256"`
	Filename  string    `json:"filename"`
	UpdatedAt time.Time `json:"updated_at"`
	UpdatedBy string    `json:"updated_by"`
}

ExtensionFileView is an extension binary for one platform and arch.

type ExtensionSummary added in v0.6.1 

type ExtensionSummary struct {
	ID               uint     `json:"id"`
	Name             string   `json:"name"`
	Description      string   `json:"description"`
	Version          string   `json:"version"`
	CommandExecution bool     `json:"command_execution"`
	Platforms        []string `json:"platforms"`
}

ExtensionSummary is a library extension as environment and node admins see it. Platforms lists the platforms it has a file for.

type ExtensionUpdateRequest added in v0.6.1 

type ExtensionUpdateRequest struct {
	Description      *string `json:"description,omitempty"`
	Version          *string `json:"version,omitempty"`
	CommandExecution *bool   `json:"command_execution,omitempty"`
}

ExtensionUpdateRequest changes the fields that are set.

type ExtensionView added in v0.6.1 

type ExtensionView struct {
	ID               uint                `json:"id"`
	Name             string              `json:"name"`
	Description      string              `json:"description"`
	Version          string              `json:"version"`
	CommandExecution bool                `json:"command_execution"`
	Files            []ExtensionFileView `json:"files"`
	Environments     int                 `json:"environments"`
	Nodes            int                 `json:"nodes"`
	CreatedBy        string              `json:"created_by"`
	UpdatedAt        time.Time           `json:"updated_at"`
}

ExtensionView is an osquery extension in the library, with its files and how many environments and nodes it is assigned to.

type FlagsRequest 

type FlagsRequest struct {
	Secret     string `json:"secret"`
	SecrefFile string `json:"secretFile"`
	CertFile   string `json:"certFile"`
	// UUID and Apply are sent by osctrld for its service sync; older osctrld
	// sends neither. Both are untrusted node input.
	UUID  string              `json:"uuid,omitempty"`
	Apply *OsctrldApplyStatus `json:"apply,omitempty"`
}

FlagsRequest to retrieve flags

type GenericRequest 

type GenericRequest struct {
	NodeKey string `json:"node_key"`
}

GenericRequest to some endpoints

type GenericResponse 

type GenericResponse struct {
	NodeInvalid bool `json:"node_invalid"`
}

GenericResponse for osquery nodes

type GetPermissionsResponse added in v0.5.3 

type GetPermissionsResponse struct {
	Username    string                   `json:"username"`
	Permissions map[string]EnvAccessView `json:"permissions"`
}

GetPermissionsResponse is what GET /api/v1/users/{username}/permissions returns.

Permissions maps env UUID → EnvAccessView. An env with no permission rows for the user is OMITTED — the SPA treats absence as "no access yet" (the default zero-value EnvAccess). Returning every env even with all-false rows would bloat responses for tenants with hundreds of envs without adding signal.

type LogDecorations 

type LogDecorations struct {
	Username       string `json:"username"`
	OsqueryUser    string `json:"osquery_user"`
	LocalHostname  string `json:"local_hostname"`
	Hostname       string `json:"hostname"`
	OsqueryVersion string `json:"osquery_version"`
	ConfigHash     string `json:"config_hash"`
	DaemonHash     string `json:"osquery_md5"`
}

LogDecorations for decorations field in node logs requests

type LogGenericData 

type LogGenericData struct {
	HostIdentifier string         `json:"hostIdentifier"`
	Decorations    LogDecorations `json:"decorations"`
	Version        string         `json:"version"`
}

LogGenericData to parse both status and result logs

type LogRequest 

type LogRequest struct {
	NodeKey string          `json:"node_key"`
	LogType string          `json:"log_type"`
	Data    json.RawMessage `json:"data"`
}

LogRequest received to process logs

type LogResponse 

type LogResponse GenericResponse

LogResponse for log requests from nodes

type LogResultData 

type LogResultData struct {
	Name           string          `json:"name"`
	Epoch          int64           `json:"epoch"`
	Action         string          `json:"action"`
	Columns        json.RawMessage `json:"columns"`
	Snapshot       json.RawMessage `json:"snapshot"`
	Counter        int             `json:"counter"`
	UnixTime       StringInt       `json:"unixTime"`
	Decorations    LogDecorations  `json:"decorations"`
	CalendarTime   string          `json:"calendarTime"`
	HostIdentifier string          `json:"hostIdentifier"`
}

LogResultData to be used processing result logs from nodes

type LogSinkCloneRequest added in v0.5.7 

type LogSinkCloneRequest struct {
	SourceEnvironmentID uint `json:"source_environment_id"`
	TargetEnvironmentID uint `json:"target_environment_id"`
	Overwrite           bool `json:"overwrite"`
}

LogSinkCloneRequest is the body for POST /api/v1/log-sinks/clone. SourceEnvironmentID 0 means "global". Overwrite=false returns 409 if the target environment already has sinks.

type LogSinkCreateRequest added in v0.5.7 

type LogSinkCreateRequest struct {
	Name          string          `json:"name"`
	Type          string          `json:"type"`
	Enabled       bool            `json:"enabled"`
	Order         int             `json:"order"`
	Config        json.RawMessage `json:"config" swaggertype:"object"`
	EnvironmentID uint            `json:"environment_id"`
	Info          string          `json:"info,omitempty"`
	Categories    []string        `json:"categories,omitempty"`
}

LogSinkCreateRequest is the body for POST /api/v1/log-sinks.

type LogSinkFieldSpec added in v0.5.7 

type LogSinkFieldSpec struct {
	Name        string   `json:"name"`
	Label       string   `json:"label"`
	Type        string   `json:"type"`
	Required    bool     `json:"required"`
	Secret      bool     `json:"secret"`
	Placeholder string   `json:"placeholder,omitempty"`
	Help        string   `json:"help,omitempty"`
	Options     []string `json:"options,omitempty"`
	Default     any      `json:"default,omitempty"`
}

LogSinkFieldSpec is one field in a sink type's config schema. The SPA renders a typed form from this; the backend validates the submitted JSON against the registered Decode func.

type LogSinkTypeSpec added in v0.5.7 

type LogSinkTypeSpec struct {
	Type         string             `json:"type"`
	Description  string             `json:"description"`
	HasSecret    bool               `json:"has_secret"`
	SecretFields []string           `json:"secret_fields,omitempty"`
	Fields       []LogSinkFieldSpec `json:"fields,omitempty"`
	Categories   []string           `json:"categories"`
}

LogSinkTypeSpec is one entry in the GET /api/v1/log-sinks/types response. It advertises a supported sink type, whether its config contains secrets (so the SPA masks those fields), the JSON keys that hold secrets (so the SPA can render password inputs for them), and the typed field schema the SPA renders as a dynamic form.

type LogSinkUpdateRequest added in v0.5.7 

type LogSinkUpdateRequest struct {
	Name       string          `json:"name"`
	Type       string          `json:"type"`
	Enabled    bool            `json:"enabled"`
	Order      int             `json:"order"`
	Config     json.RawMessage `json:"config" swaggertype:"object"`
	Info       string          `json:"info,omitempty"`
	Categories []string        `json:"categories,omitempty"`
}

LogSinkUpdateRequest is the body for PUT /api/v1/log-sinks/{id}. All fields are required; a secret field set to "***" is merged from the previously stored value by the handler so the SPA can submit a form without re-entering every secret.

type LogStatusData 

type LogStatusData struct {
	Line           StringInt      `json:"line"`
	Message        string         `json:"message"`
	Version        string         `json:"version"`
	Filename       string         `json:"filename"`
	Severity       StringInt      `json:"severity"`
	UnixTime       StringInt      `json:"unixTime"`
	Decorations    LogDecorations `json:"decorations"`
	CalendarTime   string         `json:"calendarTime"`
	HostIdentifier string         `json:"hostIdentifier"`
}

LogStatusData to be used processing status logs from nodes

type LoginEnvironment added in v0.5.2 

type LoginEnvironment struct {
	UUID string `json:"uuid"`
	Name string `json:"name"`
}

LoginEnvironment is the pre-auth-safe projection of an environment returned by GET /api/v1/login/environments. UUID + name only — every other field stays behind auth.

type NodeConfigRequest added in v0.6.1 

type NodeConfigRequest struct {
	Override  string     `json:"override"`
	ExpiresAt *time.Time `json:"expires_at"`
}

NodeConfigRequest sets a node's osquery configuration override.

type NodeConfigResponse added in v0.6.1 

type NodeConfigResponse struct {
	Environment string     `json:"environment"`
	Override    string     `json:"override"`
	Applied     string     `json:"applied"`
	ExpiresAt   *time.Time `json:"expires_at"`
	Expired     bool       `json:"expired"`
	UpdatedBy   string     `json:"updated_by"`
	UpdatedAt   *time.Time `json:"updated_at"`
}

NodeConfigResponse is a node's osquery configuration override state. Applied equals Environment when there is no override or it has expired.

type NodeEnrichment added in v0.5.2 

type NodeEnrichment struct {
	System  *SystemInfo     `json:"system,omitempty"`
	BIOS    *BIOSInfo       `json:"bios,omitempty"`
	OS      *OSInfo         `json:"os,omitempty"`
	Osquery *OsqueryRuntime `json:"osquery,omitempty"`
}

NodeEnrichment is the projected view of everything we want to expose from nodes.OsqueryNode.RawEnrollment that isn't already on OsqueryNode itself. Embedded into NodeView with `json:"system_info,omitempty"` — the outer key is a slight abuse of the name (it carries BIOS + OS + runtime too) but it matches the heaviest sub-object and reads well in the SPA.

type NodeExtensionAssignRequest added in v0.6.1 

type NodeExtensionAssignRequest struct {
	ExpiresAt *time.Time `json:"expires_at" binding:"required"`
}

NodeExtensionAssignRequest assigns a command-execution extension to a node until ExpiresAt. The key is required: only an explicit null means no expiry.

type NodeExtensionAssignment added in v0.6.1 

type NodeExtensionAssignment struct {
	ExtensionID uint       `json:"extension_id"`
	Name        string     `json:"name"`
	ExpiresAt   *time.Time `json:"expires_at"`
	Expired     bool       `json:"expired"`
	CreatedBy   string     `json:"created_by"`
	CreatedAt   time.Time  `json:"created_at"`
}

NodeExtensionAssignment is a command-execution extension assigned to a node.

type NodeExtensionEffective added in v0.6.1 

type NodeExtensionEffective struct {
	Name             string   `json:"name"`
	Source           string   `json:"source"`
	CommandExecution bool     `json:"command_execution"`
	Platforms        []string `json:"platforms"`
	Available        bool     `json:"available"`
}

NodeExtensionEffective is an extension the node should run. Source is "environment" or "host"; Available is whether there is a file for the node's platform.

type NodeExtensionStatusView added in v0.6.1 

type NodeExtensionStatusView struct {
	Name       string     `json:"name"`
	SHA256     string     `json:"sha256"`
	Result     string     `json:"result"`
	Error      string     `json:"error"`
	At         *time.Time `json:"at"`
	ReportedAt time.Time  `json:"reported_at"`
	// Lingering is set by osctrl when osctrld reports a command-execution extension as kept (its removal failed) and the node has no unexpired assignment for it.
	Lingering bool `json:"lingering"`
}

NodeExtensionStatusView is the last status osctrld reported for one extension. Every field but ReportedAt comes from the host.

type NodeExtensionsResponse added in v0.6.1 

type NodeExtensionsResponse struct {
	Effective   []NodeExtensionEffective  `json:"effective"`
	Assignments []NodeExtensionAssignment `json:"assignments"`
	Status      []NodeExtensionStatusView `json:"status"`
	Library     []ExtensionSummary        `json:"library"`
}

NodeExtensionsResponse is a node's extensions. Status is reported by the host and is untrusted. Library, the command-execution extensions that can be assigned to the node, is null unless the caller is a super admin.

type NodeFlagsRequest added in v0.6.1 

type NodeFlagsRequest struct {
	Override  string     `json:"override"`
	ExpiresAt *time.Time `json:"expires_at"`
}

NodeFlagsRequest sets a node's osquery flags override.

type NodeFlagsResponse added in v0.6.1 

type NodeFlagsResponse struct {
	Environment string             `json:"environment"`
	Override    string             `json:"override"`
	Applied     string             `json:"applied"`
	ExpiresAt   *time.Time         `json:"expires_at"`
	Expired     bool               `json:"expired"`
	UpdatedBy   string             `json:"updated_by"`
	UpdatedAt   *time.Time         `json:"updated_at"`
	Conflicts   []string           `json:"conflicts"`
	Osctrld     *OsctrldStatusView `json:"osctrld"`
}

NodeFlagsResponse is a node's osquery flags override state. Environment and Applied keep the __SECRET_FILE__ and __CERT_FILE__ placeholders. Applied equals Environment when there is no override or it has expired.

type NodeHealth added in v0.5.5 

type NodeHealth struct {
	Status  string   `json:"status,omitempty"`
	Reason  string   `json:"reason,omitempty"`
	Signals []string `json:"signals,omitempty"`
}

NodeHealth is a compact triage signal for dense node-list and node-detail surfaces. Detailed evidence stays in activity/status/posture views.

func CalculateNodeHealth added in v0.5.5 

func CalculateNodeHealth(n nodes.OsqueryNode, inactiveHours int64, postureEnabled bool, posture *NodePostureSummary) NodeHealth

CalculateNodeHealth produces the table/detail triage state from the same data the API already projects. Offline wins over posture so operators do not mistake stale posture data for current risk.

type NodeOsqueryResponse added in v0.6.1 

type NodeOsqueryResponse struct {
	Pin              *OsqueryPinView         `json:"pin"`
	Target           *OsqueryEffectiveTarget `json:"target"`
	InstalledVersion string                  `json:"installed_version"`
	Upgrade          *OsqueryUpgradeView     `json:"upgrade"`
	// Available lists the library version names (no digests), ascending.
	Available []string `json:"available"`
	// PlatformUnsupported is true when the node's stored platform has no
	// osquery package (for example freebsd), so osctrld cannot upgrade it.
	// Windows is supported.
	PlatformUnsupported bool `json:"platform_unsupported"`
	// Rollout is set only while the environment's staged rollout (running or
	// paused) is what the node's target comes from; null otherwise.
	Rollout *NodeOsqueryRollout `json:"rollout"`
}

NodeOsqueryResponse is the osquery upgrade state of a node.

type NodeOsqueryRollout added in v0.6.1 

type NodeOsqueryRollout struct {
	State      string     `json:"state"`
	Stage      int        `json:"stage"`
	Stages     []int      `json:"stages"`
	EligibleAt *time.Time `json:"eligible_at"`
}

NodeOsqueryRollout tells where a node stands in the environment rollout. Stage is the 1-based stage the host joins, Stages the percent per stage. EligibleAt is when that stage opens, null when paused or already open.

type NodePostureSummary added in v0.5.5 

type NodePostureSummary struct {
	RiskLevel string `json:"risk_level,omitempty"`
}

NodePostureSummary is optional quick posture metadata for dense node-list surfaces. Keep this intentionally compact: detailed controls and numeric scores stay on the posture tab.

type NodeUptime added in v0.5.5 

type NodeUptime struct {
	Days         int       `json:"days"`
	Hours        int       `json:"hours"`
	Minutes      int       `json:"minutes"`
	Seconds      int       `json:"seconds"`
	TotalSeconds int64     `json:"total_seconds,omitempty"`
	LastSeen     time.Time `json:"last_seen,omitempty"`
}

NodeUptime is optional node metadata populated from the latest osctrl:posture:uptime result when posture collection is enabled.

type NodeView added in v0.5.2 

type NodeView struct {
	nodes.OsqueryNode
	NodeKey     string              `json:"node_key,omitempty"`
	Enrichment  *NodeEnrichment     `json:"system_info,omitempty"`
	CountryCode string              `json:"country_code,omitempty"`
	Uptime      *NodeUptime         `json:"uptime,omitempty"`
	Posture     *NodePostureSummary `json:"posture,omitempty"`
	Tags        []tags.AdminTag     `json:"tags,omitempty"`
	Health      NodeHealth          `json:"health,omitempty"`
}

NodeView is the JSON shape returned by the node show + list endpoints. It embeds OsqueryNode verbatim (so existing JSON fields stay) and adds the optional enrichment block. Consumers that don't care about the enrichment (CLI, dashboards) ignore the extra field; the SPA's Node Detail page reads from it directly.

func ProjectNode added in v0.5.2 

func ProjectNode(n nodes.OsqueryNode) NodeView

ProjectNode wraps a single OsqueryNode into the SPA-facing NodeView, parsing RawEnrollment best-effort. A parse failure or an absent payload simply leaves Enrichment nil — the JSON `omitempty` then drops the key entirely so the SPA sees the same `OsqueryNode` shape it always saw, plus optional detail when available.

func ProjectNodeWithCountry added in v0.5.5 

func ProjectNodeWithCountry(n nodes.OsqueryNode, countryCode string) NodeView

func ProjectNodeWithCountryAndUptime added in v0.5.5 

func ProjectNodeWithCountryAndUptime(n nodes.OsqueryNode, countryCode string, uptime *NodeUptime) NodeView

func ProjectNodeWithCountryUptimeAndPosture added in v0.5.5 

func ProjectNodeWithCountryUptimeAndPosture(n nodes.OsqueryNode, countryCode string, uptime *NodeUptime, posture *NodePostureSummary) NodeView

func ProjectNodeWithCountryUptimePostureTagsAndHealth added in v0.5.5 

func ProjectNodeWithCountryUptimePostureTagsAndHealth(n nodes.OsqueryNode, countryCode string, uptime *NodeUptime, posture *NodePostureSummary, nodeTags []tags.AdminTag, health NodeHealth) NodeView

func ProjectNodeWithUptime added in v0.5.5 

func ProjectNodeWithUptime(n nodes.OsqueryNode, uptime *NodeUptime) NodeView

func ProjectNodes added in v0.5.2 

func ProjectNodes(in []nodes.OsqueryNode) []NodeView

ProjectNodes wraps a slice with ProjectNode — used by the list endpoint to keep the table-row payload consistent with the show endpoint.

func ProjectNodesWithCountry added in v0.5.5 

func ProjectNodesWithCountry(in []nodes.OsqueryNode, lookup func(ip string) string) []NodeView

func ProjectNodesWithCountryAndUptime added in v0.5.5 

func ProjectNodesWithCountryAndUptime(in []nodes.OsqueryNode, lookup func(ip string) string, uptimes map[string]*NodeUptime) []NodeView

func ProjectNodesWithCountryUptimeAndPosture added in v0.5.5 

func ProjectNodesWithCountryUptimeAndPosture(in []nodes.OsqueryNode, lookup func(ip string) string, uptimes map[string]*NodeUptime, postures map[string]*NodePostureSummary) []NodeView

func ProjectNodesWithCountryUptimePostureTagsAndHealth added in v0.5.5 

func ProjectNodesWithCountryUptimePostureTagsAndHealth(in []nodes.OsqueryNode, lookup func(ip string) string, uptimes map[string]*NodeUptime, postures map[string]*NodePostureSummary, tagsByNodeID map[uint][]tags.AdminTag, healthByNodeID map[uint]NodeHealth) []NodeView

type NodesPagedResponse added in v0.5.2 

type NodesPagedResponse struct {
	Items      []NodeView `json:"items"`
	Page       int        `json:"page"`
	PageSize   int        `json:"page_size"`
	TotalItems int64      `json:"total_items"`
	TotalPages int        `json:"total_pages"`
}

NodesPagedResponse is the SPA-canonical paginated response for GET /api/v1/nodes/{env}. Items are NodeView — OsqueryNode plus the optional `system_info` enrichment block (CPU cores, BIOS, hardware vendor/model) parsed from RawEnrollment. The embed keeps every previous OsqueryNode JSON field at the same key, so existing consumers (CLI, dashboards) are unaffected.

type OSInfo added in v0.5.2 

type OSInfo struct {
	Name         string `json:"name,omitempty"`
	Version      string `json:"version,omitempty"`
	Codename     string `json:"codename,omitempty"`
	Major        string `json:"major,omitempty"`
	Minor        string `json:"minor,omitempty"`
	Patch        string `json:"patch,omitempty"`
	Platform     string `json:"platform,omitempty"`
	PlatformLike string `json:"platform_like,omitempty"`
}

OSInfo mirrors host_details.os_version. Adds the few fields beyond what OsqueryNode.Platform / PlatformVersion already expose (codename, family).

type OSVersionTable 

type OSVersionTable struct {
	ID           string `json:"_id"`
	Codename     string `json:"codename"`
	Major        string `json:"major"`
	Minor        string `json:"minor"`
	Name         string `json:"name"`
	Patch        string `json:"patch"`
	Platform     string `json:"platform"`
	PlatformLike string `json:"platform_like"`
	Version      string `json:"version"`
}

OSVersionTable provided on enrollment, table os_version

type OsctrldApplyStatus added in v0.6.1 

type OsctrldApplyStatus struct {
	Result string    `json:"result"`
	SHA256 string    `json:"sha256"`
	Error  string    `json:"error,omitempty"`
	At     time.Time `json:"at"`
}

OsctrldApplyStatus is what osctrld reports about its last flags apply.

type OsctrldDownloadRequest added in v0.6.1 

type OsctrldDownloadRequest struct {
	Secret string `json:"secret"`
	SHA256 string `json:"sha256"`
}

OsctrldDownloadRequest is the body osctrld posts to download an extension. SHA256 is untrusted node input.

type OsctrldExtensionEntry added in v0.6.1 

type OsctrldExtensionEntry struct {
	Name   string `json:"name"`
	SHA256 string `json:"sha256"`
	Size   int64  `json:"size"`
	URL    string `json:"url"`
}

OsctrldExtensionEntry is one extension osctrld should run.

type OsctrldExtensionStatus added in v0.6.1 

type OsctrldExtensionStatus struct {
	Name   string    `json:"name"`
	SHA256 string    `json:"sha256"`
	Result string    `json:"result"`
	Error  string    `json:"error,omitempty"`
	At     time.Time `json:"at"`
}

OsctrldExtensionStatus is what osctrld reports about one extension.

type OsctrldExtensionsRequest added in v0.6.1 

type OsctrldExtensionsRequest struct {
	Secret   string                   `json:"secret"`
	UUID     string                   `json:"uuid,omitempty"`
	Platform string                   `json:"platform"`
	Arch     string                   `json:"arch"`
	Status   []OsctrldExtensionStatus `json:"status,omitempty"`
}

OsctrldExtensionsRequest is what osctrld posts to list its osquery extensions. UUID, Platform, Arch and Status are untrusted node input.

type OsctrldOsqueryRef added in v0.6.1 

type OsctrldOsqueryRef struct {
	Version string `json:"version"`
	SHA256  string `json:"sha256"`
}

OsctrldOsqueryRef is a version with the SHA-256 of its package.

type OsctrldOsqueryRequest added in v0.6.1 

type OsctrldOsqueryRequest struct {
	Secret           string `json:"secret"`
	UUID             string `json:"uuid"`
	Platform         string `json:"platform"`
	Arch             string `json:"arch"`
	Format           string `json:"format"`
	InstalledVersion string `json:"installed_version"`
}

OsctrldOsqueryRequest is what osctrld posts to ask for the osquery version to run. Every field is untrusted node input.

type OsctrldOsqueryResponse added in v0.6.1 

type OsctrldOsqueryResponse struct {
	Reason          string             `json:"reason"`
	Source          string             `json:"source,omitempty"`
	RequestID       string             `json:"request_id,omitempty"`
	Target          *OsctrldOsqueryRef `json:"target,omitempty"`
	Previous        *OsctrldOsqueryRef `json:"previous,omitempty"`
	ReportedVersion string             `json:"reported_version"`
}

OsctrldOsqueryResponse is the osquery version osctrld should run. An empty Reason means upgrade; Target is set only then; Previous too, except for Windows.

type OsctrldRollback added in v0.6.1 

type OsctrldRollback struct {
	Stage   string `json:"stage"`
	EventID string `json:"event_id"`
}

OsctrldRollback is one rollback outcome reported by osctrld: the stage it reached and the id of the rollback event (unix nanos:SHA-256 of failed content).

type OsctrldStatusRequest added in v0.6.1 

type OsctrldStatusRequest struct {
	Secret         string          `json:"secret"`
	UUID           string          `json:"uuid"`
	OsqueryRunning bool            `json:"osquery_running"`
	DownSince      *time.Time      `json:"down_since,omitempty"`
	Flags          OsctrldRollback `json:"flags"`
	Extensions     OsctrldRollback `json:"extensions"`
	Upgrade        *OsctrldUpgrade `json:"upgrade,omitempty"`
}

OsctrldStatusRequest is what osctrld posts to report osqueryd health and rollback events. All fields are untrusted node input.

type OsctrldStatusView added in v0.6.1 

type OsctrldStatusView struct {
	LastFetchedAt   *time.Time `json:"last_fetched_at,omitempty"`
	ApplyResult     string     `json:"apply_result"`
	ApplyError      string     `json:"apply_error"`
	ApplyAt         *time.Time `json:"apply_at"`
	RejectedCurrent bool       `json:"rejected_current"`
	// Health report: osquery_running, down_since and the stages come from the
	// host; reported_at is the server's receive time.
	OsqueryRunning  *bool      `json:"osquery_running,omitempty"`
	DownSince       *time.Time `json:"down_since,omitempty"`
	ReportedAt      *time.Time `json:"reported_at,omitempty"`
	ReportStale     bool       `json:"report_stale,omitempty"`
	FlagsStage      string     `json:"flags_stage,omitempty"`
	ExtensionsStage string     `json:"extensions_stage,omitempty"`
}

OsctrldStatusView is the node's last osctrld flags fetch and apply result. The apply and report fields are reported by the host and are untrusted. LastFetchedAt is omitted when the row exists only because of a health report.

type OsctrldUpgrade added in v0.6.1 

type OsctrldUpgrade struct {
	Result    string `json:"result"`
	Version   string `json:"version,omitempty"`
	Reason    string `json:"reason,omitempty"`
	RequestID string `json:"request_id,omitempty"`
	EventID   string `json:"event_id,omitempty"`
}

OsctrldUpgrade is the result of osctrld's last osquery upgrade attempt. All fields are untrusted node input.

type OsqueryConfigRequest added in v0.5.2 

type OsqueryConfigRequest struct {
	Configuration string `json:"configuration"`
	Integrity     string `json:"integrity"`
}

OsqueryConfigRequest to receive osquery configuration requests

type OsqueryEffectiveTarget added in v0.6.1 

type OsqueryEffectiveTarget struct {
	Version string `json:"version"`
	Source  string `json:"source"` // pin or environment
}

OsqueryEffectiveTarget is the version a node is rolled out to and where it comes from.

type OsqueryEntryRequest added in v0.6.1 

type OsqueryEntryRequest struct {
	Platform string `json:"platform"`
	Arch     string `json:"arch"`
	Format   string `json:"format"`
	SHA256   string `json:"sha256"`
}

OsqueryEntryRequest is one digest in a library PUT.

type OsqueryInfoTable 

type OsqueryInfoTable struct {
	BuildDistro   string `json:"build_distro"`
	BuildPlatform string `json:"build_platform"`
	ConfigHash    string `json:"config_hash"`
	ConfigValid   string `json:"config_valid"`
	Extension     string `json:"extensions"`
	InstanceID    string `json:"instance_id"`
	PID           string `json:"pid"`
	StartTime     string `json:"start_time"`
	UUID          string `json:"uuid"`
	Version       string `json:"version"`
	Watcher       string `json:"watcher"`
}

OsqueryInfoTable provided on enrollment, table osquery_info

type OsqueryPinView added in v0.6.1 

type OsqueryPinView struct {
	Version   string     `json:"version"`
	RequestID string     `json:"request_id"`
	ExpiresAt *time.Time `json:"expires_at"`
	UpdatedBy string     `json:"updated_by"`
	UpdatedAt time.Time  `json:"updated_at"`
}

OsqueryPinView is a node's pin.

type OsqueryRuntime added in v0.5.2 

type OsqueryRuntime struct {
	Version       string `json:"version,omitempty"`
	BuildPlatform string `json:"build_platform,omitempty"`
	BuildDistro   string `json:"build_distro,omitempty"`
	Extensions    string `json:"extensions,omitempty"`
	StartTime     string `json:"start_time,omitempty"`
	ConfigValid   string `json:"config_valid,omitempty"`
}

OsqueryRuntime mirrors host_details.osquery_info — the runtime / build metadata of the agent that enrolled. Useful for "this node is running an extensions-disabled build" diagnostics. Drops `instance_id`, `pid`, and `watcher` (PIDs) since they leak less-useful runtime detail; keep `start_time` so operators can see when the daemon last restarted.

type OsqueryTable 

type OsqueryTable struct {
	Name        string               `json:"name"`
	Description string               `json:"description"`
	URL         string               `json:"url"`
	Platforms   []string             `json:"platforms"`
	Filter      string               `json:"filter"`
	Evented     bool                 `json:"evented"`
	Cacheable   bool                 `json:"cacheable"`
	Notes       string               `json:"notes"`
	Examples    []string             `json:"examples"`
	Columns     []OsqueryTableColumn `json:"columns"`
}

OsqueryTable describes a table exposed by the configured osquery schema.

type OsqueryTableColumn added in v0.5.8 

type OsqueryTableColumn struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Type        string `json:"type"`
	Notes       string `json:"notes"`
	Hidden      bool   `json:"hidden"`
	Required    bool   `json:"required"`
	Index       bool   `json:"index"`
}

OsqueryTableColumn describes a selectable field in an osquery table.

type OsqueryTargetRequest added in v0.6.1 

type OsqueryTargetRequest struct {
	Version   string     `json:"version"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

OsqueryTargetRequest sets an environment target or a node pin.

type OsqueryTargetView added in v0.6.1 

type OsqueryTargetView struct {
	Version   string    `json:"version"`
	RequestID string    `json:"request_id"`
	UpdatedBy string    `json:"updated_by"`
	UpdatedAt time.Time `json:"updated_at"`
}

OsqueryTargetView is the osquery version an environment is rolled out to.

type OsqueryUpgradeView added in v0.6.1 

type OsqueryUpgradeView struct {
	Result     string    `json:"result"`
	Version    string    `json:"version"`
	Reason     string    `json:"reason"`
	RequestID  string    `json:"request_id"`
	ReportedAt time.Time `json:"reported_at"`
}

OsqueryUpgradeView is the last upgrade report of a node's osctrld. The strings are reported by the host and are untrusted; only validated values are stored.

type OsqueryVersionEntry added in v0.6.1 

type OsqueryVersionEntry struct {
	Platform  string    `json:"platform"`
	Arch      string    `json:"arch"`
	Format    string    `json:"format"`
	SHA256    string    `json:"sha256"`
	CreatedBy string    `json:"created_by"`
	CreatedAt time.Time `json:"created_at"`
}

OsqueryVersionEntry is the SHA-256 of one official osquery package.

type OsqueryVersionHostCount added in v0.6.1 

type OsqueryVersionHostCount struct {
	Version string `json:"version"`
	Count   int64  `json:"count"`
}

OsqueryVersionHostCount is the number of hosts of an environment on a version.

type OsqueryVersionPutRequest added in v0.6.1 

type OsqueryVersionPutRequest struct {
	Entries []OsqueryEntryRequest `json:"entries"`
}

OsqueryVersionPutRequest adds or replaces the digests of a library version.

type OsqueryVersionView added in v0.6.1 

type OsqueryVersionView struct {
	Version string                `json:"version"`
	Entries []OsqueryVersionEntry `json:"entries"`
	InUse   bool                  `json:"in_use"`
}

OsqueryVersionView is a library version with its digests.

type PasswordChangeRequest added in v0.5.2 

type PasswordChangeRequest struct {
	CurrentPassword string `json:"current_password"`
	NewPassword     string `json:"new_password"`
}

PasswordChangeRequest is the body for POST /api/v1/users/me/password.

type PlatformInfoTable 

type PlatformInfoTable struct {
	Address    string `json:"address"`
	Date       string `json:"date"`
	Extra      string `json:"extra"`
	Revision   string `json:"revision"`
	Size       string `json:"size"`
	Vendor     string `json:"vendor"`
	Version    string `json:"version"`
	VolumeSize string `json:"volume_size"`
}

PlatformInfoTable provided on enrollment, table platform_info

type QueriesPagedResponse added in v0.5.2 

type QueriesPagedResponse struct {
	Items      []queries.DistributedQuery `json:"items"`
	Page       int                        `json:"page"`
	PageSize   int                        `json:"page_size"`
	TotalItems int64                      `json:"total_items"`
	TotalPages int                        `json:"total_pages"`
}

QueriesPagedResponse is the SPA-canonical paginated response for GET /api/v1/queries/{env}/list/{target}.

type QueryCarveScheduled 

type QueryCarveScheduled struct {
	Time      string `json:"time"`
	SHA256    string `json:"sha256"`
	Size      string `json:"size"`
	Path      string `json:"path"`
	Status    string `json:"status"`
	CarveGUID string `json:"carve_guid"`
	RequestID string `json:"request_id"`
	Carve     string `json:"carve"`
}

QueryCarveScheduled to receive confirmation for scheduled carved file

type QueryReadRequest 

type QueryReadRequest GenericRequest

QueryReadRequest received to get on-demand queries

type QueryReadResponse 

type QueryReadResponse struct {
	Queries     map[string]string `json:"queries"`
	NodeInvalid bool              `json:"node_invalid"`
}

QueryReadResponse for on-demand queries from nodes

type QueryResultsResponse added in v0.5.2 

type QueryResultsResponse struct {
	Items      []map[string]any `json:"items"`
	Page       int              `json:"page"`
	PageSize   int              `json:"page_size"`
	TotalItems int64            `json:"total_items"`
	TotalPages int              `json:"total_pages"`
	Since      string           `json:"since,omitempty"`
}

QueryResultsResponse is the SPA-canonical paginated response for GET /api/v1/queries/{env}/results/{name}.

type QueryTargetView added in v0.5.4 

type QueryTargetView struct {
	Type  string `json:"type"`
	Value string `json:"value"`
}

QueryTargetView is the SPA-facing shape for stored distributed-query targets.

type QueryWriteData 

type QueryWriteData struct {
	Name    string          `json:"name"`
	Result  json.RawMessage `json:"result"`
	Status  int             `json:"status"`
	Message string          `json:"message"`
}

QueryWriteData to store result of on-demand queries

type QueryWriteMessages 

type QueryWriteMessages map[string]string

QueryWriteMessages to hold the on-demand queries messages

type QueryWriteQueries 

type QueryWriteQueries map[string]json.RawMessage

QueryWriteQueries to hold the on-demand queries results

type QueryWriteRequest 

type QueryWriteRequest struct {
	Queries  QueryWriteQueries  `json:"queries"`
	Statuses QueryWriteStatuses `json:"statuses"`
	Messages QueryWriteMessages `json:"messages"`
	NodeKey  string             `json:"node_key"`
}

QueryWriteRequest to receive on-demand queries results

type QueryWriteResponse 

type QueryWriteResponse GenericResponse

QueryWriteResponse for on-demand queries results from nodes

type QueryWriteStatuses 

type QueryWriteStatuses map[string]int

QueryWriteStatuses to hold the on-demand queries statuses

type SavedQueriesPagedResponse added in v0.5.2 

type SavedQueriesPagedResponse struct {
	Items      []SavedQueryView `json:"items"`
	Page       int              `json:"page"`
	PageSize   int              `json:"page_size"`
	TotalItems int64            `json:"total_items"`
	TotalPages int              `json:"total_pages"`
}

SavedQueriesPagedResponse is the SPA-canonical paginated response for GET /api/v1/saved-queries/{env}.

type SavedQueryCreateRequest added in v0.5.2 

type SavedQueryCreateRequest struct {
	Name  string `json:"name"`
	Query string `json:"query"`
}

SavedQueryCreateRequest is the body shape for POST /api/v1/saved-queries/{env}.

type SavedQueryUpdateRequest added in v0.5.2 

type SavedQueryUpdateRequest struct {
	Query string `json:"query"`
}

SavedQueryUpdateRequest is the body shape for PATCH /api/v1/saved-queries/{env}/{name}.

type SavedQueryView added in v0.5.2 

type SavedQueryView struct {
	ID            uint      `json:"id"`
	CreatedAt     time.Time `json:"created_at"`
	UpdatedAt     time.Time `json:"updated_at"`
	Name          string    `json:"name"`
	Creator       string    `json:"creator"`
	Query         string    `json:"query"`
	EnvironmentID uint      `json:"environment_id"`
	ExtraData     string    `json:"extra_data,omitempty"`
}

SavedQueryView is the SPA-canonical projection of a saved query. We use a hand-typed struct (rather than queries.SavedQuery directly) so the JSON envelope stays stable even if the storage struct gains fields. Timestamps are emitted as RFC3339 (Go time.Time default JSON encoding), to match the OpenAPI schema (date-time) and the SPA's formatRelative parser.

type ScriptRequest 

type ScriptRequest struct {
	Secret      string `json:"secret"`
	SecrefFile  string `json:"secretFile"`
	FlagsFile   string `json:"flagsFile"`
	Certificate string `json:"certificate"`
}

ScriptRequest to retrieve script

type ServiceCommandResponse added in v0.5.6 

type ServiceCommandResponse struct {
	CommandID     string     `json:"command_id"`
	TargetService string     `json:"target_service"`
	Action        string     `json:"action"`
	Status        string     `json:"status"`
	RequestedBy   string     `json:"requested_by"`
	RequestedFrom string     `json:"requested_from"`
	CreatedAt     time.Time  `json:"created_at"`
	ExpiresAt     time.Time  `json:"expires_at"`
	ConsumedAt    *time.Time `json:"consumed_at,omitempty"`
	ConsumedBy    string     `json:"consumed_by,omitempty"`
	RecoveredAt   *time.Time `json:"recovered_at,omitempty"`
	RecoveredBy   string     `json:"recovered_by,omitempty"`
}

type ServiceConfigApplyRequest added in v0.5.6 

type ServiceConfigApplyRequest struct {
	Service string `json:"service,omitempty"`
}

ServiceConfigApplyRequest is the optional body for POST /api/v1/service-config/apply. Empty service defaults to osctrl-api.

type ServiceConfigApplyResponse added in v0.5.6 

type ServiceConfigApplyResponse struct {
	Message string                  `json:"message"`
	Service string                  `json:"service"`
	Command *ServiceCommandResponse `json:"command,omitempty"`
}

type ServiceConfigPersistRequest added in v0.5.6 

type ServiceConfigPersistRequest struct {
	Service string `json:"service,omitempty"`
}

ServiceConfigPersistRequest is the optional body for POST /api/v1/service-config/persist. Empty service defaults to osctrl-api.

type ServiceConfigPersistResponse added in v0.5.6 

type ServiceConfigPersistResponse struct {
	Message string                  `json:"message"`
	Service string                  `json:"service"`
	Command *ServiceCommandResponse `json:"command,omitempty"`
}

ServiceConfigPersistResponse is returned by the persist endpoint. For osctrl-tls the write is performed asynchronously by the TLS process, so Command carries the queued command to poll.

type ServiceConfigStatusResponse added in v0.5.6 

type ServiceConfigStatusResponse struct {
	Service        string    `json:"service"`
	PendingChanges bool      `json:"pending_changes"`
	FilePath       string    `json:"file_path"`
	FileWritable   bool      `json:"file_writable"`
	FileReason     string    `json:"file_reason,omitempty"`
	CheckedAt      time.Time `json:"checked_at"`
}

ServiceConfigStatusResponse is the body of GET /api/v1/service-config/{service}/status. It tells the SPA whether the service has DB edits that the YAML file on disk does not have (PendingChanges), and whether that service's process could write them out if asked (FileWritable, with FileReason explaining a refusal).

type ServiceConfigUpdateRequest added in v0.5.6 

type ServiceConfigUpdateRequest struct {
	Value json.RawMessage            `json:"value,omitempty" swaggertype:"object"`
	Patch map[string]json.RawMessage `json:"patch,omitempty" swaggertype:"object"`
	Reset []string                   `json:"reset,omitempty"`
}

ServiceConfigUpdateRequest is the body for PUT /api/v1/service-config/{service}/{section}. It takes exactly one of two forms.

Value replaces the whole section, which pins EVERY field in it: stored values then beat flags, environment variables and YAML at startup. Use it to set a section from scratch.

Patch and Reset change individual top-level fields. Patch pins each named field to the given value; Reset releases a field so it follows the process again from the next restart. Only pinned fields override anything, so a field you never touched keeps following its flag. Field names match case-insensitively; an unknown name is rejected.

type SetPermissionsAllRequest added in v0.5.3 

type SetPermissionsAllRequest struct {
	Access EnvAccessView `json:"access"`
}

SetPermissionsAllRequest is the body for POST /api/v1/users/{username}/permissions/all — sets the same access shape across every environment currently in the system. No env_uuid; the server enumerates envs server-side.

"All current envs" semantics: this applies to the env list at the time the request is handled. Envs created LATER do not inherit; the operator re-applies as needed.

type SetPermissionsAllResponse added in v0.5.3 

type SetPermissionsAllResponse struct {
	Updated int           `json:"updated"`
	Total   int           `json:"total"`
	Access  EnvAccessView `json:"access"`
}

SetPermissionsAllResponse is what POST /api/v1/users/{username}/permissions/all returns.

Updated is the count of environments where the user's permissions were successfully (re-)written. Total is the count of envs the server iterated. On the happy path Updated == Total; if any single env's write failed mid-iteration the handler aborts the transaction and returns 5xx — partial-success is not exposed.

type SetPermissionsRequest added in v0.5.2 

type SetPermissionsRequest struct {
	EnvUUID string        `json:"env_uuid"`
	Access  EnvAccessView `json:"access"`
}

SetPermissionsRequest is the body for POST /api/v1/users/{username}/permissions.

type SettingPatchRequest added in v0.5.2 

type SettingPatchRequest struct {
	Type    string  `json:"type,omitempty"`
	String  *string `json:"string,omitempty"`
	Boolean *bool   `json:"boolean,omitempty"`
	Integer *int64  `json:"integer,omitempty"`
}

SettingPatchRequest is the body for PATCH /api/v1/settings/{service}/{name}. Exactly one of String / Boolean / Integer must be supplied; the handler validates the type matches what's stored. Type is informational and optional — when omitted the handler infers from the supplied field.

type StringInt 

type StringInt int

StringInt to parse numbers that could be strings

func (*StringInt) UnmarshalJSON 

func (si *StringInt) UnmarshalJSON(b []byte) error

UnmarshalJSON implements the json.Unmarshaler interface, which allows us to ingest values of any json type as an int and run our custom conversion

type SystemInfo added in v0.5.2 

type SystemInfo struct {
	HardwareVendor   string `json:"hardware_vendor,omitempty"`
	HardwareModel    string `json:"hardware_model,omitempty"`
	HardwareVersion  string `json:"hardware_version,omitempty"`
	HardwareSerial   string `json:"hardware_serial,omitempty"`
	CPUBrand         string `json:"cpu_brand,omitempty"`
	CPUType          string `json:"cpu_type,omitempty"`
	CPUSubtype       string `json:"cpu_subtype,omitempty"`
	CPUPhysicalCores string `json:"cpu_physical_cores,omitempty"`
	CPULogicalCores  string `json:"cpu_logical_cores,omitempty"`
	PhysicalMemory   string `json:"physical_memory,omitempty"`
	ComputerName     string `json:"computer_name,omitempty"`
	LocalHostname    string `json:"local_hostname,omitempty"`
}

SystemInfo mirrors host_details.system_info from the osquery enroll payload, minus the host_identifier / instance_id fields which are duplicates of data we already expose via OsqueryNode.UUID.

type SystemInfoTable 

type SystemInfoTable struct {
	ComputerName     string `json:"computer_name"`
	CPUBrand         string `json:"cpu_brand"`
	CPULogicalCores  string `json:"cpu_logical_cores"`
	CPUPhysicalCores string `json:"cpu_physical_cores"`
	CPUSubtype       string `json:"cpu_subtype"`
	CPUType          string `json:"cpu_type"`
	HardwareModel    string `json:"hardware_model"`
	HardwareSerial   string `json:"hardware_serial"`
	HardwareVendor   string `json:"hardware_vendor"`
	HardwareVersion  string `json:"hardware_version"`
	Hostname         string `json:"hostname"`
	LocalHostname    string `json:"local_hostname"`
	PhysicalMemory   string `json:"physical_memory"`
	UUID             string `json:"uuid"`
}

SystemInfoTable provided on enrollment, table system_info

type TLSEnvironmentView added in v0.5.2 

type TLSEnvironmentView struct {
	ID             uint      `json:"id"`
	CreatedAt      time.Time `json:"created_at"`
	UpdatedAt      time.Time `json:"updated_at"`
	UUID           string    `json:"uuid"`
	Name           string    `json:"name"`
	Hostname       string    `json:"hostname"`
	Type           string    `json:"type"`
	Icon           string    `json:"icon"`
	DebugHTTP      bool      `json:"debug_http"`
	ConfigTLS      bool      `json:"config_tls"`
	ConfigInterval int       `json:"config_interval"`
	LoggingTLS     bool      `json:"logging_tls"`
	LogInterval    int       `json:"log_interval"`
	QueryTLS       bool      `json:"query_tls"`
	QueryInterval  int       `json:"query_interval"`
	CarvesTLS      bool      `json:"carves_tls"`
	AcceptEnrolls  bool      `json:"accept_enrolls"`
	EnrollExpire   time.Time `json:"enroll_expire"`
	RemoveExpire   time.Time `json:"remove_expire"`
}

TLSEnvironmentView is the low-privilege projection of an environment. UserLevel operators (env scope) need basic env metadata so the SPA can render its env switcher / dashboard / table chrome — but they MUST NOT receive the enroll secret, the certificate, or one-liner URLs that embed the secret. The full storage struct is admin-only via EnvironmentAdminHandler.

type TokenResponse added in v0.5.2 

type TokenResponse struct {
	Token   string    `json:"token"`
	Expires time.Time `json:"expires"`
}

TokenResponse is returned by POST /api/v1/users/{username}/token/refresh and by login. The Token is shown ONCE to the operator (so they can copy it for CLI use); it isn't returned by any GET endpoint after refresh.

type UserMePatchRequest added in v0.5.2 

type UserMePatchRequest struct {
	Email    string `json:"email"`
	Fullname string `json:"fullname"`
	// PreferredLanguage is the UI language tag the operator picked.
	// Validated against the supported-language list; an empty value
	// leaves the stored preference unchanged (same semantics as the
	// other patch fields).
	PreferredLanguage string `json:"preferred_language"`
}

UserMePatchRequest is the body for PATCH /api/v1/users/me — operators can update their own profile (email and fullname only).

type UserMeResponse added in v0.5.2 

type UserMeResponse struct {
	Username    string    `json:"username"`
	Email       string    `json:"email"`
	Fullname    string    `json:"fullname"`
	Admin       bool      `json:"admin"`
	Service     bool      `json:"service"`
	UUID        string    `json:"uuid"`
	TokenExpire time.Time `json:"token_expire"`
	LastAccess  time.Time `json:"last_access"`
	// PreferredLanguage mirrors AdminUser.PreferredLanguage — the
	// UI language the operator picked. Empty means "no server-side
	// preference"; the SPA falls back to its own detection.
	PreferredLanguage string                   `json:"preferred_language"`
	Permissions       map[string]EnvAccessView `json:"permissions"`
}

UserMeResponse is the GET/PATCH /api/v1/users/me payload.

type VerifyRequest 

type VerifyRequest FlagsRequest

VerifyRequest to verify nodes

type VerifyResponse 

type VerifyResponse struct {
	Flags          string `json:"flags"`
	Certificate    string `json:"certificate"`
	OsqueryVersion string `json:"osquery_version"`
	// OsquerySHA256 is the expected SHA-256 of the osquery package osctrld
	// should install. osctrld refuses to install an unverified package
	// unless it is given a digest another way, so an empty value here is a
	// safe default rather than a silent downgrade in security: the node
	// falls back to its own --osquery-sha256, or refuses.
	//
	// One digest covers one artifact, and osquery ships a different package
	// per format and architecture (deb amd64/arm64, rpm x86_64/aarch64, the
	// macOS pkg, the Windows msi). osctrld picks its URL from its own
	// runtime.GOOS/GOARCH and does not tell the server which one it will
	// fetch, so osctrl can only answer this correctly for a deployment that
	// installs a single package. Mixed fleets leave it unset and configure
	// the digest on the node until the verify request carries the node's
	// package format.
	OsquerySHA256 string `json:"osquery_sha256"`
}

VerifyResponse for verify requests from osctrld

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.