---
title: Bloodhound
slug: connectors/bloodhound
docTags: 
createdAt: 2026-06-09T16:29:34.672Z
---

The Bloodhound connector enables automated interactions with Bloodhound's security analysis capabilities, facilitating the identification and management of AD attack paths.

Bloodhound is a powerful security analysis tool that maps out Active Directory and Azure AD environments to uncover complex attack paths and potential security vulnerabilities. The Bloodhound Turbine Connector allows Swimlane Turbine users to integrate Bloodhound's advanced attack path analytics and risk assessment capabilities directly into their security workflows. By leveraging this connector, security teams can automate the extraction of attack path findings, domain risk analysis, and threat identification, enhancing their ability to proactively defend against sophisticated cyber threats.

### Limitations

None to date.

### Supported Versions

This BloodHound connector uses the Version 2 API.

### Additional Docs

- [BloodHound Authentication Link](https://bloodhound.specterops.io/reference/overview)
- [BloodHound API Documentation Link](https://support.bloodhoundenterprise.io/hc/en-us/articles/11311053342619-Working-with-the-BloodHound-API)

## Configuration

### Prerequisites

To effectively utilize the Bloodhound connector for Turbine, ensure you have the following prerequisites:

- HTTP Bearer Authentication with these parameters:
  - URL: Endpoint for the Bloodhound API.
  - Token: Bearer token such as JWT to authenticate API requests.
- Custom Authentication with these parameters:
  - URL: Endpoint for the Bloodhound API.
  - ID: Unique identifier for custom authentication.
  - Key: Secret key associated with the custom ID for authentication.

## Authentication Methods

### HTTP Basic Authentication:

- URL: The endpoint URL for the BloodHound API.
- Username: Your BloodHound username with sufficient permissions.
- Password: The password associated with your BloodHound account.

### Custom Authentication with the following parameters:

- URL: The endpoint URL for the BloodHound API.
- token\_id: The ID of the asset.
- token\_key: The key of the asset.

## Capabilities

This BloodHound connector provides the following capabilities:

- Export Attack Path Findings
- Get Available Domains
- List Attack Path Sparkline Values
- List Available Attack Paths
- List Domain Attack Paths Details
- List Saved Queries
- List all Attack Path Types
- Run a Cypher Query
- Search for Objects
- Start Analysis
- Update Attack Path Risk

### Export Attack Path Findings

Export the finding table for a given attack path.

BloodHound's documentation for this action can be found \[here][https://bloodhound.specterops.io/reference/attack-paths/export-attack-path-findings](https://bloodhound.specterops.io/reference/attack-paths/export-attack-path-findings)).

### Get Available Domains

Gets available domains along with their collection status.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/search/get-available-domains).

### List Attack Path Sparkline Values

List the values that represent the sparklines for individual attack paths.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/list-attack-path-sparkline-values).

### List Available Attack Paths

Lists all possible attack path types.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/list-available-attack-paths).

### List Domain Attack Paths Details

Lists detailed data about attack paths for a domain.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/list-domain-attack-paths-details).

### List Saved Queries

Get all saved queries for the current user.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/cypher/list-saved-queries).

### List all Attack Path Types

Lists all possible attack path types.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/list-all-attack-path-types).

### Run a Cypher Query

Runs a manual cypher query directly against the database.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/cypher/run-a-cypher-query).

### Search for Objects

Search for graph objects by name or object ID, filtered by type.

BloodHound's documentation for this action can be found \[here][https://bloodhound.specterops.io/reference/search/search-for-objects](https://bloodhound.specterops.io/reference/search/search-for-objects)).

### Start Analysis

Starts generating attack paths.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/start-analysis).

### Update Attack Path Risk

Updates an attack path as an accepted or unaccepted risk until a given time.

BloodHound's documentation for this action can be found [here](https://bloodhound.specterops.io/reference/attack-paths/update-attack-path-risk).

# Configurations

## BloodHound Asset

Authenticates using bearer token\_id and token\_key.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| token\_id     | The ID of the asset.               | string   | Required     |
| token\_key    | The key of the asset.              | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

## BloodHound HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| token         | The JWT Token.                     | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Export Attack Path Findings

Exports a findings table for an attack path in Bloodhound using the specified domain ID and finding parameters.

### Endpoint

- **URL:** `/api/v2/domains/{{domain_id}}/attack-path-findings`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                      |
| --------------------------- | -------- | ------------ | ---------------------------------------------------- |
| `path_parameters.domain_id` | string   | Required     | The ID of the domain to export findings for.         |
| `headers`                   | object   | Optional     | HTTP headers for the request                         |
| `headers.Prefer`            | number   | Optional     | HTTP headers for the request                         |
| `parameters.sort_by`        | string   | Optional     | Sort by column. The only sortable column is finding. |
| `parameters.finding`        | string   | Required     | Finding Type.                                        |
| `parameters.filterAccepted` | string   | Optional     | Risk acceptance filter.                              |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk","filterAccepted":"accepted"},"path_parameters":{"domain_id":"123"},"headers":{"Prefer":0}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK","json_body":"header1,header2,header3\ncell1,cell2,cell3\ncell4,cell5,cell6\n...\n"}`

## Get Available Domains

Retrieves a list of available domains along with their collection statuses from Bloodhound.

### Endpoint

- **URL:** `/api/v2/available-domains`
- **Method:** `GET`

### Input

| **Argument Name**      | **Type** | **Required** | **Description**                                                                   |
| ---------------------- | -------- | ------------ | --------------------------------------------------------------------------------- |
| `headers`              | object   | Optional     | HTTP headers for the request                                                      |
| `headers.Prefer`       | number   | Optional     | HTTP headers for the request                                                      |
| `parameters.sort_by`   | string   | Optional     | Sortable columns are objectid, name.                                              |
| `parameters.objectId`  | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq. |
| `parameters.name`      | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq. |
| `parameters.collected` | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq. |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","objectId":"34234","name":"Composite","collected":"Composite"},"headers":{"Prefer":0}}`

### Output

| **Parameter**    | **Type** | **Description**                  |
| ---------------- | -------- | -------------------------------- |
| `status_code`    | number   | HTTP status code of the response |
| `reason`         | string   | Response reason phrase           |
| `data`           | array    | Response data                    |
| `data.type`      | string   | Response data                    |
| `data.name`      | string   | Response data                    |
| `data.id`        | string   | Response data                    |
| `data.collected` | boolean  | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":[{}]}}`

## List all Attack Path Types

Retrieve all possible attack path types from Bloodhound for comprehensive analysis and strategic planning.

### Endpoint

- **URL:** `/api/v2/attack-path-types`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                                                                            |
| -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `headers`            | object   | Optional     | HTTP headers for the request                                                                                               |
| `headers.Prefer`     | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0. |
| `parameters.sort_by` | string   | Optional     | Sort by column. The only sortable column is finding.                                                                       |
| `parameters.finding` | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                          |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk"},"headers":{"Prefer":0}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `data`        | array    | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":["<string>"]}}`

## List Attack Path Sparkline Values

Lists sparkline values for attack paths in a specified domain on Bloodhound, requiring domain ID and finding parameters.

### Endpoint

- **URL:** `/api/v2/domains/{{domain_id}}/sparkline`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                                                                                               |
| --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------- |
| `path_parameters.domain_id` | string   | Required     | The ID of the domain to list the sparkline values for.                                                                        |
| `headers`                   | object   | Optional     | HTTP headers for the request                                                                                                  |
| `headers.Prefer`            | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.    |
| `parameters.sort_by`        | string   | Optional     | Sortable columns are CompositeRisk, FindingCount, ImpactedAssetCount, domain\_sid, id, created\_at, updated\_at, deleted\_at. |
| `parameters.finding`        | string   | Required     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                             |
| `parameters.from`           | string   | Optional     | Beginning datetime of range (inclusive) in RFC-3339 format; Defaults to current datetime minus 30 days.                       |
| `parameters.to`             | string   | Optional     | Ending datetime of range (exclusive) in RFC-3339 format; Defaults to current datetime.                                        |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","finding":"eq","from":"2023-09-01T00:00:00Z","to":"2024-10-01T00:00:00Z"},"path_parameters":{"domain_id":":123"},"headers":{"Prefer":0}}`

### Output

| **Parameter**             | **Type** | **Description**                  |
| ------------------------- | -------- | -------------------------------- |
| `status_code`             | number   | HTTP status code of the response |
| `reason`                  | string   | Response reason phrase           |
| `start`                   | string   | Output field: start              |
| `end`                     | string   | Output field: end                |
| `data`                    | array    | Response data                    |
| `data.id`                 | number   | Response data                    |
| `data.created_at`         | string   | Response data                    |
| `data.updated_at`         | string   | Response data                    |
| `data.deleted_at`         | object   | Response data                    |
| `data.deleted_at.time`    | string   | Response data                    |
| `data.deleted_at.valid`   | boolean  | Response data                    |
| `data.CompositeRisk`      | number   | Response data                    |
| `data.FindingCount`       | number   | Response data                    |
| `data.ImpactedAssetCount` | number   | Response data                    |
| `data.DomainSID`          | string   | Response data                    |
| `data.Finding`            | string   | Response data                    |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"start":"2023-11-07T05:31:56Z","end":"2023-11-07T05:31:56Z","data":[{}]}}`

## List Available Attack Paths

Lists all possible attack paths for a given domain in Bloodhound, using the domain\_id as a path parameter.

### Endpoint

- **URL:** `/api/v2/domains/{{domain_id}}/available-types`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                                                                                            |
| --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `path_parameters.domain_id` | string   | Required     | Parameters for the List Available Attack Paths action                                                                      |
| `headers`                   | object   | Optional     | HTTP headers for the request                                                                                               |
| `headers.Prefer`            | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0. |
| `parameters.sort_by`        | string   | Optional     | Sort by column. The only sortable column is finding.                                                                       |
| `parameters.finding`        | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                          |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk"},"path_parameters":{"domain_id":":123"},"headers":{"Prefer":0}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `data`        | array    | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":["<string>"]}}`

## List Domain Attack Paths Details

Retrieve detailed attack path information for a specified domain in Bloodhound, utilizing the domain ID and finding parameters.

### Endpoint

- **URL:** `/api/v2/domains/{{domain_id}}/details`
- **Method:** `GET`

### Input

| **Argument Name**            | **Type** | **Required** | **Description**                                                                                                                                                                                                                                                    |
| ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `path_parameters.domain_id`  | string   | Required     | Domain ID                                                                                                                                                                                                                                                          |
| `headers`                    | object   | Optional     | HTTP headers for the request                                                                                                                                                                                                                                       |
| `headers.Prefer`             | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.                                                                                                                                         |
| `parameters.finding`         | string   | Required     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.sort_by`         | string   | Optional     | Sortable columns are domain\_sid, index, AcceptedUntil, id, created\_at, updated\_at, deleted\_at, exposure\_percentage, impact\_percentage. Relationship risks can be sorted on FromPrincipal and ToPrincipal in addition to the sortable columns for List Risks. |
| `parameters.from_principal`  | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.to_principal`    | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.principals_hash` | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.accepted_until`  | string   | Optional     | Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.                                                                                                                                   |
| `parameters.Principal`       | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.domain_sid`      | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                  |
| `parameters.id`              | integer  | Optional     | Filter results by column integer value. Valid filter predicates are eq, neq, gt, gte, lt, lte.                                                                                                                                                                     |
| `parameters.created_at`      | string   | Optional     | Filter results by created\_at value. See filter schema details for valid predicates.                                                                                                                                                                               |
| `parameters.updated_at`      | string   | Optional     | Filter results by updated\_at value. See filter schema details for valid predicates.                                                                                                                                                                               |
| `parameters.deleted_at`      | string   | Optional     | Filter results by deleted\_at value. See filter schema details for valid predicates.                                                                                                                                                                               |
| `parameters.limit`           | integer  | Optional     | This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range x >= 0                                                                                                                                          |
| `parameters.skip`            | integer  | Optional     | This query parameter is used for determining the number of objects to skip in pagination. Required range x >= 0                                                                                                                                                    |

### Input Example

`{"parameters":{"sort_by":"CompositeRisk","finding":"eq","from_principal":"eq","to_principal":"eq","principals_hash":"eq","accepted_until":"2024-10-01T00:00:00Z","Principal":"eq","id":"eq","created_at":"2024-10-01T00:00:00Z","updated_at":"2024-10-01T00:00:00Z","deleted_at":"2024-10-01T00:00:00Z","limit":100,"skip":0},"path_parameters":{"domain_id":"123"},"headers":{"Prefer":0}}`

### Output

| **Parameter**                             | **Type** | **Description**                  |
| ----------------------------------------- | -------- | -------------------------------- |
| `status_code`                             | number   | HTTP status code of the response |
| `reason`                                  | string   | Response reason phrase           |
| `count`                                   | number   | Count value                      |
| `skip`                                    | number   | Output field: skip               |
| `limit`                                   | number   | Output field: limit              |
| `data`                                    | array    | Response data                    |
| `data.id`                                 | number   | Response data                    |
| `data.created_at`                         | string   | Response data                    |
| `data.updated_at`                         | string   | Response data                    |
| `data.deleted_at`                         | object   | Response data                    |
| `data.deleted_at.time`                    | string   | Response data                    |
| `data.deleted_at.valid`                   | boolean  | Response data                    |
| `data.FromPrincipal`                      | string   | Response data                    |
| `data.ToPrincipal`                        | string   | Response data                    |
| `data.FromPrincipalProps`                 | object   | Response data                    |
| `data.FromPrincipalProps.additionalProp1` | object   | Response data                    |
| `data.FromPrincipalProps.additionalProp2` | object   | Response data                    |
| `data.FromPrincipalProps.additionalProp3` | object   | Response data                    |
| `data.FromPrincipalKind`                  | string   | Response data                    |
| `data.ToPrincipalProps`                   | object   | Response data                    |
| `data.ToPrincipalProps.additionalProp1`   | object   | Response data                    |
| `data.ToPrincipalProps.additionalProp2`   | object   | Response data                    |
| `data.ToPrincipalProps.additionalProp3`   | object   | Response data                    |
| `data.ToPrincipalKind`                    | string   | Response data                    |
| `data.RelProps`                           | object   | Response data                    |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"skip":0,"limit":0,"data":[{}]}}`

## List Saved Queries

Retrieve all saved queries associated with the current user in Bloodhound.

### Endpoint

- **URL:** `/api/v2/saved-queries`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                                                                                                                                                                                                                                                                                                                        |
| -------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `headers`            | object   | Optional     | HTTP headers for the request                                                                                                                                                                                                                                                                                                                                           |
| `headers.Prefer`     | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.                                                                                                                                                                                                                                             |
| `parameters.skip`    | number   | Optional     | This query parameter is used for determining the number of objects to skip in pagination. Required range x >= 0                                                                                                                                                                                                                                                        |
| `parameters.limit`   | number   | Optional     | This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range x >= 0                                                                                                                                                                                                                                              |
| `parameters.sort_by` | string   | Optional     | Sortable columns are user\_id, name, query, id, created\_at, updated\_at, deleted\_at.                                                                                                                                                                                                                                                                                 |
| `parameters.name`    | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                                                                                                                      |
| `parameters.query`   | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                                                                                                                      |
| `parameters.user_id` | string   | Optional     | Filter results by column string value. Valid filter predicates are eq, \~eq, neq.                                                                                                                                                                                                                                                                                      |
| `parameters.scope`   | string   | Optional     | The contains predicate checks a property against the values in a given comma-separated list. in - checks if the property matches an element in the given comma-separated list. Example: in\:Contains,GetChangesAll,MemberOf nin - checks if the property does not match an element in the given comma-separated list. Example: nin\:LocalToComputer,MemberOfLocalGroup |

### Input Example

`{"parameters":{"skip":0,"limit":10,"sort_by":"user_id","name":"eq:example_name","query":"eq:example_query","user_id":"eq:example_user_id","scope":"in:Contains,GetChangesAll,MemberOf"},"headers":{"Prefer":0}}`

### Output

| **Parameter**           | **Type** | **Description**                  |
| ----------------------- | -------- | -------------------------------- |
| `status_code`           | number   | HTTP status code of the response |
| `reason`                | string   | Response reason phrase           |
| `count`                 | number   | Count value                      |
| `skip`                  | number   | Output field: skip               |
| `limit`                 | number   | Output field: limit              |
| `data`                  | array    | Response data                    |
| `data.id`               | number   | Response data                    |
| `data.created_at`       | string   | Response data                    |
| `data.updated_at`       | string   | Response data                    |
| `data.deleted_at`       | object   | Response data                    |
| `data.deleted_at.time`  | string   | Response data                    |
| `data.deleted_at.valid` | boolean  | Response data                    |
| `data.user_id`          | string   | Response data                    |
| `data.name`             | string   | Response data                    |
| `data.query`            | string   | Response data                    |
| `data.description`      | string   | Response data                    |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":1,"skip":1,"limit":1,"data":[{}]}}`

## Run a Cypher Query

Execute a manual Cypher query against the Bloodhound database to retrieve specific graph data.

### Endpoint

- **URL:** `/api/v2/graphs/cypher`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                                                                            |
| -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `headers`            | object   | Optional     | HTTP headers for the request                                                                                               |
| `headers.Prefer`     | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0. |
| `query`              | string   | Optional     | The Cypher query to be executed. This is a string value that represents the Cypher query to be run against the database.   |
| `include_properties` | boolean  | Optional     | Include properties in the response. This is a boolean value that determines whether to include properties in the response. |

### Input Example

`{"json_body":{"query":"","include_properties":true},"headers":{"Prefer":0}}`

### Output

| **Parameter**           | **Type** | **Description**                  |
| ----------------------- | -------- | -------------------------------- |
| `status_code`           | number   | HTTP status code of the response |
| `reason`                | string   | Response reason phrase           |
| `data`                  | object   | Response data                    |
| `data.nodes`            | object   | Response data                    |
| `data.edges`            | array    | Response data                    |
| `data.edges.source`     | string   | Response data                    |
| `data.edges.target`     | string   | Response data                    |
| `data.edges.label`      | string   | Response data                    |
| `data.edges.kind`       | string   | Response data                    |
| `data.edges.lastSeen`   | string   | Response data                    |
| `data.edges.properties` | object   | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":{"nodes":{},"edges":[]}}}`

## Search for Objects

Performs a search for graph objects in Bloodhound using name or object ID, with optional type filtering and requires 'q' parameter.

### Endpoint

- **URL:** `/api/v2/search`
- **Method:** `GET`

### Input

| **Argument Name**  | **Type** | **Required** | **Description**                                                                                                             |
| ------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------- |
| `headers`          | object   | Optional     | HTTP headers for the request                                                                                                |
| `headers.Prefer`   | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.  |
| `parameters.q`     | string   | Required     | Search parameter for the name or object ID of a node.                                                                       |
| `parameters.type`  | string   | Optional     | Node type. Some AD examples: Base, User, Computer, Group, Container. Some Azure examples: AZBase, AZApp, AZDevice.          |
| `parameters.skip`  | number   | Optional     | This query parameter is used for determining the number of objects to skip in pagination. Required range: x >= 0.           |
| `parameters.limit` | number   | Optional     | This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range: x >= 0. |

### Input Example

`{"parameters":{"q":"683767","type":"Base","skip":0,"limit":10},"headers":{"Prefer":0}}`

### Output

| **Parameter**            | **Type** | **Description**                  |
| ------------------------ | -------- | -------------------------------- |
| `status_code`            | number   | HTTP status code of the response |
| `reason`                 | string   | Response reason phrase           |
| `data`                   | array    | Response data                    |
| `data.objectid`          | string   | Response data                    |
| `data.type`              | string   | Response data                    |
| `data.name`              | string   | Response data                    |
| `data.distinguishedname` | string   | Response data                    |
| `data.system_tags`       | string   | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":[{}]}}`

## Start Analysis

Initiates the generation of attack paths within the Bloodhound application to identify potential security threats.

### Endpoint

- **URL:** `/api/v2/attack-paths`
- **Method:** `PUT`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                            |
| ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `headers`         | object   | Optional     | HTTP headers for the request                                                                                               |
| `headers.Prefer`  | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0. |

### Input Example

`{"headers":{"Prefer":0}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"reason":"OK"}`

## Update Attack Path Risk

Updates the risk status of a specified attack path in Bloodhound using the provided attack\_path\_id, with an optional expiration time.

### Endpoint

- **URL:** `/api/v2/attack-paths/{{attack_path_id}}/acceptance`
- **Method:** `PUT`

### Input

| **Argument Name**                | **Type** | **Required** | **Description**                                                                                                            |
| -------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------- |
| `path_parameters.attack_path_id` | number   | Required     | The ID of the attack path to update.                                                                                       |
| `headers`                        | object   | Optional     | HTTP headers for the request                                                                                               |
| `headers.Prefer`                 | number   | Optional     | Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0. |
| `risk_type`                      | string   | Optional     | The type of risk to be accepted or unaccepted.                                                                             |
| `accept_until`                   | string   | Optional     | The date and time until the risk is accepted.                                                                              |
| `accepted`                       | boolean  | Optional     | Indicates whether the risk is accepted or unaccepted.                                                                      |

### Input Example

`{"json_body":{"risk_type":"high","accept_until":"2024-08-28T21:42:18.844Z","accepted":true},"path_parameters":{"attack_path_id":123},"headers":{"Prefer":0}}`

### Output

| **Parameter**           | **Type** | **Description**                  |
| ----------------------- | -------- | -------------------------------- |
| `status_code`           | number   | HTTP status code of the response |
| `reason`                | string   | Response reason phrase           |
| `data`                  | object   | Response data                    |
| `data.id`               | number   | Response data                    |
| `data.created_at`       | string   | Response data                    |
| `data.updated_at`       | string   | Response data                    |
| `data.deleted_at`       | object   | Response data                    |
| `data.deleted_at.time`  | string   | Response data                    |
| `data.deleted_at.valid` | boolean  | Response data                    |
| `data.Principal`        | string   | Response data                    |
| `data.PrincipalKind`    | string   | Response data                    |
| `data.Finding`          | string   | Response data                    |
| `data.DomainSID`        | string   | Response data                    |
| `data.Props`            | object   | Response data                    |
| `data.accepted_until`   | string   | Response data                    |
| `data.ImpactPercentage` | number   | Response data                    |
| `data.ImpactCount`      | number   | Response data                    |
| `data.Severity`         | string   | Response data                    |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":{"id":123,"created_at":"2023-11-07T05:31:56Z","updated_at":"2023-11-07T05:31:56Z","deleted_at":{},"Principal":"<string>","PrincipalKind":"<string>","Finding":"<string>","DomainSID":"<string>","Props":{},"accepted_until":"2023-11-07T05:31:56Z","ImpactPercentage":123,"ImpactCount":123,"Severity":"critical"}}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |
