Sophos Central

The Sophos Central connector enables streamlined security management and automation by interfacing with Sophos' suite of security products.

Sophos Central is a unified console for managing Sophos products, offering a comprehensive security solution. The Sophos Central Turbine Connector allows users to automate critical security tasks such as managing allowlists and blocklists, executing alert actions, and isolating endpoints. By integrating with Sophos Central, Swimlane Turbine users can streamline threat response, enhance endpoint security, and leverage Sophos' advanced threat intelligence within their automated workflows.

Sophos Central's Public API program makes it easy for you to automate your monitoring, security and administration activities in Sophos Central. This Connector integrates Sophos Central's REST API with Swimlane Turbine to analyze URLs, IPs, and files for threats.

Prerequisites

To effectively utilize the Sophos Central connector with Swimlane Turbine, ensure you have the following prerequisites:

OAuth 2.0 client credentials authentication with the following parameters:

URL: The base URL for the Sophos Central API.

Client ID: Your Sophos Central application client identifier.

Client Secret: The secret key associated with your Sophos Central application.

Asset Setup

To obtain the required asset paramaters - url, client_id, client_secret.

click here

Capabilities

This Connector currently supports the following capabilities:

Common API

Execute Alert Action

List Alert Actions

Endpoint API

Add Entities To Allowlist

Add Entities To Blocklist

Get Isolation by Endpoint

Get Endpoints

Isolate or Unisolate Endpoints

Scan Endpoints

SIEM Integration API

Get SIEM Alerts

Get SIEM Events

Task Setup

The following tasks inputs there are different ways to pass parameters

Get Endpoints

for lastSeenBefore and lastSeenAfter parameters you can pass two values

date and time (UTC) ex: 2019-09-23T12:02:01.700Z

duration relative to the current date and time ex: -PT1D4H500S (PTnDnHnS) and negative indicates time ago.

Notes

Authentication steps to get X-Tenant-ID, URL.

Authentication information can be found here

API Documentation for Common API

API Documentaion for Endpoint API

API Documentation for SIEM Integration API

Configurations

Sophos Central Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target DataRegion.	string	Required
X-Tenant-ID	X Tenant ID.	string	Optional
token_url		string	Optional
X-Tenant-ID-url	A URL to get the X-Tenant-ID, if X-Tenant-ID not provided.	string	Optional
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
scope	Permission scopes for this action.	array	Optional
verify_ssl	Verify SSL certificate.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Entities To Allowlist

Exempt items from conviction by adding them to the Sophos Central allowlist with specified type, properties, and an optional comment.

Endpoint

URL: /endpoint/v1/settings/allowed-items

Method: POST

Input

Argument Name	Type	Required	Description
type	string	Optional	Property by which an item is allowed.
properties	object	Optional	Allowed item properties.
properties.fileName	string	Optional	File name.
properties.path	string	Optional	Path for the application.
properties.sha256	string	Optional	Sha256 value for the application.
properties.certificateSigner	string	Optional	Value saved for the certificateSigner.
comment	string	Optional	Comment indicating why the item should be allowed.
originPersonId	string	Optional	Person associated with the endpoint where the item to be allowed was last seen.
originEndpointId	string	Optional	Endpoint where the item to be allowed was last seen.

Input Example

{"json_body":{"type":"path","properties":{"fileName":"filename.txt","path":"$desktop/documents/filename.txt","sha256":"","certificateSigner":""},"comment":"Item is not a Malware","originPersonId":"3fa85f64-5717-4562-b3fc-2c963f66afa6","originEndpointId":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
createdAt	string	Output field: createdAt
updatedAt	string	Output field: updatedAt
properties	object	Output field: properties
properties.fileName	string	Name of the resource
properties.path	string	Output field: properties.path
properties.sha256	string	Output field: properties.sha256
properties.certificateSigner	string	Output field: properties.certificateSigner
comment	string	Output field: comment
type	string	Type of the resource
createdBy	object	Output field: createdBy
createdBy.id	string	Unique identifier
createdBy.name	string	Name of the resource
originPerson	object	Output field: originPerson
originPerson.id	string	Unique identifier
originPerson.name	string	Name of the resource
originEndpoint	object	Output field: originEndpoint
originEndpoint.id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"123e4567-e89b-12d3-a456-426614174000","createdAt":"2024-06-24T15:00:00Z","updatedAt":"2024-06-24T15:30:00Z","properties":{"fileName":"example.exe","path":"/opt/application/example.exe","sha256":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","certificateSigner":"Example Signer"},"comment":"Allowed for testing purposes.","type":"sha256","createdBy":{"id":"111aaa222bbb333ccc444ddd555eee666","name":"Admin U...

Add Entities To Blocklist

Blocks an entity in Sophos Central by specifying type, properties, and a comment. Requires 'type', 'properties', and 'comment' in JSON body input.

Endpoint

URL: /endpoint/v1/settings/blocked-items

Method: POST

Input

Argument Name	Type	Required	Description
type	string	Optional	Property by which an item is blocked.
properties	object	Optional	Blocked item properties.
properties.fileName	string	Optional	File name.
properties.path	string	Optional	Path for the application.
properties.sha256	string	Optional	Sha256 value for the application.
properties.certificateSigner	string	Optional	Value saved for the certificateSigner.
comment	string	Optional	Comment indicating why the item should be blocked.

Input Example

{"json_body":{"type":"sha256","properties":{"fileName":"filename.txt","path":"$desktop/documents/filename.txt","sha256":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad","certificateSigner":"xyz"},"comment":"Item is a Malware"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
createdAt	string	Output field: createdAt
updatedAt	string	Output field: updatedAt
properties	object	Output field: properties
properties.fileName	string	Name of the resource
properties.path	string	Output field: properties.path
properties.sha256	string	Output field: properties.sha256
properties.certificateSigner	string	Output field: properties.certificateSigner
comment	string	Output field: comment
type	string	Type of the resource
createdBy	object	Output field: createdBy
createdBy.id	string	Unique identifier
createdBy.name	string	Name of the resource
originPerson	object	Output field: originPerson
originPerson.id	string	Unique identifier
originPerson.name	string	Name of the resource
originEndpoint	object	Output field: originEndpoint
originEndpoint.id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"456e7890-f321-4dc5-ba87-654edcba0987","createdAt":"2024-06-25T10:00:00Z","updatedAt":"2024-06-25T10:15:00Z","properties":{"fileName":"malicious.exe","path":"/tmp/malicious.exe","sha256":"abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789","certificateSigner":"Unknown"},"comment":"Detected as malicious by antivirus engine.","type":"sha256","createdBy":{"id":"111aaa222bbb333ccc444ddd555eee666","name":"Security ...

Execute Alert Action

Executes a specified action on an identified alert in Sophos Central using the alertId and action details provided.

Endpoint

URL: /common/v1/alerts/{{alertId}}/actions

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Alert ID.
action	string	Optional	Actions that you can perform on these alerts.
message	string	Optional	Message to send for the action.

Input Example

{"json_body":{"action":"cleanPua","message":"Remove WinExeSvc"},"path_parameters":{"alertId":"a5ded91c-6575-435c-a6b4-64b94f9048ff"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
alertId	string	Unique identifier
action	string	Output field: action
status	string	Status value
requestedAt	string	Output field: requestedAt
startedAt	string	Output field: startedAt
completedAt	string	Output field: completedAt
result	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"2f2d0c43-5687-4cf6-ba15-dd1c1173e673","alertId":"f9415c5f-e0e9-41d7-8126-1956223a66f1","action":"cleanPua","status":"started","requestedAt":"2021-02-12T14:35:20.248","startedAt":"2021-02-12T14:37:01.922","completedAt":"2021-02-12T14:37:01.922","result":"xyz"}}

Get Endpoints

Retrieves a comprehensive list of all endpoints associated with the specified tenant in Sophos Central.

Endpoint

URL: /endpoint/v1/endpoints

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageFromKey	string	Optional	The key of the item from where to fetch a page.
parameters.pageSize	number	Optional	The size of the page requested.
parameters.pageTotal	boolean	Optional	Whether the number of pages should be calculated and returned in the response.
parameters.sort	array	Optional	Defines how to sort the data.
parameters.healthStatus	array	Optional	Find endpoints by health status.
parameters.type	array	Optional	Find endpoints by type.
parameters.tamperProtectionEnabled	boolean	Optional	Find endpoints by whether Tamper Protection is turned on.
parameters.lockdownStatus	array	Optional	Find endpoints by lockdown status.
parameters.lastSeenBefore	string	Optional	Find endpoints that were last seen before the given date and time (UTC) or a duration relative to the current date and time (exclusive), or you can provide 3 days 4 hours 5 minutes and 0 seconds ago, value is case-sensitive(-P3DT4H5M0S).
parameters.lastSeenAfter	string	Optional	Find endpoints that were last seen after the given date and time (UTC) or a duration relative to the current date and time (inclusive), or you can provide 3 days 4 hours 5 minutes and 0 seconds ago, value is case-sensitive(-P3DT4H5M0S).
parameters.ids	array	Optional	Find endpoints with the specified IDs.
parameters.isolationStatus	string	Optional	Find endpoints by isolation status.
parameters.hostnameContains	string	Optional	Find endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched.
parameters.associatedPersonContains	string	Optional	Find endpoints where the name of the person associated with the endpoint contains the given string.
parameters.groupNameContains	string	Optional	Find endpoints where the name of the group the endpoint is in contains the given string.
parameters.search	string	Optional	Term to search for in the specified search fields.
parameters.searchFields	array	Optional	List of search fields for finding the given search term. Defaults to all applicable fields. By default it takes all five values in an array.
parameters.ipAddresses	array	Optional	Find endpoints by IP addresses.
parameters.cloud	array	Optional	Find endpoints that are cloud instances.
parameters.fields	array	Optional	The fields to return in a partial response.
parameters.view	string	Optional	Type of view to be returned in response.
parameters.assignedToGroup	boolean	Optional	Whether endpoint is assigned to a group.
parameters.groupIds	array	Optional	Match endpoints by assigned group.
parameters.macAddresses	array	Optional	Find endpoints by MAC Addresses. Must contain at most 50 items must be unique.

Input Example

{"parameters":{"pageFromKey":"abcdef123456","pageSize":50,"pageTotal":false,"sort":["hostname:asc","lastSeenAt:desc"],"healthStatus":["good","bad"],"type":["computer","server"],"tamperProtectionEnabled":true,"lockdownStatus":["unlocked","notInstalled"],"lastSeenBefore":"2019-09-23T12:02:01.700Z","lastSeenAfter":"PT4H500S","ids":["123e4567-e89b-12d3-a456-426614174000","987e6543-21cb-43d1-ba69-123456789000"],"isolationStatus":"isolated","hostnameContains":"example","associatedPersonContains":"john","groupNameContains":"workstations","search":"windows","searchFields":["hostname","groupName","associatedPersonName","osName"],"ipAddresses":["192.168.1.100","10.0.0.1"],"cloud":["aws:i-3bc4829309","azure:42349c92"],"fields":["id","hostname","os"],"view":"full","assignedToGroup":true,"groupIds":["654321ab-cdef-9876-5432-fedcba098765","abcdef12-3456-7890-fedc-ba9876543210"],"macAddresses":["01:23:45:67:89:AB","0123456789ab"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.type	string	Type of the resource
items.tenant	object	Output field: items.tenant
items.tenant.id	string	Unique identifier
items.tenant.hostname	string	Name of the resource
items.health	object	Output field: items.health
items.health.overall	string	Output field: items.health.overall
items.threats	object	Output field: items.threats
items.threats.status	string	Status value
items.services	object	Output field: items.services
items.services.status	string	Status value
items.services.serviceDetails	array	Output field: items.services.serviceDetails
items.services.serviceDetails.name	string	Name of the resource
items.services.serviceDetails.status	string	Status value
items.os	object	Output field: items.os
items.os.isServer	boolean	Output field: items.os.isServer
items.os.platform	string	Output field: items.os.platform
items.os.name	string	Name of the resource
items.os.majorVersion	number	Output field: items.os.majorVersion
items.os.minorVersion	number	Output field: items.os.minorVersion
items.os.build	number	Output field: items.os.build
items.os.ipv4Addresses	array	Output field: items.os.ipv4Addresses

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pages":{"fromKey":"key1","nextKey":"key2","size":10,"total":100,"items":1000,"maxSize":50}}}

Get Isolation by Endpoint

Retrieve isolation settings for a specified endpoint in Sophos Central using the unique endpointId.

Endpoint

URL: /endpoint/v1/endpoints/{{endpointId}}/isolation

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.endpointId	string	Required	Endpoint ID.

Input Example

{"path_parameters":{"endpointId":"416e722a-4ee3-4e81-98c0-a5489ee23fc6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
enabled	boolean	Output field: enabled
lastEnabledAt	string	Output field: lastEnabledAt
lastEnabledBy	object	Output field: lastEnabledBy
lastEnabledBy.id	string	Unique identifier
lastEnabledBy.type	string	Type of the resource
lastEnabledBy.name	string	Name of the resource
lastEnabledBy.accountType	string	Type of the resource
lastEnabledBy.accountId	string	Unique identifier
lastDisabledAt	string	Output field: lastDisabledAt
lastDisabledBy	object	Output field: lastDisabledBy
lastDisabledBy.id	string	Unique identifier
lastDisabledBy.type	string	Type of the resource
lastDisabledBy.name	string	Name of the resource
lastDisabledBy.accountType	string	Type of the resource
lastDisabledBy.accountId	string	Unique identifier
comment	string	Output field: comment

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 25 Jun 2024 08:37:17 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-ID":"ff459065-adfe-4deb-8d75-8df4d1629e7f","X-Request-ID":"49f7d5e4-c3b0-4314-a965-a3338b232b09"},"reason":"","json_body":{"enabled":true,"lastEnabledAt":"2024-06-25T15:30:00Z","lastEnabledBy":{"id":"[email protected]","type":"user","name":"John Doe","accountType":"organization","accountId":"98765432-abcdef-01234...

Get SIEM Alerts

Fetches the latest Sophos Central SIEM alerts, including timestamps, from the past 24 hours.

Endpoint

URL: /siem/v1/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	The maximum number of items to return.
parameters.from_date	number	Optional	The starting date from which alerts will be retrieved defined as Unix timestamp in UTC. Ignored if cursor is set. Must be within last 24 hours.
parameters.cursor	string	Optional	Identifier for next item in the list, this value is available in response as next_cursor.

Input Example

{"parameters":{"limit":100,"from_date":86400,"cursor":"xyz"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
has_more	boolean	Output field: has_more
items	array	Output field: items
items.created_at	string	Output field: items.created_at
items.customer_id	string	Unique identifier
items.data	object	Response data
items.description	string	Output field: items.description
items.event_service_event_id	string	Unique identifier
items.id	string	Unique identifier
items.info	object	Output field: items.info
items.location	string	Output field: items.location
items.severity	string	Output field: items.severity
items.source	string	Output field: items.source
items.threat	string	Output field: items.threat
items.threat_cleanable	boolean	Output field: items.threat_cleanable
items.type	string	Type of the resource
items.when	string	Output field: items.when
next_cursor	string	Output field: next_cursor

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"has_more":false,"items":[{}],"next_cursor":"abcdef123456"}}

Get SIEM Events

Retrieve Sophos Central events with timestamps from the last 24 hours for SIEM integration.

Endpoint

URL: /siem/v1/events

Method: GET

Input

Argument Name	Type	Required	Description
prameters	object	Optional	Parameter for Get SIEM Events
prameters.limit	number	Optional	The maximum number of items to return.
prameters.cursor	string	Optional	Identifier for next item in the list, this value is available in response as next_cursor.
prameters.from_date	number	Optional	The starting date from which alerts will be retrieved defined as Unix timestamp in UTC.Ignored if cursor is set.
prameters.exclude_types	string	Optional	The String of list of types of events to be excluded.

Input Example

{"prameters":{"limit":100,"cursor":"xyz","from_date":"86400","exclude_types":"error,warning,info,debug"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
has_more	boolean	Output field: has_more
items	array	Output field: items
items.amsi_threat_data	object	Response data
items.amsi_threat_data.parentProcessId	string	Response data
items.amsi_threat_data.parentProcessPath	string	Response data
items.amsi_threat_data.processId	string	Response data
items.amsi_threat_data.processName	string	Response data
items.amsi_threat_data.processPath	string	Response data
items.appCerts	array	Output field: items.appCerts
items.appCerts.signer	string	Output field: items.appCerts.signer
items.appCerts.thumbprint	string	Output field: items.appCerts.thumbprint
items.appSha256	string	Output field: items.appSha256
items.core_remedy_items	object	Output field: items.core_remedy_items
items.core_remedy_items.items	array	Output field: items.core_remedy_items.items
items.core_remedy_items.items.descriptor	string	Output field: items.core_remedy_items.items.descriptor
items.core_remedy_items.items.result	string	Result of the operation
items.core_remedy_items.items.type	string	Type of the resource
items.core_remedy_items.totalItems	number	Output field: items.core_remedy_items.totalItems
items.created_at	string	Output field: items.created_at
items.customer_id	string	Unique identifier
items.details	array	Output field: items.details
items.details.property	string	Output field: items.details.property
items.details.type	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"has_more":true,"items":[{}],"next_cursor":"next_cursor_example"}}

Isolate or Unisolate Endpoints

Enables or disables isolation for multiple endpoints in Sophos Central, with a recommended time gap between state changes.

Endpoint

URL: /endpoint/v1/endpoints/isolation

Method: POST

Input

Argument Name	Type	Required	Description
enabled	boolean	Optional	Whether the endpoints should be isolated or not.
comment	string	Optional	Reason the endpoints should be isolated or not. Length is lessthan 400.
ids	array	Optional	List of endpoints IDs. Max contain is 50.

Input Example

{"json_body":{"enabled":true,"comment":"Isolating endpoints with suspicious health","ids":["3fa85f64-5717-4562-b3fc-2c963f66afa6","9d5d6819-0238-43e6-ba03-815cae0d474d","2da8b591-9164-4f7e-a367-ad9b9cb77736","66046f6a-bff0-4b51-aa0b-ac18bd363207"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
isolation	object	Output field: isolation
isolation.enabled	boolean	Output field: isolation.enabled
isolation.lastEnabledAt	string	Output field: isolation.lastEnabledAt
isolation.lastEnabledBy	object	Output field: isolation.lastEnabledBy
isolation.lastEnabledBy.id	string	Unique identifier
isolation.lastEnabledBy.type	string	Type of the resource
isolation.lastEnabledBy.name	string	Name of the resource
isolation.lastEnabledBy.accountType	string	Type of the resource
isolation.lastEnabledBy.accountId	string	Unique identifier
isolation.lastDisabledAt	string	Output field: isolation.lastDisabledAt
isolation.lastDisabledBy	object	Output field: isolation.lastDisabledBy
isolation.lastDisabledBy.id	string	Unique identifier
isolation.lastDisabledBy.type	string	Type of the resource
isolation.lastDisabledBy.name	string	Name of the resource
isolation.lastDisabledBy.accountType	string	Type of the resource
isolation.lastDisabledBy.accountId	string	Unique identifier
isolation.comment	string	Output field: isolation.comment

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"123e4567-e89b-12d3-a456-426614174000","isolation":{"enabled":true,"lastEnabledAt":"2024-06-25T15:30:00Z","lastEnabledBy":{},"lastDisabledAt":"2024-06-24T12:00:00Z","lastDisabledBy":{},"comment":"Endpoint isolated due to security incident."}}}

List Alert Actions

Retrieve a list of actions taken on a specific alert in Sophos Central using the alertId.

Endpoint

URL: /common/v1/alerts/{{alertId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Alert ID.

Input Example

{"path_parameters":{"alertId":"a5ded91c-6575-435c-a6b4-64b94f9048ff"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
allowedActions	array	Output field: allowedActions
category	string	Output field: category
description	string	Output field: description
groupKey	string	Output field: groupKey
managedAgent	object	Output field: managedAgent
managedAgent.id	string	Unique identifier
managedAgent.type	string	Type of the resource
person	object	Output field: person
person.id	string	Unique identifier
product	string	Output field: product
raisedAt	string	Output field: raisedAt
severity	string	Output field: severity
tenant	object	Output field: tenant
tenant.id	string	Unique identifier
tenant.name	string	Name of the resource
type	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"a5ded91c-6575-435c-a6b4-64b94f9048ff","allowedActions":["acknowledge"],"category":"updating","description":"John-PC is out of date.","groupKey":"MSxFdmVudDo6RW5kcG9pbnQ6Ok91dE9mRGF0ZSw1MTMs","managedAgent":{"id":"bb90527d-73a8-4e6e-85c6-20c2e0c5bc6f","type":"computer"},"person":{"id":"17dd896f-ee9f-4f7d-a2a2-6a8c0b48ff15"},"product":"endpoint","raisedAt":"2021-02-12T15:04:53.780Z","severity":"medium","tenant":{"id":"79067f...

Scan Endpoints

Initiates or configures a scan on a specified endpoint using its endpointId in Sophos Central.

Endpoint

URL: /endpoint/v1/endpoints/{{endpointId}}/scans

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.endpointId	string	Required	Endpoint ID.

Input Example

{"json_body":{},"path_parameters":{"endpointId":"416e722a-4ee3-4e81-98c0-a5489ee23fc6"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
status	string	Status value
requestedAt	string	Output field: requestedAt

Output Example

{"status_code":201,"response_headers":{"Date":"Tue, 25 Jun 2024 07:33:17 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-ID":"5304dbd8-ac5b-4915-b296-3e26c94cd5ff","X-Request-ID":"4028517a-90cc-47e5-870a-1e52ff3ef064"},"reason":"","json_body":{"id":"416e722a-4ee3-4e81-98c0-a5489ee23fc6","status":"requested","requestedAt":"2024-06-25T07:33:16.990060040Z"}}

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 25 Jun 2024 08:37:17 GMT
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Correlation-ID	A unique identifier for correlating requests	5304dbd8-ac5b-4915-b296-3e26c94cd5ff
X-Request-ID	A unique identifier for the request	49f7d5e4-c3b0-4314-a965-a3338b232b09