{"openapi":"3.1.0","info":{"title":"PlatPhorm Investigate API","version":"1.0.0","description":"Autonomous security-incident investigation agent. Correlation and evidence are currently served by local deterministic engines and will move to correlate.platphormnews.com / evidence.platphormnews.com via adapter env vars."},"servers":[{"url":"https://investigate.platphormnews.com"}],"paths":{"/api/health":{"get":{"summary":"Liveness + dependency provenance"}},"/api/docs":{"get":{"summary":"This document"}},"/api/v1/investigate":{"post":{"summary":"Run an autonomous investigation (streams NDJSON run events)","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["question"],"properties":{"question":{"type":"string"}}}}}}}},"/api/v1/tools":{"get":{"summary":"List agent tools + dependency status"}},"/api/v1/tools/{name}":{"post":{"summary":"Invoke a single tool directly (automation surface)"}}},"x-tools":[{"name":"correlate","description":"Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output."},{"name":"map_attack","description":"Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression."},{"name":"build_timeline","description":"Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events."},{"name":"verify_claim","description":"Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion."}]}