ExtraHop Explore REST API Guide

Click on any resource group in the REST API Explorer to view the available operations and the expected URL syntax for the resource.

The following options enable you to manage the information displayed on the main page.

Objects on the ExtraHop system can be identified by any unique value, such as the IP address, MAC address, name, or system ID. However, to perform API operations on a specific object, you must locate the object ID. You can easily locate the object ID through the following methods in the REST API Explorer.

• The object ID is provided in the headers returned from a POST request. For example, if you send a POST request to create a page, the response headers display a location URL.

  The following request returned the location for the newly created page as /api/v1/pages/221 and the ID for the page as 221.

  {
   "date": "Wed, 25 Nov 2015 17:39:06 GMT",
   "via": "1.1 localhost",
   "server": "Apache",
   "content-type": "text/plain; charset=utf-8",
   "location": "/api/v1/pages/221",
   "cache-control": "private, max-age=0",
   "connection": "Keep-Alive",
   "keep-alive": "timeout=45, max=89",
   "content-length": "0"
  }

• The object ID is provided for all objects returned from a GET request. For example, if you perform a GET request on all devices, the response body contains information for each device, including the ID.

  The following response body displays an entry for a single device, with an ID of 10212:

  {
   "mod_time": 1448474346504,
   "node_id": null,
   "id": 10212,
   "extrahop_id": "test0001",
   "description": null,
   "user_mod_time": 1448474253809,
   "discover_time": 1448474250000,
   "vlanid": 0,
   "parent_id": 9352,
   "macaddr": "00:05:G3:FF:FC:28",
   "vendor": "Cisco",
   "is_l3": true,
   "ipaddr4": "10.10.10.5",
   "ipaddr6": null,
   "device_class": "node",
   "default_name": "Cisco5",
   "custom_name": null,
   "cdp_name": "",
   "dhcp_name": "",
   "netbios_name": "",
   "dns_name": "",
   "custom_type": "",
   "analysis_level": 1
  },

• The object ID is provided in the URL for most objects. For example, in the ExtraHop Web UI, click on Metrics, and then Devices. Select any device and view the URL. In the following example, the URL for the device page shows Oid=10180.

  https://10.10.10.205/extrahop/#/Devices?details=true&device
  Oid=10180&from=6&interval_type=HR&until=0&view=l2stats

  To perform specific requests for that device, add 10180 to the id field in the REST API Explorer or to the body parameter in your request.

  The URL for dashboards displays a short_code, which appears after /Dashboard. When you add the short_code to the REST API Explorer or to your request, you must prepend a tilde to the short code.

  In the following example, kmC9Y is the short_code. To perform requests for this dashboard, add ~kmC9Y as the value for the short_code field.

  https://10.10.10.205/extrahop/#/Dashboard/kmC9Y/?from=6&interval_
  type=HR&until=0

  You can also find the short_code and dashboard ID in the Dashboard Properties for any dashboard, which can be accessed from the command menu . Some API operations, such as DELETE, require the dashboard ID.

The ExtraHop system consists of a network of connected appliances that perform tasks such as monitoring traffic, analyzing data, storing data, and identifying detections.

You can retrieve information about ExtraHop appliances connected to the local appliance and establish new connections to remote ExtraHop appliances.

The following table displays all of the operations you can perform on this resource:

Implementation information and instructions for each operation are documented in the REST API Explorer. You can click on any operation in the REST API Explorer to view implementation information such as parameters, response class and messages, and JSON model and schema.

An API key enables a user to perform operations through the ExtraHop REST API.

You can generate the initial API key for the setup user account through the REST API. All other API keys are generated through the API Access page in the ExtraHop Admin UI.

The following table displays all of the operations you can perform on this resource:

Implementation information and instructions for each operation are documented in the REST API Explorer. You can click on any operation in the REST API Explorer to view implementation information such as parameters, response class and messages, and JSON model and schema.

This resource provides metadata about the ExtraHop appliance, such as the firmware version or if the appliance is a Command appliance.

The following table displays all of the operations you can perform on this resource:

Implementation information and instructions for each operation are documented in the REST API Explorer. You can click on any operation in the REST API Explorer to view implementation information such as parameters, response class and messages, and JSON model and schema.

This resource enables you to retrieve and set product keys or to retrieve and set a license.

The following table displays all of the operations you can perform on this resource:

Implementation information and instructions for each operation are documented in the REST API Explorer. You can click on any operation in the REST API Explorer to view implementation information such as parameters, response class and messages, and JSON model and schema.

The running configuration file is a JSON document that contains core system configuration information for the ExtraHop appliance.

The following table displays all of the operations you can perform on this resource:

Implementation information and instructions for each operation are documented in the REST API Explorer. You can click on any operation in the REST API Explorer to view implementation information such as parameters, response class and messages, and JSON model and schema.