{"openapi":"3.1.0","info":{"title":"Sublime Security (BYOK) API","version":"0.1.0","description":"Sublime Security (BYOK) lets an AI assistant read your own Sublime Security data through the Sublime Security API with a key you supply (Sublime API key). Read-only: 7 tools (list_rules, list_mailboxes, list_flagged_message_groups, get_siem_summary, list_user_reports, list_lists, list_audit_log_events). The BYOK key travels with each request, is used for that one call only and is never stored,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-sublime-security.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-sublime-security/docs"},"termsOfService":"https://connectorbay.com/byok-sublime-security/terms"},"servers":[{"url":"https://byok-sublime-security.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-sublime-security/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_rules":{"post":{"operationId":"list_rules","summary":"List detection rules (Sublime feed and custom rules) with name, severity, source, tags, whether active and last update. ","description":"List detection rules (Sublime feed and custom rules) with name, severity, source, tags, whether active and last update. Use for \"Which active high-severity detection rules do we have in Sublime\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Case-insensitive text to find in rule name or description.","title":"Search"},"in_feed":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True for rules from a feed, false for the rest.","title":"In Feed"},"limit":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many entries to return (1 to 500).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Zero-based offset of the first entry to return, for paging.","title":"Offset"}},"title":"list_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_mailboxes":{"post":{"operationId":"list_mailboxes","summary":"List monitored mailboxes with their email address, whether active and any subscription error status. Use for \"Are any mo","description":"List monitored mailboxes with their email address, whether active and any subscription error status. Use for \"Are any monitored mailboxes in Sublime in an error state\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Text to find in mailbox names and email addresses.","title":"Search"},"active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True for effectively active mailboxes only, false for the others.","title":"Active"},"limit":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many entries to return (1 to 500).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Zero-based offset of the first entry to return, for paging.","title":"Offset"}},"title":"list_mailboxesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_flagged_message_groups":{"post":{"operationId":"list_flagged_message_groups","summary":"List groups of similar messages with their attack score verdict, classification, review status and state. Message bodies","description":"List groups of similar messages with their attack score verdict, classification, review status and state. Message bodies, senders and subjects are not returned. Use for \"Which message groups did Sublime flag as malicious this week\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"flagged":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":true,"description":"True to return only groups with at least one flagged message.","title":"Flagged"},"attack_score_verdict":{"anyOf":[{"enum":["unknown","likely_benign","suspicious","malicious","graymail","spam"],"type":"string"},{"type":"null"}],"default":null,"description":"Only groups with this attack score verdict.","title":"Attack Score Verdict"},"created_at_gte":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only groups with a message processed at or after this UTC time, ISO 8601.","title":"Created At Gte"},"created_at_lt":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only groups with a message processed before this UTC time, ISO 8601 (wide windows can time out).","title":"Created At Lt"},"limit":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many entries to return (1 to 500).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Zero-based offset of the first entry to return, for paging.","title":"Offset"}},"title":"list_flagged_message_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_siem_summary":{"post":{"operationId":"get_siem_summary","summary":"Get a reduced summary of flagged or user-reported message groups: verdict, matched rule names, message and recipient cou","description":"Get a reduced summary of flagged or user-reported message groups: verdict, matched rule names, message and recipient counts and first and last seen. Senders and subjects are left out. Use for \"Give me a summary of messages Sublime flagged in the last day\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"type":{"anyOf":[{"enum":["flagged","reported"],"type":"string"},{"type":"null"}],"default":"flagged","description":"Which timestamp to filter on: flagged or reported.","title":"Type"},"timestamp_gte":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Inclusive lower bound, ISO 8601 UTC.","title":"Timestamp Gte"},"timestamp_lt":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Exclusive upper bound, ISO 8601 UTC.","title":"Timestamp Lt"},"cursor":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor: the cursor value of the previous answer.","title":"Cursor"},"limit":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":100,"description":"How many groups to return (1 to 1000).","title":"Limit"}},"title":"get_siem_summaryArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_user_reports":{"post":{"operationId":"list_user_reports","summary":"List messages that users reported as suspicious, with channel and report time. Reporter addresses are not returned. Use ","description":"List messages that users reported as suspicious, with channel and report time. Reporter addresses are not returned. Use for \"How many messages did users report as phishing recently\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"limit":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many reports to return (1 to 500).","title":"Limit"},"reported_at_gte":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only reports at or after this UTC time, ISO 8601.","title":"Reported At Gte"},"reported_at_lt":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only reports before this UTC time, ISO 8601.","title":"Reported At Lt"}},"title":"list_user_reportsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_lists":{"post":{"operationId":"list_lists","summary":"List the lists used in detection rules (for example allow lists of domains or user groups) with name, entry type and whe","description":"List the lists used in detection rules (for example allow lists of domains or user groups) with name, entry type and whether editable. Entries are not returned. Use for \"Which allow and block lists exist in Sublime\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"entry_type":{"anyOf":[{"enum":["string","user_group","provider_org_unit"],"type":"string"},{"type":"null"}],"default":null,"description":"Only lists of this entry type.","title":"Entry Type"},"name":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Exact list name to find.","title":"Name"}},"title":"list_listsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_audit_log_events":{"post":{"operationId":"list_audit_log_events","summary":"List audit log events of the Sublime console (configuration and access changes) with type and time; filter by time range","description":"List audit log events of the Sublime console (configuration and access changes) with type and time; filter by time range or type. Use for \"What changed in our Sublime configuration recently\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"created_at_gte":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only events at or after this UTC time, ISO 8601 such as 2026-10-01T00:00:00Z.","title":"Created At Gte"},"created_at_lt":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only events before this UTC time, ISO 8601 such as 2026-10-08T00:00:00Z.","title":"Created At Lt"},"type":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only events of this type (see Sublime's audit log event types).","title":"Type"},"limit":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many entries to return (1 to 500).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Zero-based offset of the first entry to return, for paging.","title":"Offset"}},"title":"list_audit_log_eventsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}