Shuffle API

Set a key

Add a key to the Shuffle Datastore (previously called cache). To add a key to a specific category, add "category": "name" to the JSON body. The value field can be anything, but preferrably JSON. You can add Enrichments using the enrichments field with the format [{"type": "ip", "value": 1.2.3.4"}] which is used heavily in Shuffle Security. ignore_security_rules is only relevant IF you have enabled security rules for the category you are in, which restricts who and what can write to a key.

Methods: POST, PUT

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{org_id}/set_cache' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "key": "hi",
  "value": "1234",
  "category": "category",
  "ignore_security_rules": false
}'

Success response

{"success": true, "keys_existed": [{"key": "hi", "existed": true }]}

Set multiple keys

Accepts a list in the same format as Set a key, and is very efficient at bulk updates. Returns which keys are new and which were updated. To add a key to a specific category, add "category": "name" to the JSON body. PS: Only keys of the first discovered category will be added.

Methods: POST, PUT

curl -X POST 'https://uk.shuffle.security/api/v2/datastore?bulk=true' \
  -H 'Authorization: Bearer APIKEY' \
  -d '[
  {
    "key": "testKey1",
    "value": "1234",
    "category": "category"
  },
  {
    "key": "testKey2",
    "value": "1234",
    "category": "category"
  }
]'

Success response

{"success": true, "keys_existed": [{"key": "testKey1", "existed": true }, { "key": "testKey2", "existed": false}]}

Get a key

Search for a cache key. For keys set in a workflow, it may unavailable with the normal API, and require execution_id & authorization in the JSON body.

To get a key from a specific category, add "category": "name" to the JSON body.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{org_id}/get_cache' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "ORG_ID",
  "key": "hi"
}'

Success response

{
"success": true, "workflow_id": "99951014-f0b1-473d-a474-4dc9afedkb81", "execution_id": "f0b2b4e9-90ca-4835-bdd4-2889ef5ls2u5", "key": "hi", "value": "1234", "category": "category", "created": 1761114186, "edited": 1761114186, "changed": true, "encrypted": false, "public_authorization":"efbd9m2sy-f07c-4167-aa32-642b1429814d", "suborg_distribution": null, "revision_id": ""
}

List all keys

List existing datastore (cache) keys. By default, this will include the 50 last modified keys from any category.

To list keys from a specific category, ?category= to the URL.

Available queries:

• top: default 50. How many keys to return.
• cursor: to get the next page
• category: the category to get

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/orgs/{org_id}/list_cache' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true,"keys":[{"success":false,"workflow_id":"99951014-f0b1-473d-a474-4dc9afecaa75","execution_id":"f0b2b4e9-90ca-4835-bdd4-2889ef5f926f","org_id":"2e7b6a08-b63b-4fc2-bd70-718091509db1","key":"hi","value":"1234"}]}

Delete a key

Deletes a key, completely removing all references to it.

To delete a key from a specific category, add "category": "name" to the JSON body.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{org_id}/delete_cache' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "ORG_ID",
  "key": "hi",
  "category": ""
}'

Success response

{"success": true}

Dynamic Category - List records

Dynamic endpoint that digs into the Datastore to return all records for a given category. Commonly used for collections like Incidents (/api/v2/incidents), Software (/api/v2/software), Assets, and custom categories.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v2/{category}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{
  "success": true,
  "data": [
    {
      "key": "INC-1001",
      "value": {
        "title": "Suspicious login detected",
        "severity": "HIGH"
      }
    }
  ]
}

Dynamic Category - Get record

Retrieves a specific record from a Datastore category using the dynamic category path.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v2/{category}/{key}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{
  "success": true,
  "key": "INC-1001",
  "value": {
    "title": "Suspicious login detected",
    "severity": "HIGH",
    "status": "INVESTIGATING"
  }
}

Dynamic Category - Set record

Creates or updates a specific record in a Datastore category using the dynamic category path.

Method: POST

curl -X POST 'https://uk.shuffle.security/api/v2/{category}/{key}' \
  -H 'Authorization: Bearer APIKEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "title": "Suspicious login detected",
  "severity": "HIGH",
  "status": "INVESTIGATING"
}'

Success response

{
  "success": true
}

Dynamic Category - Get record revisions

Returns version history and immutable revision snapshots for a specific key within any Datastore category. All updates, script writes, and automated workflow runs append a new revision rather than destructively overwriting data. This ensures accidental deletions or invalid payloads can be rolled back immediately while maintaining an audit log of who made which change.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v2/datastore/category/{category}/{key}/revisions' \
  -H 'Authorization: Bearer APIKEY'

Success response

{
  "success": true,
  "data": [
    {
      "revision_id": "rev_01j7abc890def",
      "key": "INC-1001",
      "edited": 1773291600,
      "user_id": "usr_9981",
      "workflow_id": "",
      "execution_id": "",
      "value": {
        "title": "Suspicious login detected",
        "severity": "HIGH",
        "status": "IN_PROGRESS"
      }
    },
    {
      "revision_id": "rev_01j7abc123xyz",
      "key": "INC-1001",
      "created": 1773291000,
      "user_id": "",
      "workflow_id": "wf_ingest_alerts",
      "execution_id": "exec_5521",
      "value": {
        "title": "Suspicious login detected",
        "severity": "HIGH",
        "status": "NEW"
      }
    }
  ]
}

Correlations

Correlates and cross-references records stored within Shuffle's Datastore to discover relationships between entities such as indicators, alerts, assets, and incidents.

Method: POST

curl -X POST 'https://uk.shuffle.security/api/v2/correlations' \
  -H 'Authorization: Bearer APIKEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "category": "incidents",
  "key": "INC-1001"
}'

Success response

{
  "success": true,
  "correlations": []
}

App API

Apps are the building blocks used in workflows, as they contain the actions to be executed. First of all, there are two types of apps:

• Generated from OpenAPI
• Self-made with Python

Here's how to distinguish them for now:

• OpenAPI: app.activated & app.generated = true, and app.private_id length > 0
• Normal: Opposite of OpenAPI

Get apps

Returns a list of existing apps that you have access to, including private ones.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/apps' \
  -H 'Authorization: Bearer APIKEY'

Delete an app

Deletes an app if you have access to delete it.

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/apps/{app_id}' \
  -H 'Authorization: Bearer APIKEY'

Upload a python app

Uploads a python app. You should upload a zip file with the following like file structure. This has to be done for each individual version of the app. The app uploaded is available to everyone in the tenant.

If you need help with this section, look into the Shuffle CLI utility as well.

To zip an app, go to the appfolder, e.g. shuffle-tools, then type in the following to zip the version you want to upload (*nix):

zip app.zip -r version/*

This will give you the following structure.

app.zip
├── src
│   ├── app.py
├── api.yaml
├── Dockerfile
├── requirements.txt

Methods: POST

curl -X GET 'https://uk.shuffle.security/api/v1/apps/upload' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true, "id": "798f1234c4fb8b4a6300da3c546af45a"}

The ID returned is based on these fields being unique:

• Organization
• App Name
• App ID

After an app is uploaded, the App cache for your tenant is cleared, meaning your apps will be loaded from the database directly. If you want to see whether your app was uploaded or not, you can always check the app directly here (swap appid): https://shuffler.io/apps/{appid}

Stats and Timelines

Stats and Timelines are a system built to help track changes to something over time. This is used both by internal systems in Shuffle, and is an option for you to use in Workflows or elsewhere to make timelines. Adding statistics was added in versions >1.4.3, and graphing of ANY value will be available soon. Graphs for default tracked information like App and Workflow utilisation is on the statistics admin page for your tenant.

The new dashboard page allows for customisation of a bar graph. You may view your custom stats here. We will introduce custom dashboard controls in future versions of Shuffle.

Get Stats

Returns the statistics for an tenant

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/orgs/{ORG_ID}/stats' \
  -H 'Authorization: Bearer APIKEY'

Success response

{
  "org_id": "orgid",
  "org_name": "orgname",
  "last_cleared": 1722463229,
  "daily_statistics": [
    {
      "date": "2024-06-27T10:38:56.488732Z",
      "app_executions": 32,
      "app_executions_failed": 0,
      "subflow_executions": 10,
      "workflow_executions": 10,
      "workflow_executions_finished": 20,
      "workflow_executions_failed": 0,
      "org_sync_actions": 0,
      "cloud_executions": 20,
      "onprem_executions": 0,
      "ai_executions": 0,
      "api_usage": 0,
      "app_usage": null,
      "additions": [
        {
          "key": "app_executions_Cloud",
          "value": 42
        },
        {
          "key": "custom_sample_key",
          "value": 10
        }
      ]
    }
  ],
  "additions": [
    {
      "key": "app_executions_Cloud",
      "value": 42
    },
    {
      "key": "custom_sample_key",
      "value": 123,
      "daily_value": 113
    }
  ]
}

Count Stats for Custom key

Add a statistic to be added, e.g. for number of tickets found over time. Custom statistics are tracked under the key "custom_X", where "custom_" is appended unless supplied, and "X" is the key you supply. They can be found in the "additions" section of the Get Stats API response.

Use the "Count Stats" action in Shuffle tools to do this in a Workflow

Method: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{ORG_ID}/stats' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "key": "tickets",
  "value": 6
}'

Success response

{"success": true, "reason": "Cache incremented by 6"}

Health

Health, ops and monitoring APIs in Shuffle allow checking system readiness, tracking operational metrics, and monitoring live execution throughput.

Health check

Health check endpoint to verify system availability and operational readiness.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/health'

Success response

{
  "success": true,
  "status": "UP"
}

Health and ops stats

Returns operational metrics and execution health statistics over a specified timeframe.

Available queries:

• after: Unix epoch timestamp start of range.
• before: Unix epoch timestamp end of range.
• onprem: Set to true when querying an on-premises instance.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/health/stats?after=1767225600&before=1775000000' \
  -H 'Authorization: Bearer APIKEY'

Success response

[
  {
    "updated": 1767225600,
    "total_executions": 1542,
    "failed_executions": 3
  }
]

Live execution stats

Returns real-time execution statistics broken down by status over a specified time window.

Available queries:

• mode: Time range window (1h, 24h, 7d, 30d). Default is 1h.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/health/executions/live?mode=1h' \
  -H 'Authorization: Bearer APIKEY'

Success response

[
  {
    "created_at": 1777973900,
    "executing": 4,
    "finished": 85,
    "aborted": 1
  }
]

App Authentication

App Authentication is a way to store authentication keys encrypted and safe, available through using their ID. You can interact with it through a workflow, an app or the admin panel at /admin?tab=app_auth. To use an authentication after it's made, it has to be mapped to an action in a workflow by it's ID.

Here is a brief video that you can watch to learn more about it:

List App Authentication

Get a list of all app authentication. These are all the authentication currently available to YOUR tenant. These can be distributed from Parent tenant to Child tenant.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/apps/authentication' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true, "data": []}

Set Authentication Everywhere

When you have an authentication available, it is possible to set it everywhere using an API. This will update all your current workflows that uses that app to use the specified authentication. This can also be done while creating an app authentication by setting the field "auto_distribute": true in the json

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/apps/authentication/{authentication_id}/config' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "action": "assign_everywhere",
  "id": "authentication_id"
}'

Success response

{"success": true}

Allow subtenant to use auth

Parent tenants have the option to allow child tenants to use the same auth. The subtenants can not modify the auth they get access to. Intended for use where you e.g. have one ticketing system as an MSSP which you want to create tickets in from your child tenants (customers).

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/apps/authentication/{authentication_id}/config' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "action": "suborg_distribute",
  "id": "authentication_id"
}'

Success response

{"success": true}

Delete App Authentication

Delete an authentication. PS: This does NOT change the ID of every workflow that utilizes the app.

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/apps/authentication/{authentication_id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true}

Add App Authentication

Add authentication to an app, available through e.g. the Workflow editor, or authentication explorer. When adding this, make sure the app has an ID (uuid) and name attached to it, and that the fields are matching the apps' description.

You can find the fields following these steps:

1. Get the app you want to use (e.g. Jira)
2. Find a sample Action (doesn't matter which)
3. Loop through the Action's parameter's and find fields tagged with "configuration": true

If you want it auto distributed to all existing workflows in your tenant, add "auto_distribute": true to the JSON body

Method: PUT

curl -X GET 'https://uk.shuffle.security/api/v1/apps/authentication' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true, "id": "app_id"}

Search existing apps

Returns a list of apps that are hidden in the backend, e.g. OpenAPI apps loaded from Security API's. Requires the search parameter.

Example: {"search": "secure"} will match both "secureworks" and "Cisco openVuln", because Secureworks has "secure" in its name and Cisco uses "secure" in its description.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/apps/search' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "search": "APPNAME"
}'

Success response

{"success": true, "reason": [{apps here}]}

Download REMOTE apps

Describes how to download remote apps from a Github repository, including private ones.

User API

Below are the endpoints related to user creation, editing, listing, apikey generation and more.

List users

Lists all available users. Requires admin rights.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/users/getusers' \
  -H 'Authorization: Bearer APIKEY'

Success response List of users

Register a new user

Registers a user based on the username and password provided. If it's the first user, it can be done by anyone, otherwise only admins.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/users/register' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "username": "username",
  "password": "P@ssw0rd"
}'

Success response

{"success": true}

Update a user

Updates a user. Requires admin rights.

Supported fields:

• username
• role (admin/user)

Methods: PUT

curl -X PUT 'https://uk.shuffle.security/api/v1/users/updateuser' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "user_id": "USERID",
  "role": "user"
}'

Success response

{"success": true}

Deactivates a user

Deactivates a user. This exists instead of a deletion method. Requires admin rights.

Method: DELETE

curl -X DELETE 'https://uk.shuffle.security/api/v1/users/{userid}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true}

Get new apikey

Re-generates a new apikey. Requires admin for POST. GET changes YOUR apikey. The API-key will always be 36 in length (uuid)

Methods: GET, POST (admin)

curl -X POST 'https://uk.shuffle.security/api/v1/users/generateapikey' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "user_id": "id"
}'

Success response

{"success": true, "username": "username", "verified": false, "apikey": "new apikey"}

File API

Below are the endpoints related to file creation, uploading, downloading, listing and more. This API is available to Python apps by using self.set_files(files) and self.get_file(file_id)

Create a file

Creating a file is necessary before uploading one. This is to prepare the file location which is always per-tenant only. Use "global" for the workflow_id if it's not associated with one.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/files/create' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "filename": "file.txt",
  "org_id": "your_organization",
  "workflow_id": "workflow_id",
  "namespace": "category",
  "labels": [
    "label1",
    "label2"
  ]
}'

Success response

{"success": true, "id": "e19cffe4-e2da-47e9-809e-904f5cb03687"}

Upload a file

Uploads a file to an ID created with the "Create a file" API function. This is only possible once and can't be overwritten.

Methods: POST

curl -X GET 'https://uk.shuffle.security/api/v1/files/{file}/upload' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true, "id": "e19cffe4-e2da-47e9-809e-904f5cb03687"}

List files

Gets the meta for all files (up to 1000)

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/files' \
  -H 'Authorization: Bearer APIKEY'

Success response

[{"id":"e19cffe4-e2da-47e9-809e-904f5cb03687","type":"","created_at":1614015359,"updated_at":1614015521,"meta_access_at":0,"last_downloaded":0,"description":"","expires_at":"","status":"active","filename":"file.txt","url":"","org_id":"b199646b-16d2-456d-9fd6-b9972e929466","workflow_id":"global","workflows":null,"download_path":"shuffle-files/b199646b-16d2-456d-9fd6-b9972e929466/global/e19cffe4-e2da-47e9-809e-904f5cb03687","md5_sum":"3917d8dbd72e73a2db92ad5bb6544940","sha256_sum":"3f25c3613d658ecdd7ee9b7777193ffb084ebe43e641f6daa3c3181f0b631c08","filesize":1061,"duplicate":false,"subflows":null}, {"id":"e19cffe4-e2da-47e9-809e-904f5cb03687","type":"","created_at":1614015359,"updated_at":1614015521,"meta_access_at":0,"last_downloaded":0,"description":"","expires_at":"","status":"active","filename":"file.txt","url":"","org_id":"b199646b-16d2-456d-9fd6-b9972e929466","workflow_id":"global","workflows":null,"download_path":"shuffle-files/b199646b-16d2-456d-9fd6-b9972e929466/global/e19cffe4-e2da-47e9-809e-904f5cb03687","md5_sum":"3917d8dbd72e73a2db92ad5bb6544940","sha256_sum":"3f25c3613d658ecdd7ee9b7777193ffb084ebe43e641f6daa3c3181f0b631c08","filesize":1061,"duplicate":false,"subflows":null}]

Download a file

Gets the file CONTENT of a file

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/files/{id}/content' \
  -H 'Authorization: Bearer APIKEY'

Success response

THIS IS SOME TEXT INSIDE A TEXTFILE HELLO :)

Get file meta data

Gets metadata for a file, as well as some security relevant info like MD5 and Sha256 sum.

Methods: POST

curl -X GET 'https://uk.shuffle.security/api/v1/files/{id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"id":"e19cffe4-e2da-47e9-809e-904f5cb03687","type":"","created_at":1614015359,"updated_at":1614015521,"meta_access_at":0,"last_downloaded":0,"description":"","expires_at":"","status":"active","filename":"file.txt","url":"","org_id":"b199646b-16d2-456d-9fd6-b9972e929466","workflow_id":"global","workflows":null,"download_path":"shuffle-files/b199646b-16d2-456d-9fd6-b9972e929466/global/e19cffe4-e2da-47e9-809e-904f5cb03687","md5_sum":"3917d8dbd72e73a2db92ad5bb6544940","sha256_sum":"3f25c3613d658ecdd7ee9b7777193ffb084ebe43e641f6daa3c3181f0b631c08","filesize":1061,"duplicate":false,"subflows":null}

Delete a file

Deletes a file. The file meta is left intact, but the file itself is removed from existence. Status is changed to "deleted".

PS: To REMOVE the data entirely, add ?remove_metadata=true to the url

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/files/{id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true}

Edit an existing file

Edit an active file with existing content (/upload) for first uploads. The file meta is left intact, except for the hash sums, sizing and timestamps. This function is meant to be used together with file categories to e.g. handle Detection rules.

Methods: PUT

curl -X POST 'https://uk.shuffle.security/api/v1/files/{id}/edit' \
  -H 'Authorization: Bearer APIKEY' \
  -d 'this is the new content of the file'

Success response

{"success": true}

Get file category

Gets all files in a namespace zipped. The point of this function is to be able to load in multiple files at once in order to e.g. run detections. By adding the query ids=true, it will instead give you a list of all the files. When receiveing file it will automatically deduplicate files with the same Sha256 hash.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/files/namespaces/{category}' \
  -H 'Authorization: Bearer APIKEY'

?id=true

{"success": True, "list": [{
	"name": "Filename",
	"id": "file_uuid",
},
{
	"name": "Filename2",
	"id": "file_uuid2",
}]}

Success response

<ZIPFILE WITH ALL FILES IN CATEGORY>

Triggers

Triggers in Shuffle have their own custom usage and APIs.

Get all schedules

Get all schedules

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/workflows/schedules' \
  -H 'Authorization: Bearer APIKEY'

Success response

[{"id":"cabaaffc-db53-4e19-ad8b-4f5fc0dc49c9","start_node":"","seconds":0,"workflow_id":"7b8ffd74-5e67-4700-bf79-751d1ac7e5e4","argument":"{\"start\":\"\",\"execution_source\":\"schedule\",\"execution_argument\":\"{\\\"example\\\": {\\\"json\\\": \\\"is cool\\\"}}\"}","wrapped_argument":"{\"start\":\"\",\"execution_source\":\"schedule\",\"execution_argument\":\"{\\\"example\\\": {\\\"json\\\": \\\"is cool\\\"}}\"}","appinfo":{"sourceapp":{"foldername":"","name":"","id":"","description":"","action":""},"destinationapp":{"foldername":"","name":"","id":"","description":"","action":""}},"finished":false,"base_app_location":"","org":"37217426-f794-429c-a0f9-548f7055af45","createdby":"","availability":"","creationtime":1641573762,"lastmodificationtime":1641573762,"lastruntime":1641573762,"frequency":"*/15 * * * *","environment":""}]

Schedule a workflow

Schedule a workflow to run at certain intervals. The node in the workflow must exist, and that the execution argument MUST be a string. May not update the ID within a workflow.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/workflows/{workflow_id}/schedule' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "name": "Schedule",
  "frequency": "*/25 * * * *",
  "execution_argument": "{\"example\": {\"json\": \"is cool\"}}",
  "environment": "cloud",
  "id": "cabaaffc-db53-4e19-ad8b-4f5fc0dc49c9"
}'

Success response

{"success":true}

Stop a workflow schedule

Stop a schedule from running

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/workflows/{workflow_id}/schedule/{schedule_id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true}

Create and start webhook

Start a new webhook

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/hooks' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "name": "Webhook_1",
  "type": "webhook",
  "id": "db434f8c-a9cb-47ec-abf8-ad8fb10e5809",
  "workflow": "7b8ffd74-5e67-4700-bf79-751d1ac7e5e4",
  "start": "6601f07f-92f2-45d3-88bf-328db7bfdfa0",
  "environment": "cloud",
  "auth": ""
}'

Additional info when RUNNING a webhook:

• You can add dynamic app authentication when running a webhook by using the following header: appauth. Example: appauth: jira=auth for jira;elasticsearch=elasticsearch auth. This works both with the name of the auth, and the ID.

Success response

{"success":true}

Delete and stop webhook

Stop a running webhook from being available

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/hooks/{webhook_id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true, "reason": "Stopped webhook"}

Notifications

Below are the API's associated with Notifications in Shuffle. These can be listed, marked as read, and cleared.

Create a notification

Notifications can be manually created, and will show up on the /admin?tab=priorities tab. This API is automatically utilized if you are running onprem with the Worker. This WILL trigger the notification workflow if it has been set up, and they will be grouped according to normal Notification control rules.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/notifications' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "YOUR ORGID",
  "title": "The title",
  "description": "The description of the notification",
  "reference_url": "URL for where to go when the user clicks explore"
}'

Success response

{"success":true}

Get all notifications

Get all notifications assigned to your user from your tenants.

Methods: GET

Available queries:

• status: open => only returns open
• type: agent_question => only returns notifications of type 'agent_question'
• severity: MEDIUM => only returns "MEDIUM" severity

Queries can be mixed for better filtering.

curl -X GET 'https://uk.shuffle.security/api/v1/notifications?status=open' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true,"notifications":[{"image":"","created_at":1638898114,"updated_at":1638898114,"title":"Error in Workflow \"Shuffle Workflow helloooo\"","description":"Node shuffle_tools_1 in Workflow Shuffle Workflow Winner announcement was found to have an error. Click to investigate","org_id":"","user_id":"","tags":null,"amount":1,"id":"057bf2b5-d29d-4bb4-bf2f-d8a6ee882dfe","reference_url":"/workflows/1693bf4a-b0f4-46dd-8257-448cbc6b0e9b?execution_id=74adf061-f949-4392-9e2d-1fd5e3381037\u0026view=executions\u0026node=ef683a39-4c2b-4c83-ad2d-d28a922e44b4","org_notification_id":"60a22356-1028-4226-b755-51804e3a25a2","dismissable":true,"personal":true,"read":false}]}

Mark all notifications as read

Clears all notifications

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/notifications/clear' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true}

Mark notification as read

Marks a single notification as read

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/notifications/{notificationId}/markasread' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success":true}

Environments

Below are the endpoints related to Runtime Locations (previously environments)

Get environments

Get user's active tenant's environments.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/getenvironments' \
  -H 'Authorization: Bearer APIKEY'

Ps: If you want to get the environments of another tenant, Please add in the Org-Id: {Org-Id} header.

It would return something like this:

[{
    "Name": "example",
    "Type": "onprem",
    "Registered": false,
    "default": false,
    "archived": true,
    "id": "{ID}",
    "org_id": "{ID}",
    "created": 1710253304,
    "edited": 1750766926,
    "checkin": 1716270170,
    "running_ip": "",
    "auth": "{AUTH}",
    "queue": 1,
    "orborus_uuid": "",
    "licensed": false,
    "run_type": "docker",
    "data_lake": {
        "enabled": false,
        "pipelines": null
    },
    "suborg_distribution": null
}]

Tenants

Below are the endpoints related to organization/tenant creation, editing, listing and more.

Get an Organization

Get an Organization by its ID

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/orgs/{org_id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"name":"Testing","description":"Description","company_type":"","image": "base64 image", "id":"583816e5-40ab-4212-8c7a-e54c8edd6b51","org":"new suborg","users":[],"role":"","roles":["admin","user"],"active_apps":["eb6b633ebbb77575ad17789eecf36cdf"],"cloud_sync":false,"cloud_sync_active":true,"sync_config":{"interval":0,"api_key":"","source":""},"sync_features": {}, "invites":null,"child_orgs":[],"manager_orgs":null,"creator_org":"PARENT_ORG_ID","disabled":false,"partner_info":{"reseller":false,"reseller_level":""},"sso_config":{"sso_entrypoint":"","sso_certificate":"","client_id":"","client_secret":"","openid_authorization":"","openid_token":""},"main_priority":"","region":"","region_url":"","tutorials":[], "org_auth": {"org_token": "", "expires": ""}} 

Create a Suborg

Creates an organization that will be the child of your current organization. Can not be done from a existing Child org. Required fields: org_id and name. OrgId needs to match your CURRENT organization.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{org_id}/create_sub_org' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "org_id",
  "name": "Child Org Name"
}'

Success response

{"success": true, "id": "<new org uuid>", "reason": "Successfully created new sub-org"}

Change current Organization

Shuffle is based on your CURRENT organization. This means you have to swap between your Organizations to get the the relevant information. If you want access to force the usage of another organization than your currently active one, use "Org-Id=<org_id>" as a Header. This is a further outlined in the Authentication section.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{CURRENT_ORG_ID}/change' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "ORG TO CHANGE TO"
}'

Success response

{"success": true, "reason": "Changed Organization", "region_url": "New API endpoint IF applicable"}

Generate SSO login link

Generate an SSO provision URL for user provisioning in partner organizations (For now. Please contact support@shuffler.io if you would like to use this API). This endpoint allows admin users in partner organizations to provision new users or generate login URLs for existing users.

Requirements:

• Admin role required in the target organization (or its parent organization for child orgs)
• Organization (or its parent) must be a partner (DistributionPartner, IntegrationPartner, ServicePartner, TechPartner, or ChannelPartner)
• Auto provision must be enabled
• SSO must be configured (OpenIdClientId and OpenIdToken required)

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/sso/link' \
  -H 'Authorization: Bearer APIKEY' \
  -H 'Org-Id: target_org_id' \
  -d '{
  "email": "user@example.com"
}'

Headers:

• Authorization: Bearer APIKEY (required) - Your API key for authentication
• Org-Id: target_org_id (optional) - Specify the organization to provision in. If not provided, uses your current active organization.

Request Body:

{
  "email": "user@example.com"
}

Success response for new user:

{
  "success": true,
  "sso_url": "https://auth.example.com/sso?state=...",
  "user_id": "uuid-of-created-user"
}

Success response for existing user:

{
  "success": true,
  "sso_url": "https://auth.example.com/sso?state=...",
  "existing_user": true,
  "sso_configured": true
}

Error responses:

Authentication required:

{"success": false, "reason": "Authentication required"}

Admin access required:

{"success": false, "reason": "Admin access required in the relevant org"}

Not a partner organization:

{"success": false, "reason": "Provisioning not allowed. We need a partner org for this."}

Auto provision disabled:

{"success": false, "reason": "Provisioning not allowed. Auto provision is disabled."}

SSO not configured:

{"success": false, "reason": "SSO not configured for this organization"}

Invalid email:

{"success": false, "reason": "Invalid email address"}

Restricted email domain:

{"success": false, "reason": "Cannot provision @shuffler.io email addresses"}

User already exists (not provisioned by this org):

{"success": false, "reason": "User already exists"}

What happens:

1. For new users: Creates a new user account, adds them to the organization, and returns an SSO setup URL
2. For existing users provisioned by this org:
   • If SSO is already configured: Returns a login URL
   • If SSO is not configured: Returns a setup URL to complete SSO configuration

Edit Organization

Edit an Organization. Each field is individually managed, except org_id which is required.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/orgs/{org_id}' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "org_id": "current org id",
  "name": "New Organization Name",
  "image": "Base64 image",
  "description": "New Description"
}'

Success response

{"success": true, "reason": "Changed Organization", "region_url": "New API endpoint IF applicable"}

List Organizations

Lists the available organizations to your account

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/orgs' \
  -H 'Authorization: Bearer APIKEY'

Success response

[{"name":"Testing","description":"Description","company_type":"","image": "base64 image", "id":"583816e5-40ab-4212-8c7a-e54c8edd6b51","org":"new suborg","users":[],"role":"","roles":["admin","user"],"active_apps":["eb6b633ebbb77575ad17789eecf36cdf"],"cloud_sync":false,"cloud_sync_active":true,"sync_config":{"interval":0,"api_key":"","source":""},"sync_features": {}, "invites":null,"child_orgs":[],"manager_orgs":null,"creator_org":"PARENT_ORG_ID","disabled":false,"partner_info":{"reseller":false,"reseller_level":""},"sso_config":{"sso_entrypoint":"","sso_certificate":"","client_id":"","client_secret":"","openid_authorization":"","openid_token":""},"main_priority":"","region":"","region_url":"","tutorials":[]}]

List Child Organizations

Lists the child organizations of a parent organization

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/orgs/{parentOrgId}/suborgs?cursor=<cursor>' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"cursor": "cursor", "parentOrg": {"name": "Parentorg_name", "id": "parentorg_id"}, "subOrgs": [{"name":"Testing","description":"Description","company_type":"","image": "base64 image", "id":"583816e5-40ab-4212-8c7a-e54c8edd6b51","org":"new suborg","users":[],"role":"","roles":["admin","user"],"active_apps":["eb6b633ebbb77575ad17789eecf36cdf"],"cloud_sync":false,"cloud_sync_active":true,"sync_config":{"interval":0,"api_key":"","source":""},"sync_features": {}, "invites":null,"child_orgs":[],"manager_orgs":null,"creator_org":"PARENT_ORG_ID","disabled":false,"partner_info":{"reseller":false,"reseller_level":""},"sso_config":{"sso_entrypoint":"","sso_certificate":"","client_id":"","client_secret":"","openid_authorization":"","openid_token":""},"main_priority":"","region":"","region_url":"","tutorials":[]}]}

Delete Organizations

Deletes an organization. Only possible for sub-organizations.

This requires you to have already removed all workflows, and will NOT clean up all the data in the database until it expires (3 months~) Only admins of the parent organization can delete a sub-organization.

Methods: DELETE

curl -X GET 'https://uk.shuffle.security/api/v1/orgs/{org_id}' \
  -H 'Authorization: Bearer APIKEY'

Success response

{"success": true}

Invite user to organization

Invites a user to join your organization. If the user doesn't exist, they will be created with a temporary password and invited via email. Only organization admins can invite users.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/register_org' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "username": "user@example.com"
}'

Alternative endpoint:

curl -X POST 'https://uk.shuffle.security/api/v1/users/register_org' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "username": "user@example.com"
}'

Requirements:

• You must be an admin of the organization to invite users
• The username must be a valid email address

What happens:

1. If the user doesn't exist in Shuffle:

   • A new user account is created
   • An invitation email is sent to the user with a link to join the organization

2. If the user already exists in Shuffle but not in your org:

   • The organization is added to the user's list of organizations
   • An invitation email is sent to the user with a link to join the organization

3. If the user already exists in your organization:

   • The user is already a member - no action is taken

Success response

{"success": true}

Error responses

Admin permission required:

{"success": false, "reason": "You don't have access to invite users to this organization"}

User already exists in organization:

{"success": false, "reason": "User already exist in this organization"}

Invalid email:

{"success": false, "reason": "Email is invalid"}

Important notes:

• The invite link format is: https://shuffler.io/invite?invite_id={userId}_{inviteId}&org_id={orgId}
• If the organization has SSO enabled, &sso=enabled is added to the invite link
• For new users, the region is automatically set to the organization's region.

Vulnerabilities

The Vulnerabilities API manages vulnerability data and provides CVE intelligence across Shuffle. It enables listing known vulnerabilities, creating or ingesting vulnerability records, and performing global searches by CVE identifier.

List vulnerabilities

Returns a list of tracked vulnerabilities.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/vulnerabilities' \
  -H 'Authorization: Bearer APIKEY'

Success response

{
  "success": true,
  "vulnerabilities": [
    {
      "id": "CVE-2024-3094",
      "title": "XZ Utils Backdoor",
      "severity": "CRITICAL",
      "score": 10.0
    }
  ]
}

Get vulnerability by CVE

Searches for a specific vulnerability by its CVE identifier. This is a global search for the vulnerability in general across the database, rather than being strictly tenant-specific.

Method: GET

curl -X GET 'https://uk.shuffle.security/api/v1/vulnerabilities/CVE-2024-3094'

Success response

{
  "success": true,
  "id": "CVE-2024-3094",
  "title": "XZ Utils Backdoor",
  "description": "Malicious code discovered in upstream tarballs of xz.",
  "severity": "CRITICAL",
  "cvss_score": 10.0
}

Create vulnerability

Creates or ingests a new vulnerability record.

Method: POST

curl -X POST 'https://uk.shuffle.security/api/v1/vulnerabilities' \
  -H 'Authorization: Bearer APIKEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "id": "CVE-2024-3094",
  "title": "XZ Utils Backdoor",
  "severity": "CRITICAL",
  "description": "Malicious code discovered in upstream tarballs of xz."
}'

Success response

{
  "success": true
}

Detection API

Below are the endpoints related to manage detections in the Shuffle platform. The Detection APIs are based on the File API in Shuffle, but has some custom management interfaces to make it easier to use. The primary area this is currently used heavily is in Shuffle Security.

The detection system is both used for internal Detection, as well as for distributed third party detection management in multiple environments simultaneously.

If you want to know more about these endpoints, reach out to support@shuffler.io.

Singul

The Integration Layer of Shuffle, also named Singul, is a way to interact with apps a new way. It utilizes Apps and MCPs that are auto-generated, auto-Categorized and auto-Labeled, and gives access to API's for specific actions for each of those labels. The integration layer is based on Shuffle's Schemaless translation technology, with the goal of making Shuffle able to act as a Large Action Model (LAM).

A frontend library is also available to handle integrations in your own platform. Learn more here.

Shufflepy

The easiest way to try it out for developer is to use the Shufflepy library.

from shufflepy import Shuffle

## If the url is not specified, the library will use `https://shuffler.io` as the default URL. You must specify an apikey. 

shuffle = Singul("APIKEY")
resp = shuffle.list_tickets("jira")

Run a Category Action

Runs the category action in a standardized format.

Methods: POST

curl -X POST 'https://uk.shuffle.security/api/v1/apps/categories/run' \
  -H 'Authorization: Bearer APIKEY' \
  -d '{
  "app_name": "PagerDuty",
  "category": "cases",
  "label": "create_ticket",
  "fields": [
    {
      "key": "title",
      "value": "This is the title"
    },
    {
      "key": "description",
      "value": "This is the description"
    },
    {
      "key": "source",
      "value": "Shuffle"
    }
  ],
  "skip_workflow": true
}'

Success response 200 means the app ran and performed both input and output translation properly

Default Label Output

202 means the app ran, but the output translation failed. This will return the DEFAULT output of the action that ran.

Other status codes: They are based on the API from the app itself, and indicates something went wrong.

Get Active Categories

To find what categories with what apps you have that are active, run this API. It will return with what categories and actions for those categories you have available. This is based on the current organization.

Methods: GET

curl -X GET 'https://uk.shuffle.security/api/v1/apps/categories' \
  -H 'Authorization: Bearer APIKEY'

Success response

[{
	"name":"Cases",
	"color":"",
	"icon":"cases",
	"action_labels":["Create ticket"],
	"app_labels": [{
		"app_name":"PagerDuty",
		"large_image":"",
		"id":"50af6d9f18134b90aabca9180b37ea01",
		"labels": [{
			"category":"Cases",
			"label":"Create ticket"
		}]
	}]
}]

How to debug Singul executions

• Go to https://shuffler.io/workflows/debug
• You should see something like this:

As you can see, I triggered this Singul execution through the Singul app (not the SDK). However, even if you were using the SDK, you would find such executions.

• Click on the button below "Explore":

• You will see the full result of the execution. Click on the arrow

• To see the body that Singul translated to, scroll and find the "Body"

Based on the output, and the input mentioned in "Body", you should be able to figure out what is going on here.