OpenGraph API - SpecterOps

Use these BloodHound API operations when developing OpenGraph extensions. The saved-query operations also support queries created outside extensions; their extension-specific behavior is described below.

API endpoints

Method	Endpoint	Purpose
`POST`	/api/v2/custom-nodes	Create a new custom node type with configuration.
`GET`	/api/v2/custom-nodes	Get all custom node types and their configurations.
`GET`	/api/v2/custom-nodes/{kind_name}	Get configuration for a specific node type.
`PUT`	/api/v2/custom-nodes/{kind_name}	Update the configuration of an existing node type.
`DELETE`	/api/v2/custom-nodes/{kind_name}	Delete a custom node type.
`POST`	/api/v2/clear-database	Delete selected BloodHound data, including targeted graph data such as HasSession edges.
`GET`	/api/v2/extensions	Get a list of all OpenGraph extensions.
`PUT`	/api/v2/extensions	Install or update an extension using a schema JSON payload or an extension bundle containing `schema.json` and optional `pz_rules.json` and `saved_queries.json` files.
`DELETE`	/api/v2/extensions/{extension_id}	Delete an OpenGraph extension.
`GET`	/api/v2/extensions-edges	Get a list of all edge kinds across OpenGraph schemas.
`GET`	/api/v2/nodes/{node_id}	Get details of a specific node by its graph-assigned integer ID.
`GET`	/api/v2/relationships/{relationship_id}	Get details of a specific relationship by its graph-assigned integer ID.

Saved-query operations

These general saved-query operations also apply to extension-managed queries. Extension-managed queries are read-only, including for administrators. Manage their contents through the extension bundle. Deleting the extension also removes its queries.

Method	Endpoint	General purpose	Extension-managed query behavior
`GET`	`/api/v2/saved-queries`	List saved queries accessible to the current user.	Use `scope=all` or `scope=public` to include extension-managed queries, identified in the response by `scope: "extension"`. Filter by `extension_id` to find queries for a specific extension.
`GET`	`/api/v2/saved-queries/{saved_query_id}`	Retrieve a saved query by ID.	Returns the query, including the `extension_id` that identifies its managing extension.
`PUT`	`/api/v2/saved-queries/{saved_query_id}`	Update a saved query.	Rejects updates to extension-managed queries. Publish changes in an updated extension bundle.
`DELETE`	`/api/v2/saved-queries/{saved_query_id}`	Delete a saved query.	Rejects deletion of extension-managed queries. Omit the query from an updated bundle or delete the extension to remove it.