Get Started
Auth
- POSTLogin to BloodHound
- POSTLogout of BloodHound
- GETGet self
- GETList SAML Providers
- GETGet all SAML sign on endpoints
- POSTCreate a New SAML Provider from Metadata
- GETGet SAML Provider
- DELDelete a SAML Provider
- GETList SSO Providers
- POSTCreate OIDC Provider
- POSTCreate a New SAML Provider from Metadata
- DELDelete SSO Provider
- PATCHUpdate SSO Provider
- GETGet SAML Provider Signing Certificate
Permissions
BloodHound Users
- GETList Users
- GETList Users Minimal
- POSTCreate a New User
- GETGet a user
- DELDelete a User
- PATCHUpdate a User
- PUTCreate or Set User Secret
- DELExpire User Secret
- POSTEnrolls user in multi-factor authentication
- DELUnenroll user from multi-factor authentication
- GETReturns MFA activation status for a user
- POSTActivates MFA for an enrolled user
Collectors
Collection Uploads
Custom Node Management
Audit
Config
Asset Isolation
- GETList all asset isolation groups
- POSTCreate an asset group
- POSTCreate Asset Group Tag Selector
- GETGet Asset Group Tag
- GETGet Asset Group Tags
- GETGet asset group by ID
- GETList asset group tag members by ID
- GETGet Asset Group Tag Selector
- GETGet Asset Group Tag selectors
- GETGet asset group tag selectors of a specific object by member id
- GETList asset group tag member count by kind
- GETList asset group tag members by selector
- GETList asset group tag selector member count by kind
- GETList asset group collections
- POSTPreview Selectors
- PUTUpdate an asset group
- PUTUpdate asset group selectors
- POSTUpdate asset group selectors
- PATCHUpdate Asset Group Tag Selector
- DELDelete an asset group
- DELDelete an asset group selector
- DELDelete Asset Group Tag Selector
- GETGet asset group custom member count
- GETList all asset isolation group members
- POSTCreate Asset Group Tag
- DELDelete an Asset Group Tag
- GETGet history records
- POSTSearch history records
- GETList asset group member count by kind
- POSTSearch Asset Group Tags
- PATCHUpdate Asset Group Tag
- GETGet certifications for privilege zones
- POSTCertify or Revoke Certification of Objects
Graph
OpenGraph (Experimental)
Cypher
- GETList saved queries
- GETExport a saved query
- GETExport one or more saved queries
- POSTImport one or more cypher queries.
- POSTCreate a saved query
- PUTUpdate a saved query
- DELDelete a saved query
- PUTShare a saved query or set it to public
- DELRevokes permission of a saved query from users
- POSTRun a cypher query
Azure Entities
Computers
- GETGet computer entity info
- GETGet computer entity admin rights
- GETGet computer entity admins
- GETGet computer entity constrained delegation rights
- GETGet computer entity constrained users
- GETGet computer entity controllables
- GETGet computer entity controllers
- GETGet computer entity DCOM rights
- GETGet computer entity DCOM users
- GETGet computer entity group membership
- GETGet computer entity remote PowerShell rights
- GETGet computer entity remote PowerShell users
- GETGet computer entity RDP rights
- GETGet computer entity RDP users
- GETGet computer entity sessions
- GETGet computer entity SQL admins
Domains
- GETGet domain entity info
- PATCHUpdate the Domain entity
- GETGet domain entity computers
- GETGet domain entity controllers
- GETGet domain entity DC Syncers
- GETGet domain entity foreign admins
- GETGet domain entity foreign GPO controllers
- GETGet domain entity foregin groups
- GETGet domain entity foreign users
- GETGet domain entity GPOs
- GETGet domain entity groups
- GETGet domain entity inbound trusts
- GETGet domain entity linked GPOs
- GETGet domain entity OUs
- GETGet domain entity outbound trusts
- GETGet domain entity users
- GETGet ADCS escalations of Domain entity
GPOs
AIA CAs
Root CAs
Enterprise CAs
NT Auth Stores
Cert Templates
OUs
AD Users
- GETGet User entity info
- GETGet User entity admin rights
- GETGet User entity constrained delegation rights
- GETGet User entity controllables
- GETGet User entity controllers
- GETGet User entity DCOM rights
- GETGet User entity membership
- GETGet User entity PowerShell remote rights
- GETGet User entity RDP rights
- GETGet User entity sessions
- GETGet User entity SQL admin rights
Groups
- GETGet Group entity info
- GETGet Group entity admin rights
- GETGet Group entity controllables
- GETGet Group entity controllers
- GETGet Group entity DCOMRights
- GETGet Group entity members
- GETGet Group entity memberships
- GETGet Group entity PowerShell remote rights
- GETGet Group entity RDP rights
- GETGet Group entity sessions
Data Quality
Database
Datapipe
EULA
Analysis
Client Ingest
Clients
- GETList Clients
- POSTCreate Client
- POSTClient Error
- PUTUpdate Client Values
- GETGet Client
- PUTUpdate Client
- DELDelete Client
- PUTRegenerate the authentication token for a client
- GETList all completed tasks for a client
- GETList all completed jobs for a client
- POSTCreates a scheduled task
- POSTCreates a scheduled job
Jobs
Tasks
- GETList available client tasksdeprecated
- GETList finished tasksdeprecated
- GETGet tasksdeprecated
- GETGet client current taskdeprecated
- POSTNotifies the API of a task startdeprecated
- POSTNotifies the API of a task endingdeprecated
- GETGet client taskdeprecated
- PUTCancels a scheduled taskdeprecated
- GETGet Task Log Filedeprecated
Events (Schedules)
Attack Paths
Risk Posture
Meta Entities
Get API Spec
curl --request GET \
--url https://your-tenant.bloodhoundenterprise.io/api/v2/spec"openapi: 3.0.3\nservers:\n - url: /\n...[truncated example]\n"API Info
Get API Spec
Returns an Open API 3.0 compatible BloodHound API spec
GET
/
api
/
v2
/
spec
Get API Spec
curl --request GET \
--url https://your-tenant.bloodhoundenterprise.io/api/v2/spec"openapi: 3.0.3\nservers:\n - url: /\n...[truncated example]\n"Documentation Index
Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
Use this file to discover all available pages before exploring further.
Headers
Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Passing in wait=-1 bypasses all timeout limits when the feature is enabled.
Pattern:
^wait=(-1|[0-9]+)$Response
OK
The response is of type file.
⌘I
Assistant
Responses are generated using AI and may contain mistakes.