{"openapi":"3.1.0","info":{"title":"Rapid7 Insight IDR (BYOK) API","version":"0.1.0","description":"Rapid7 Insight IDR (BYOK) lets an AI assistant read your own Rapid7 Insight IDR data through the Rapid7 Insight IDR API with a key you supply (Rapid7 Insight platform API key (user or organization key)). Read-only: 6 tools (list_investigations, get_investigation, list_investigation_alerts, list_rapid7_product_alerts, get_health_metrics, search_assets). The BYOK key travels with each request, is...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-rapid7-insightidr.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-rapid7-insightidr/docs"},"termsOfService":"https://connectorbay.com/byok-rapid7-insightidr/terms"},"servers":[{"url":"https://byok-rapid7-insightidr.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-rapid7-insightidr/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_investigations":{"post":{"operationId":"list_investigations","summary":"List InsightIDR investigations with title, source, status, priority, disposition, tags and timestamps; filter by status,","description":"List InsightIDR investigations with title, source, status, priority, disposition, tags and timestamps; filter by status, source, priority, tags or opened time. Defaults to the last 28 days. Use for \"Which high priority InsightIDR investigations are open\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"statuses":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Comma-separated statuses to include: OPEN, INVESTIGATING, CLOSED.","title":"Statuses"},"priorities":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Comma-separated priorities to include: CRITICAL, HIGH, MEDIUM, LOW, UNSPECIFIED.","title":"Priorities"},"sources":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Comma-separated sources to include: MANUAL, HUNT, ALERT.","title":"Sources"},"tags":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Comma-separated tags; only investigations carrying them are returned.","title":"Tags"},"start_time":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only investigations opened at or after this ISO 8601 time, for example 2026-10-01T00:00:00Z.","title":"Start Time"},"end_time":{"anyOf":[{"maxLength":40,"type":"string"},{"type":"null"}],"default":null,"description":"Only investigations closed at or before this ISO 8601 time.","title":"End Time"},"sort":{"anyOf":[{"maxLength":60,"type":"string"},{"type":"null"}],"default":null,"description":"Sort as field,DIRECTION, for example priority,DESC (the default).","title":"Sort"},"index":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Index"},"size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"Items per page (1 to 100).","title":"Size"}},"required":["region"],"title":"list_investigationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_investigation":{"post":{"operationId":"get_investigation","summary":"Get one investigation: title, source, status, priority, disposition, tags and timestamps. Use for \"What is the status an","description":"Get one investigation: title, source, status, priority, disposition, tags and timestamps. Use for \"What is the status and priority of InsightIDR investigation 174e4f99\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"investigation_id":{"description":"Investigation id (the last part of the investigation rrn, for example 6A74T2A4) or its full rrn.","maxLength":200,"title":"Investigation Id","type":"string"}},"required":["region","investigation_id"],"title":"get_investigationArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_investigation_alerts":{"post":{"operationId":"list_investigation_alerts","summary":"List the alerts attached to an investigation with title, type, detection rule name and event times. Use for \"Which alert","description":"List the alerts attached to an investigation with title, type, detection rule name and event times. Use for \"Which alerts are part of InsightIDR investigation 174e4f99\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"investigation_id":{"description":"Investigation id (the last part of the investigation rrn, for example 6A74T2A4) or its full rrn.","maxLength":200,"title":"Investigation Id","type":"string"},"index":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Index"},"size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"Items per page (1 to 100).","title":"Size"}},"required":["region","investigation_id"],"title":"list_investigation_alertsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_rapid7_product_alerts":{"post":{"operationId":"list_rapid7_product_alerts","summary":"List alerts from other Rapid7 products (Threat Command, Insight Agent and others) linked to an investigation, with produ","description":"List alerts from other Rapid7 products (Threat Command, Insight Agent and others) linked to an investigation, with product, title, severity and a link. Use for \"Which other Rapid7 product alerts are linked to InsightIDR investigation 174e4f99\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"investigation_id":{"description":"Investigation id (the last part of the investigation rrn, for example 6A74T2A4) or its full rrn.","maxLength":200,"title":"Investigation Id","type":"string"}},"required":["region","investigation_id"],"title":"list_rapid7_product_alertsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_health_metrics":{"post":{"operationId":"get_health_metrics","summary":"Show health of InsightIDR data sources by resource type (agents, collectors, event sources, sensors, scan engines and ot","description":"Show health of InsightIDR data sources by resource type (agents, collectors, event sources, sensors, scan engines and others) as returned by the platform. Use for \"Are my InsightIDR collectors and event sources healthy\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"resource_types":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Comma-separated resource types to include, for example collectors,event_sources.","title":"Resource Types"},"with_epm":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"description":"True to include events per minute for event sources.","title":"With Epm"},"index":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Index"},"size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"Items per page (1 to 100).","title":"Size"}},"required":["region"],"title":"get_health_metricsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/search_assets":{"post":{"operationId":"search_assets","summary":"Search InsightIDR assets by name (contains match) and return their rrn and name. Asset names can be host names. Use for ","description":"Search InsightIDR assets by name (contains match) and return their rrn and name. Asset names can be host names. Use for \"Which InsightIDR assets have 'web' in their name\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"region":{"description":"Rapid7 region code of your data: us, us2, us3, eu, ca, au, ap, aps2 or me1 (the first part of your Insight platform URL).","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Region","type":"string"},"name_contains":{"description":"Text that the asset name must contain (case-insensitive).","maxLength":100,"title":"Name Contains","type":"string"},"index":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Page number, starting at 0.","title":"Index"},"size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"Items per page (1 to 100).","title":"Size"}},"required":["region","name_contains"],"title":"search_assetsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}