API Tokens

Netskope Cloud Exchange exposes a REST API to enable nearly every equivalent GUI command to be programmatically triggered. However, each REST API call requires valid credentials. Users who are given API access will be able to create a Client ID and Client Secret. Note, this is NOT the same API token that you use for communicating with your Netskope tenant.

You can create API tokens by going to Settings > Users and clicking on the API Tokens tab.

After the tokens are created, copy them and return to the Configure New Tenant page. Please note, a v1 token is required for adding a Netskope tenant in Cloud Exchange but will not be used if a v2 endpoint is available.

You can use the iterator API endpoint by enabling the toggle button Use Iterator Endpoint. The toggle button will only be accessible if you have a provided a v2 token. If you opt for the Iterator API endpoints, all the Threat IoCs, Alerts, and Events will be fetched by the Iterator API endpoints. You have to provide access to the above mentioned API endpoints while generating the v2 API token.

To view the API documentation in Swagger, click Help in the bottom of the left nav and select API docs.

Click the caret icon to view endpoint information.

The Cloud Exchange platform REST API scopes are explained in the following sections.

5.0.1 REST API

v1 REST API Scopes

Netskope Endpoint Permissions	Privilege Level	Log Shipper (CLS)	Ticket Orchestrator (CTO)	Threat Exchange (CTE)	User Risk Exchange (URE)	App Risk Exchange (ARE)
/api/v1/updateFileHashList	Read + Write (v1 default)			x

v2 REST API Scopes

Netskope Endpoint Permissions	Privilege Level	Log Shipper (CLS)	Ticket Orchestrator (CTO)	Threat Exchange (CTE)	User Risk Exchange (URE)	App Risk Exchange (ARE)
/api/v2/events/dataexport/events/alert	Read
/api/v2/events/dataexport/events/application	Read	x				x
/api/v2/events/dataexport/events/audit	Read	x
/api/v2/events/dataexport/events/connection	Not polled
/api/v2/events/dataexport/events/incident	Read	x
/api/v2/events/dataexport/events/infrastructure	Read	x
/api/v2/events/dataexport/events/network	Read	x
/api/v2/events/dataexport/events/page	Read	x
/api/v2/events/dataexport/alerts/uba	Read	x	x		x
/api/v2/events/dataexport/alerts/securityassessment	Read	x	x
/api/v2/events/dataexport/alerts/quarantine	Read	x	x
/api/v2/events/dataexport/alerts/remediation	Read	x	x
/api/v2/events/dataexport/alerts/policy	Read	x	x
/api/v2/events/dataexport/alerts/malware	Read	x	x	x
/api/v2/events/dataexport/alerts/malsite	Read	x	x	x
/api/v2/events/dataexport/alerts/compromisedcredential	Read	x	x
/api/v2/events/dataexport/alerts/ctep (or ips)	Read	x	x
/api/v2/events/dataexport/alerts/dlp	Read	x	x
/api/v2/events/dataexport/alerts/watchlist	Read	x	x
/api/v2/policy/urllist/file	Read + Write
/api/v2/policy/urllist	Read + Write			x
/api/v2/policy/urllist/deploy	Read + Write			x
/api/v2/incidents/uba/getuci	Read + Write				x
/api/v2/ubadatasvc/user/uci	Read + Write				x
/api/v2/services/cci/app	Read					x
/api/v2/services/cci/domain	Read					x
/api/v2/services/cci/tags	Read					x
/api/v2/infrastructure/publishers	Read + Write			x
/api/v2/steering/apps/private/tags	Read + Write			x
/api/v2/steering/apps/private	Read + Write			x