# Alibaba Cloud Secure Access Service Edge - Endpoint Protection API

> Alibaba Cloud Secure Access Service Edge - Endpoint Protection API on Apizie: 5 endpoints (Queries security alert types, Queries the handling operations, operability, and whitelist rule configurations for a specified endpoint…, Queries endpoint security alerts and supports filtering by alert, endpoint, and processing status, Handles security alert events, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-csasedr`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/csasedr
- Page: https://zieapi.vercel.app/api/cloud/aliyun-csasedr
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-csasedr/openapi.json

Alibaba Cloud OpenAPI for Secure Access Service Edge - Endpoint Protection (csasedr, version 2024-11-22). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Queries security alert types
`POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/describe-nsas-susp-event-type` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com |
| SourceIp | string | no | The source IP address |
| Remark | string | no | The name or IP address of the server |
| Name | string | no | The name of the security alert type |
| Lang | string | no | The language of the request and response messages. Default value: zh. Valid values: zh: Chinese en: English |
| Uuids | string | no | The UUIDs of the servers. Separate multiple UUIDs with commas (,) |
| ContainerFieldName | string | no | The container field. This parameter is not supported by SASE-EDR |
| ContainerFieldValue | string | no | The value of the container field. This parameter is not supported by SASE-EDR |

### Queries the handling operations, operability, and whitelist rule configurations for a specified endpoint…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/describe-security-event-operations` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com |
| SecurityEventId | integer | yes | The ID of the security alert event to be handled |

### Queries endpoint security alerts and supports filtering by alert, endpoint, and processing status
`POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/describe-susp-events` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com |
| Department | string | no | The department to which the user belongs |
| HostName | string | no | The name of the endpoint device |
| SrcIp | string | no | The IP address of the endpoint |
| UserName | string | no | The username of the endpoint |
| SourceIp | string | no | The IP address of the access source |
| Dealed | string | no | Filters alerts by processing group. Valid values: `N`: Pending. `Y`: Processed. `A`: All. If this parameter is not specified, all groups… |
| Name | string | no | The name of the asset affected by the alert event |
| Levels | string | no | The urgency levels of the alert events to query. Separate multiple urgency levels with commas (,). The urgency levels are listed in… |
| ParentEventTypes | string | no | The internal type identifiers of the alerts. Separate multiple types with commas (,). The valid values are derived from the current alert… |
| EventNames | string | no | The internal subtype identifiers of the alerts. Separate multiple subtypes with commas (,). This parameter is used to match event names.… |
| Remark | string | no | The alert name or asset information to query. Note: Fuzzy match is supported. Asset information includes the asset name, public IP… |
| Status | string | no | Further filters alerts by individual alert status within the processing group specified by the Dealed parameter. Status descriptions: `0`:… |
| PageSize | integer | no | The number of alert events to return on each page in a paging query. Default value: 20. Maximum value: 100 |
| CurrentPage | integer | no | The page number of the returned page. Default value: 1 |
| Lang | string | no | The language of the request and response. Default value: zh. Valid values: zh: Chinese. en: English |
| AlarmUniqueInfo | string | no | The unique ID of the alert event. To query the exception event information of a single alert event, you must provide the unique ID of the… |
| UniqueInfo | string | no | The unique key of the security alert |
| Id | integer | no | The unique ID of the recorded alert event |
| Source | string | no | The compatibility source classification parameter. This parameter is not used to specify the alert data source. You do not need to specify… |
| GroupId | integer | no | The ID of the group to which the asset affected by the alert event belongs |
| Uuids | string | no | The UUIDs of the servers for which you want to query alerts. Separate multiple UUIDs with commas (,) |
| ClusterId | string | no | The ID of the cluster for which you want to query alert events |
| ContainerFieldName | string | no | The container search field. Not supported by SASE-EDR |
| ContainerFieldValue | string | no | The value of the container search field. Not supported by SASE-EDR |
| TargetType | string | no | The container search target type. Not supported by SASE-EDR |
| TacticId | string | no | The ATT&CK tactic ID |
| OperateErrorCodeList | string | no | The collection of alert event processing result codes (JSON-encoded) |
| OperateTimeStart | string | no | The start time of the alert processing time. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format |
| OperateTimeEnd | string | no | The end time of the alert processing time. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format |
| TimeStart | string | no | The start time of the latest occurrence. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format |
| TimeEnd | string | no | The end time of the latest occurrence. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format |
| SortColumn | string | no | The custom sort field. Default value: operateTime. Valid values: lastTime: Latest occurrence time. operateTime: Processing time. This… |
| SortType | string | no | The custom sort order. Default value: desc. Valid values: asc: Ascending order. desc: Descending order. This field takes effect only when… |
| AssetsTypeList | string | no | The collection of asset types. Not supported by SASE-EDR (JSON-encoded) |
| StrictMode | string | no | Specifies whether the alert is in strict mode. Not supported by SASE-EDR |
| AlarmEventName | string | no | The name of the alert event |
| InnerIp | string | no | The private IP address of the endpoint device |

### Handles security alert events
`POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/handle-security-events` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com |
| SecurityEventIds | string | yes | The IDs of the security alert events to handle (JSON-encoded) |
| OperationCode | string | yes | The operation code for handling the endpoint alert. Valid values: advance_mark_mis_info: Adds to the advanced whitelist.… |
| OperationParams | string | no | The operation parameters, represented as a JSON object string. If this parameter is not passed or an empty string is passed, the backend… |
| MarkMissParam | string | no | The JSON array string used when adding an advanced whitelist or precise defense whitelist rule. This parameter applies only when… |
| MarkBatch | string | no | Specifies whether to add to the whitelist in batches. Valid values: true: Yes. false: No |
| Remark | string | no | The remark for the handling operation |

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/describe-nsas-susp-event-type" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Secure Access Service Edge - Endpoint Protection API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-csasedr/describe-nsas-susp-event-type with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Secure Access Service Edge - Endpoint Protection API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Secure Access Service Edge - Endpoint Protection itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Secure Access Service Edge - Endpoint Protection API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-csasedr.

### What is the status of the Alibaba Cloud Secure Access Service Edge - Endpoint Protection API?
Needs your own provider key (bring your own key)