Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.

Skip to main content

SpecterOps home page

Support
Contact Us
Contact Us

Home

BloodHound

API Reference

Webinars
Community
Query Library
OpenGraph Library
Blog

Get Started

Use the BloodHound API

Auth

POST
Login to BloodHound
POST
Logout of BloodHound
GET
Get self
GET
List SAML Providers
GET
Get all SAML sign on endpoints
POST
Create a New SAML Provider from Metadata
GET
Get SAML Provider
DEL
Delete a SAML Provider
GET
List SSO Providers
POST
Create OIDC Provider
POST
Create a New SAML Provider from Metadata
DEL
Delete SSO Provider
PATCH
Update SSO Provider
GET
Get SAML Provider Signing Certificate

Permissions

GET
List Permissions
GET
Get Permission

Roles

GET
List Roles
GET
Get Role

API Tokens

GET
List Auth Tokens
POST
Create Token for User
DEL
Delete a User Token

BloodHound Users

GET
List Users
POST
Create a New User
GET
Get a user
DEL
Delete a User
PATCH
Update a User
PUT
Create or Set User Secret
DEL
Expire User Secret
POST
Enrolls user in multi-factor authentication
DEL
Unenroll user from multi-factor authentication
GET
Returns MFA activation status for a user
POST
Activates MFA for an enrolled user

Collectors

GET
Get collector manifest
GET
Get collector download by version
GET
Get collector checksum by version
GET
Download asset
GET
Get kennel enterprise manifest
GET
Get kennel manifest

Collection Uploads

GET
List File Upload Jobs
POST
Create File Upload Job
POST
Upload File To Job
POST
End File Upload Job
GET
List accepted file upload types

API Info

GET
Get API version
GET
Get API Spec

Search

GET
Search for objects
GET
Get available domains

Audit

GET
List audit logs

Config

GET
List application config parameters
PUT
Write application configuration parameters
GET
List feature flags
PUT
Toggle a feature flag's enabled status to either enable or disable it.

Asset Isolation

GET
List all asset isolation groups
POST
Create an asset group
POST
Create Asset Group Tag Selector
GET
Get Asset Group Tag
GET
Get Asset Group Tags
GET
Get asset group by ID
GET
List asset group tag members by ID
GET
Get Asset Group Tag Selector
GET
Get Asset Group Tag selectors
GET
Get asset group tag selectors of a specific object by member id
GET
List asset group tag member count by kind
GET
List asset group tag members by selector
GET
List asset group collections
POST
Preview Selectors
PUT
Update an asset group
PUT
Update asset group selectors
POST
Update asset group selectors
PATCH
Update Asset Group Tag Selector
DEL
Delete an asset group
DEL
Delete an asset group selector
DEL
Delete Asset Group Tag Selector
GET
Get asset group custom member count
GET
List all asset isolation group members
POST
Create Asset Group Tag
DEL
Delete an Asset Group Tag
GET
Get history records
GET
List asset group member count by kind
POST
Search Asset Group Tags
PATCH
Update Asset Group Tag

Graph

GET
Get kinds
GET
Get pathfinding result
GET
Get search result
GET
Get the shortest path graph
GET
Get path composition
GET
Get relay targets
GET
Get ACL inheritance path

Cypher

GET
List saved queries
POST
Create a saved query
PUT
Update a saved query
DEL
Delete a saved query
PUT
Share a saved query or set it to public
DEL
Revokes permission of a saved query from users
POST
Run a cypher query

Azure Entities

GET
Get Azure entity

AD Base Entities

GET
Get entity info
GET
Get entity controllables
GET
Get entity controllers

Computers

GET
Get computer entity info
GET
Get computer entity admin rights
GET
Get computer entity admins
GET
Get computer entity constrained delegation rights
GET
Get computer entity constrained users
GET
Get computer entity controllables
GET
Get computer entity controllers
GET
Get computer entity DCOM rights
GET
Get computer entity DCOM users
GET
Get computer entity group membership
GET
Get computer entity remote PowerShell rights
GET
Get computer entity remote PowerShell users
GET
Get computer entity RDP rights
GET
Get computer entity RDP users
GET
Get computer entity sessions
GET
Get computer entity SQL admins

Containers

GET
Get container entity info
GET
Get container entity controllers

Domains

GET
Get domain entity info
PATCH
Update the Domain entity
GET
Get domain entity computers
GET
Get domain entity controllers
GET
Get domain entity DC Syncers
GET
Get domain entity foreign admins
GET
Get domain entity foreign GPO controllers
GET
Get domain entity foregin groups
GET
Get domain entity foreign users
GET
Get domain entity GPOs
GET
Get domain entity groups
GET
Get domain entity inbound trusts
GET
Get domain entity linked GPOs
GET
Get domain entity OUs
GET
Get domain entity outbound trusts
GET
Get domain entity users

GPOs

GET
Get GPO entity info
GET
Get GPO entity computer
GET
Get GPO entity controllers
GET
Get GPO entity OUs
GET
Get GPO entity tier-zero
GET
Get GPO entity users

AIA CAs

GET
Get AIA CA entity info
GET
Get AIA CA entity controllers

Root CAs

GET
Get Root CA entity info
GET
Get Root CA entity controllers

Enterprise CAs

GET
Get Enterprise CA entity info
GET
Get Enterprise CA entity controllers

NT Auth Stores

GET
Get NT Auth Store entity info
GET
Get NT Auth Store entity controllers

Cert Templates

GET
Get Cert Template entity info
GET
Get Cert Template entity controllers

OUs

GET
Get OU entity info
GET
Get OU entity computers
GET
Get OU entity GPOs
GET
Get OU entity groups
GET
Get OU entity users

AD Users

GET
Get User entity info
GET
Get User entity admin rights
GET
Get User entity constrained delegation rights
GET
Get User entity controllables
GET
Get User entity controllers
GET
Get User entity DCOM rights
GET
Get User entity membership
GET
Get User entity PowerShell remote rights
GET
Get User entity RDP rights
GET
Get User entity sessions
GET
Get User entity SQL admin rights

Groups

GET
Get Group entity info
GET
Get Group entity admin rights
GET
Get Group entity controllables
GET
Get Group entity controllers
GET
Get Group entity DCOMRights
GET
Get Group entity members
GET
Get Group entity memberships
GET
Get Group entity PowerShell remote rights
GET
Get Group entity RDP rights
GET
Get Group entity sessions

Data Quality

GET
Get database completeness stats
GET
Get AD domain data quality stats
GET
Get Azure tenant data quality stats
GET
Get platform data quality aggregate

Database

POST
Delete your BloodHound data

Datapipe

GET
Get datapipe status
PUT
Start analysis

EULA

PUT
Accept EULA

Analysis

GET
Get latest tier zero combo node
GET
Get the graph for meta tree
GET
Get the combo tree for an asset group

Client Ingest

POST
Endpoint for data ingestion

Clients

GET
List Clients
POST
Create Client
POST
Client Error
PUT
Update Client Values
GET
Get Client
PUT
Update Client
DEL
Delete Client
PUT
Regenerate the authentication token for a client
GET
List all completed tasks for a client
GET
List all completed jobs for a client
POST
Creates a scheduled task
POST
Creates a scheduled job

Jobs

GET
List available client jobs
GET
List finished jobs
GET
Get jobs
GET
Get client current job
POST
Notifies the API of a job start
POST
Notifies the API of a job ending
GET
Get client job
PUT
Cancels a scheduled job
GET
Get Job Log File

Events (Schedules)

GET
List events
POST
Create Event
GET
Get Event
PUT
Update Event
DEL
Delete Event

Attack Paths

GET
Export attack path findings
GET
Get all attack path findings
GET
List all attack path types
PUT
Start analysis
GET
List available attack paths
GET
List domain attack paths details
GET
List attack path sparkline values
GET
List finding trends
PUT
Update attack path risk

Risk Posture

GET
Get Posture Statistics
GET
Get Posture History

Meta Entities

GET
Get Meta entity info

Auth

Delete a SAML Provider

Deprecated: This endpoint will no longer be supported in a future release. Please use DELETE /api/v2/sso-providers/{sso_provider_id} instead.

Get SAML Provider

List SSO Providers

x website github linkedin slack instagram youtube