# =============================================================================
# Integration manifest template — copy to integrations/<id>/manifest.yaml
# This file is named *.example.yaml on purpose so Riposte never ingests it
# (only files named exactly "manifest.yaml" are picked up).
# =============================================================================

id: example_integration          # required · unique slug · [a-z0-9_]
name: Example Integration        # required · shown in the UI
version: 1.0.0                   # semver · bump on every change
description: One-line description of what this integration does.
category: enrichment             # free text: enrichment | containment | ticketing | ...

# ---------------------------------------------------------------------------
# config_schema — per-instance settings the operator fills in when creating an
# instance. JSON-Schema shape: { properties: {...}, required: [...] }.
# Property fields: type (string|number|boolean), description, default,
# and x-soar-sensitive: true for secrets (encrypted in the vault, never returned).
# ---------------------------------------------------------------------------
config_schema:
  properties:
    base_url:
      type: string
      description: API base URL
      default: https://api.example.com/v1
    api_key:
      type: string
      description: API key / token
      x-soar-sensitive: true
  required:
    - api_key

# ---------------------------------------------------------------------------
# auth — authentication methods, referenced from commands via auth_ref.
# value_template: {{secret}} is replaced by the value of secret_field.
#   api_key in header → name is the header (e.g. x-apikey, Authorization)
#   bearer            → typically name: Authorization, value_template: "Bearer {{secret}}"
# ---------------------------------------------------------------------------
auth:
  - id: apikey
    type: api_key                # api_key | bearer | basic | oauth2_client_credentials
    in: header                   # header | query
    name: Authorization
    value_template: "Bearer {{secret}}"
    secret_field: api_key

commands:
  # --- Request-based command (recommended: declarative, no sandbox) ---------
  - id: lookup
    name: Lookup indicator
    description: Fetches a report for an indicator over HTTP.
    inputs_schema:
      properties:
        indicator:
          type: string
          description: The value to look up
      required:
        - indicator
    outputs_schema:
      properties: {}
    request:
      method: GET                # GET | POST | PUT | PATCH | DELETE
      path: /lookup/{indicator}  # {indicator} is substituted from inputs
      query: []                  # input names to send as query params
      body: []                   # input names to send as JSON body fields
      auth_ref: apikey

  # --- Script-based command -------------------------------------------------
  # No `request:` block. Provide scripts/<id>.py next to this manifest.
  # The script receives inputs in the global dict __inputs__ and MUST print
  # exactly one JSON object to stdout (that becomes the command output).
  # See templates/scripts/example_command.py.
  - id: example_command
    name: Example scripted command
    description: Demonstrates a Python-backed command.
    inputs_schema:
      properties:
        indicator:
          type: string
      required:
        - indicator
    outputs_schema:
      properties: {}