id: thinkst_canary
name: Thinkst Canary
version: 1.0.0
description: "Thinkst Canary (Console API v1) — deception/honeypot alerting: list and read incidents, acknowledge an incident, and list Canary devices. API-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get incidents, acknowledge incident, list devices."
category: endpoint

# Per-instance configuration. The auth token is sent as a request parameter; the
# console is reached at https://<domain>.canary.tools.
config_schema:
  properties:
    domain:
      type: string
      description: "Console subdomain (the X in https://X.canary.tools)"
    auth_token:
      type: string
      description: "Console API auth token"
      x-soar-sensitive: true
  required:
    - domain
    - auth_token

commands:
  - id: list_incidents
    name: canary-list-incidents
    description: "List all incidents (alerts)."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max incidents (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_incident
    name: canary-get-incident
    description: "Get a single incident by its ID/key."
    risk: read
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident node/key ID" }
      required: [incident_id]
    outputs_schema: { properties: {} }
  - id: acknowledge_incident
    name: canary-acknowledge-incident
    description: "Acknowledge an incident."
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident node/key ID" }
      required: [incident_id]
    outputs_schema: { properties: {} }
  - id: list_devices
    name: canary-list-devices
    description: "List Canary devices."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: canary-test-connection
    description: "Verify the auth token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }