Tanium Threat Response API — File Downloads

naftiko: 1.0.0-alpha2
info:
  label: Tanium Threat Response API — File Downloads
  description: 'Tanium Threat Response API — File Downloads. 4 operations. Lead operation: List File Downloads. Self-contained
    Naftiko capability covering one Tanium business surface.'
  tags:
  - Tanium
  - File Downloads
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    TANIUM_API_KEY: TANIUM_API_KEY
capability:
  consumes:
  - type: http
    namespace: threat-response-file-downloads
    baseUri: https://{tanium_server}
    description: Tanium Threat Response API — File Downloads business capability. Self-contained, no shared references.
    resources:
    - name: plugin-products-threat-response-api-v1-filedownload
      path: /plugin/products/threat-response/api/v1/filedownload
      operations:
      - name: listfiledownloads
        method: GET
        description: List File Downloads
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: limit
          in: query
          type: integer
          description: Maximum number of file downloads to return
        - name: offset
          in: query
          type: integer
          description: Number of file downloads to skip for pagination
        - name: sort
          in: query
          type: string
          description: Sort order for results
        - name: hostname
          in: query
          type: string
          description: Filter by source endpoint hostname
        - name: hash
          in: query
          type: string
          description: Filter by file hash
    - name: plugin-products-threat-response-api-v1-filedownload-data-fileId
      path: /plugin/products/threat-response/api/v1/filedownload/data/{fileId}
      operations:
      - name: downloadfilecontent
        method: GET
        description: Download File Content
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: fileId
          in: path
          type: string
          description: Unique identifier of the file to download
          required: true
    - name: plugin-products-threat-response-api-v1-filedownload-fileId
      path: /plugin/products/threat-response/api/v1/filedownload/{fileId}
      operations:
      - name: getfiledownload
        method: GET
        description: Get File Download Metadata
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: fileId
          in: path
          type: string
          description: Unique identifier of the downloaded file
          required: true
      - name: deletefiledownload
        method: DELETE
        description: Delete A Downloaded File
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: fileId
          in: path
          type: string
          description: Unique identifier of the file to delete
          required: true
    authentication:
      type: apikey
      key: session
      value: '{{env.TANIUM_API_KEY}}'
      placement: header
  exposes:
  - type: rest
    namespace: threat-response-file-downloads-rest
    port: 8080
    description: REST adapter for Tanium Threat Response API — File Downloads. One Spectral-compliant resource per consumed
      operation, prefixed with /v1.
    resources:
    - path: /v1/plugin/products/threat-response/api/v1/filedownload
      name: plugin-products-threat-response-api-v1-filedownload
      description: REST surface for plugin-products-threat-response-api-v1-filedownload.
      operations:
      - method: GET
        name: listfiledownloads
        description: List File Downloads
        call: threat-response-file-downloads.listfiledownloads
        with:
          limit: rest.limit
          offset: rest.offset
          sort: rest.sort
          hostname: rest.hostname
          hash: rest.hash
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/plugin/products/threat-response/api/v1/filedownload/data/{fileid}
      name: plugin-products-threat-response-api-v1-filedownload-data-fileid
      description: REST surface for plugin-products-threat-response-api-v1-filedownload-data-fileId.
      operations:
      - method: GET
        name: downloadfilecontent
        description: Download File Content
        call: threat-response-file-downloads.downloadfilecontent
        with:
          fileId: rest.fileId
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/plugin/products/threat-response/api/v1/filedownload/{fileid}
      name: plugin-products-threat-response-api-v1-filedownload-fileid
      description: REST surface for plugin-products-threat-response-api-v1-filedownload-fileId.
      operations:
      - method: GET
        name: getfiledownload
        description: Get File Download Metadata
        call: threat-response-file-downloads.getfiledownload
        with:
          fileId: rest.fileId
        outputParameters:
        - type: object
          mapping: $.
      - method: DELETE
        name: deletefiledownload
        description: Delete A Downloaded File
        call: threat-response-file-downloads.deletefiledownload
        with:
          fileId: rest.fileId
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: threat-response-file-downloads-mcp
    port: 9090
    transport: http
    description: MCP adapter for Tanium Threat Response API — File Downloads. One tool per consumed operation, routed inline
      through this capability's consumes block.
    tools:
    - name: list-file-downloads
      description: List File Downloads
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: threat-response-file-downloads.listfiledownloads
      with:
        limit: tools.limit
        offset: tools.offset
        sort: tools.sort
        hostname: tools.hostname
        hash: tools.hash
      outputParameters:
      - type: object
        mapping: $.
    - name: download-file-content
      description: Download File Content
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: threat-response-file-downloads.downloadfilecontent
      with:
        fileId: tools.fileId
      outputParameters:
      - type: object
        mapping: $.
    - name: get-file-download-metadata
      description: Get File Download Metadata
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: threat-response-file-downloads.getfiledownload
      with:
        fileId: tools.fileId
      outputParameters:
      - type: object
        mapping: $.
    - name: delete-downloaded-file
      description: Delete A Downloaded File
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: threat-response-file-downloads.deletefiledownload
      with:
        fileId: tools.fileId
      outputParameters:
      - type: object
        mapping: $.