Manager API

Use /manager to work with strategies, campaigns, and human decisions. Start with the existing program and current proposals before creating work that may already be planned.

Every operation is scoped to one tenant provider, so pass the same provider scope you use elsewhere, such as githubOwnerId. Operations that read need read access and operations that change state need write access for the area they touch. Where one differs from what you would expect, the guide for that area says so. A 403 on a team-scoped role is expected for action items and chat.

Approvals and decisions

Manager separates proposing from deciding. Read this before automating anything that accepts or starts work.

• Generating a proposal is not approval. POST /manager/strategy/trigger and the proposal-producing run modes write a proposed strategy version or proposed campaigns. A proposal must be accepted before it takes effect. Strategy acceptance is always explicit, whatever autonomy the security program sets. Autonomy governs what Manager may do afterwards, such as creating successor campaigns inside the accepted goals.

• A decision names the exact thing it decides. Decide the proposed strategy takes the strategyId of a specific strategy version, and Decide a proposed campaign takes a proposalId. If that version or proposal is no longer the one awaiting a decision, the call returns 412 and changes nothing. It does not redirect to the newer one. Re-read the proposal and decide again against what you are looking at.

• Decisions are final. Accepting or rejecting cannot be repeated or reversed through the same endpoint, and a repeat call returns 412. An accepted strategy version retires the other pending versions.

• The caller is recorded. The deciding identity comes from your credentials, not from the request body.

• Some operations are direct writes, not proposals. PATCH /manager/strategy puts a new strategy version in force as soon as it succeeds. POST /manager/campaigns creates a campaign directly. The activate action on a threat investigation creates and starts a remediation campaign. These calls apply changes directly, so do not call them as a way to "propose".

Runs are asynchronous

Operations that start Manager work, such as POST /manager/trigger, POST /manager/strategy/trigger and POST /manager/campaigns/default/generate, return when the run is accepted, with a runId. They do not wait for it. Poll GET /manager/runs/{runId} until terminal is true, and read what the run wrote from the response. A SKIPPED run succeeded and wrote nothing. See Proposals, runs and state. A start call returns 429 while another run holds the tenant lock, which is safe to retry later.

Guides in this section

• Program and strategy: the security program, the active strategy, strategy versions, and strategy proposals and decisions.

• Proposals, runs and state: campaign proposals and decisions, starting and following runs, state, plans and metrics.

• Campaigns, runs and events: creating and editing campaigns, previews, findings, campaign runs, and Manager events.

• Action items and escalations: resolving, dismissing and reopening action items, nudges, and git identity classifications.

• Operator chat: chat sessions, history, actions and audit records.

• Configuration, ground rules and escalations: preview mode, ground rules, escalation routing and onboarding.

• Threat intelligence: the published threat catalog, threat reports and threat investigations.

Related

Manager configuration explains program autonomy, tenant and team ground rules, and blocked action types. Legacy Manager credits are not a supported API; use AI usage.

Published operation index

This index comes from the published specification. Check its request and response schemas before calling an operation; deployment versions and feature availability can differ.

Method	Path	Operation
GET	/manager/action-items	List Action Items
GET	/manager/action-items/summary	Action Items Summary
DELETE	/manager/action-items/{actionItemId}	Soft-Delete Action Item
GET	/manager/action-items/{actionItemId}	Get Action Item
PATCH	/manager/action-items/{actionItemId}	Patch Action Item Team
POST	/manager/action-items/{actionItemId}/assign-repo	Assign Repository Owner To Action Item
POST	/manager/action-items/{actionItemId}/assign-team	Assign Team To Action Item
PUT	/manager/action-items/{actionItemId}/chat	Get or create action item chat
POST	/manager/action-items/{actionItemId}/dismiss	Dismiss Action Item
POST	/manager/action-items/{actionItemId}/map-user	Map User For Action Item
GET	/manager/action-items/{actionItemId}/messages	Get Action Item Messages
POST	/manager/action-items/{actionItemId}/nudge	Nudge Escalation Action Item
POST	/manager/action-items/{actionItemId}/reopen	Reopen Action Item
GET	/manager/campaigns	List Campaigns
POST	/manager/campaigns	Post Campaign
GET	/manager/campaigns/default	Get Default Campaigns
POST	/manager/campaigns/default/generate	Generate Default Campaigns
GET	/manager/campaigns/findings	Get All Campaigns Findings
GET	/manager/campaigns/metrics/refresh	Refresh Campaign Metrics
GET	/manager/campaigns/previews	Get Campaign Previews
GET	/manager/campaigns/summaries	Get Campaign Summaries
DELETE	/manager/campaigns/{campaignId}	Delete Campaign
GET	/manager/campaigns/{campaignId}	Get Campaign by ID
PATCH	/manager/campaigns/{campaignId}	Patch Campaign
GET	/manager/campaigns/{campaignId}/events	Get Campaign Events
GET	/manager/campaigns/{campaignId}/findings	Get (Triaged) Findings Associated with a campaign
GET	/manager/campaigns/{campaignId}/preview	Get Campaign Preview Details
GET	/manager/campaigns/{campaignId}/runs	List Campaign Runs
GET	/manager/campaigns/{campaignId}/runs/{runId}	Get Campaign Run
PUT	/manager/chat/general	Get or create Operator General chat
GET	/manager/chat/sessions	List Chat Sessions
DELETE	/manager/chat/sessions/{chatID}	Delete Chat Session
GET	/manager/chat/sessions/{chatID}	Get Chat Session
PATCH	/manager/chat/sessions/{chatID}	Patch Chat Session
GET	/manager/chat/sessions/{chatID}/actions	Get Chat Session Actions
GET	/manager/chat/sessions/{chatID}/audit	Get chat session audit trail
GET	/manager/chat/sessions/{chatID}/history	Get Chat Session History
GET	/manager/config	Get Manager config
POST	/manager/config	Update Manager config
POST	/manager/daily-summary/trigger	Start a daily summary run
GET	/manager/escalation-recipients	Get Escalation Recipients
GET	/manager/escalations/config	Get Escalation Config
PUT	/manager/escalations/config	Put Escalation Config
GET	/manager/events	Get Events
POST	/manager/events/deduplicate	Deduplicate Events
DELETE	/manager/events/{eventId}	Delete Event
GET	/manager/findings/{findingId}/events	Get Finding Events
GET	/manager/fix-prs/{recordId}/nudge	Preview Fix PR Nudge
POST	/manager/fix-prs/{recordId}/nudge	Nudge Fix PR Reviewers
GET	/manager/groundrules	Get Manager ground rules
PATCH	/manager/groundrules	Patch a GroundRules object
POST	/manager/groundrules	Post a GroundRules object
GET	/manager/identity-classifications	List Git Identity Classifications
POST	/manager/identity-classifications	Classify Git Identity
DELETE	/manager/identity-classifications/{provider}/{providerUserId}	Revoke Git Identity Classification
GET	/manager/metrics	Get Metrics
POST	/manager/onboarding/wizard-progress	Onboarding Wizard Progress
GET	/manager/plans	Get Plans
GET	/manager/program	Get Security Program
PATCH	/manager/program	State Security Program
GET	/manager/proposals	List Open Proposals
POST	/manager/proposals/decision	Decide Proposed Campaign
GET	/manager/runs/{runId}	Get Manager Run
GET	/manager/state	Get Manager State
GET	/manager/state/latest	Get Manager State (Legacy)
GET	/manager/states	Get Manager States
GET	/manager/strategy	Get Active Strategy
PATCH	/manager/strategy	Patch Active Strategy
GET	/manager/strategy/proposal	Get Proposed Strategy
POST	/manager/strategy/proposal/decision	Decide Proposed Strategy
POST	/manager/strategy/trigger	Trigger Strategy Generation
GET	/manager/strategy/versions	List Strategy Versions
POST	/manager/tacit-knowledge/trigger	Trigger TacitKnowledge
GET	/manager/threat-investigations	Get Threat Investigations
POST	/manager/threat-investigations	Post Threat Investigation
GET	/manager/threat-investigations/{threatInvestigationId}	Get Threat Investigation
PATCH	/manager/threat-investigations/{threatInvestigationId}	Patch Threat Investigation
GET	/manager/threat-reports	List My Reported Threats
POST	/manager/threat-reports	Report a Threat
GET	/manager/threat-reports/{requestId}	Get Threat Report Status
GET	/manager/threats	Get Threat Catalog
POST	/manager/threats/{threatId}/investigate	Investigate Threat in My Environment
POST	/manager/trigger	Start a Manager run