loading…
Find out who accessed this customer dataset unexpectedly
/api/mcp/srv-data-access-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Generate aggregated metrics on data access patterns, policy compliance, and security posture across time periods and organizational units
{
"type": "object",
"required": [
"metric_types"
],
"properties": {
"group_by": {
"type": "array",
"items": {
"enum": [
"department",
"data_classification",
"user_role",
"resource_type",
"geography"
],
"type": "string"
}
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"last_90d"
],
"type": "string"
},
"metric_types": {
"type": "array",
"items": {
"enum": [
"access_volume",
"policy_violations",
"risk_scores",
"classification_coverage",
"user_activity",
"data_exposure"
],
"type": "string"
}
},
"include_trends": {
"type": "boolean",
"default": true
}
}
}Approve or deny pending access request with optional conditions and expiration settings
{
"type": "object",
"required": [
"request_id",
"action",
"justification"
],
"properties": {
"action": {
"enum": [
"approve",
"deny"
],
"type": "string"
},
"conditions": {
"type": "array",
"items": {
"type": "string"
}
},
"request_id": {
"type": "string"
},
"justification": {
"type": "string"
},
"expiration_date": {
"type": "string",
"format": "date-time"
},
"notify_requestor": {
"type": "boolean",
"default": true
}
}
}Apply or update data classification labels on datasets, tables, or files based on content analysis and organizational policies
{
"type": "object",
"required": [
"asset_id",
"asset_type",
"classification_level"
],
"properties": {
"asset_id": {
"type": "string"
},
"asset_type": {
"enum": [
"database",
"table",
"file",
"dataset",
"schema"
],
"type": "string"
},
"justification": {
"type": "string"
},
"sensitivity_labels": {
"type": "array",
"items": {
"enum": [
"pii",
"phi",
"pci",
"financial",
"legal_privilege",
"trade_secret"
],
"type": "string"
}
},
"classification_level": {
"enum": [
"public",
"internal",
"confidential",
"restricted",
"top_secret"
],
"type": "string"
},
"auto_apply_inheritance": {
"type": "boolean",
"default": false
}
}
}Create new data security incident from detected violation or manual report with initial classification and assignment
{
"type": "object",
"required": [
"title",
"description",
"severity",
"incident_type"
],
"properties": {
"title": {
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"description": {
"type": "string"
},
"incident_type": {
"enum": [
"unauthorized_access",
"data_exfiltration",
"policy_violation",
"insider_threat",
"external_breach"
],
"type": "string"
},
"source_event_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"affected_resources": {
"type": "array",
"items": {
"type": "string"
}
},
"containment_actions": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Retrieve detailed access request by ID including approval workflow, justification, and current status
{
"type": "object",
"required": [
"request_id"
],
"properties": {
"request_id": {
"type": "string"
},
"include_history": {
"type": "boolean",
"default": false
},
"include_approvers": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed information about a specific user access session including all data interactions and risk scores
{
"type": "object",
"required": [
"session_id"
],
"properties": {
"session_id": {
"type": "string"
},
"include_interactions": {
"type": "boolean",
"default": true
},
"include_risk_analysis": {
"type": "boolean",
"default": true
}
}
}Retrieve comprehensive risk profile for user or resource including risk score, contributing factors, and recommended controls
{
"type": "object",
"required": [
"entity_id",
"entity_type"
],
"properties": {
"entity_id": {
"type": "string"
},
"entity_type": {
"enum": [
"user",
"resource",
"application",
"system"
],
"type": "string"
},
"time_window": {
"enum": [
"current",
"7d",
"30d",
"90d"
],
"type": "string",
"default": "current"
},
"include_risk_factors": {
"type": "boolean",
"default": true
},
"include_recommendations": {
"type": "boolean",
"default": true
}
}
}Execute threat hunting query across access patterns using behavioral analytics and return suspicious activities
{
"type": "object",
"required": [
"hunt_query"
],
"properties": {
"hunt_query": {
"type": "string",
"description": "Behavioral analytics query syntax"
},
"user_scope": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_scope": {
"type": "array",
"items": {
"type": "string"
}
},
"risk_threshold": {
"type": "number",
"default": 70,
"maximum": 100,
"minimum": 0
},
"lookback_period": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"include_ml_insights": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed analysis of access anomalies including user behavior baselines, risk factors, and recommended actions
{
"type": "object",
"required": [
"anomaly_id"
],
"properties": {
"anomaly_id": {
"type": "string"
},
"analysis_depth": {
"enum": [
"summary",
"detailed",
"forensic"
],
"type": "string",
"default": "detailed"
},
"include_user_baseline": {
"type": "boolean",
"default": true
},
"include_peer_comparison": {
"type": "boolean",
"default": true
}
}
}List user entitlements and permissions across systems with effective access calculation and certification status
{
"type": "object",
"required": [],
"properties": {
"user_id": {
"type": "string"
},
"system_id": {
"type": "string"
},
"permission_type": {
"enum": [
"read",
"write",
"admin",
"owner"
],
"type": "string"
},
"include_inherited": {
"type": "boolean",
"default": true
},
"certification_status": {
"enum": [
"certified",
"pending",
"overdue",
"uncertified"
],
"type": "string"
},
"show_effective_access": {
"type": "boolean",
"default": true
}
}
}Retrieve data access policy violations with filtering by severity, policy type, and violation status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"default": 0,
"minimum": 0
},
"status": {
"enum": [
"open",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"assignee_id": {
"type": "string"
},
"policy_type": {
"type": "array",
"items": {
"enum": [
"data_classification",
"access_control",
"retention",
"encryption",
"geographic_restriction"
],
"type": "string"
}
}
}
}Grant or modify user access permissions to data resources with approval workflow and temporary access support
{
"type": "object",
"required": [
"user_id",
"resource_id",
"permission_level",
"business_justification"
],
"properties": {
"user_id": {
"type": "string"
},
"access_type": {
"enum": [
"permanent",
"temporary",
"emergency"
],
"type": "string"
},
"approver_id": {
"type": "string"
},
"require_mfa": {
"type": "boolean",
"default": false
},
"resource_id": {
"type": "string"
},
"expiration_date": {
"type": "string",
"format": "date-time"
},
"permission_level": {
"enum": [
"read",
"write",
"admin",
"owner"
],
"type": "string"
},
"business_justification": {
"type": "string"
}
}
}Search access events using query language filters to find unauthorized access attempts, policy violations, or suspicious data access patterns
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000,
"minimum": 1
},
"query": {
"type": "string",
"description": "Query string using field:value syntax"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
}
}
}Execute automated remediation action for policy violation including access revocation and notification workflows
{
"type": "object",
"required": [
"violation_id",
"remediation_action"
],
"properties": {
"violation_id": {
"type": "string"
},
"create_ticket": {
"type": "boolean",
"default": true
},
"justification": {
"type": "string"
},
"remediation_action": {
"enum": [
"revoke_access",
"quarantine_user",
"disable_account",
"require_mfa",
"notify_manager"
],
"type": "string"
},
"execute_immediately": {
"type": "boolean",
"default": false
},
"notify_stakeholders": {
"type": "boolean",
"default": true
}
}
}Execute data discovery scan to identify and catalog sensitive information across data repositories with classification recommendations
{
"type": "object",
"required": [
"scan_scope"
],
"properties": {
"scan_type": {
"enum": [
"full",
"incremental",
"targeted"
],
"type": "string"
},
"scan_scope": {
"type": "array",
"items": {
"type": "string"
}
},
"schedule_recurring": {
"type": "boolean",
"default": false
},
"notify_on_completion": {
"type": "boolean",
"default": true
},
"sensitivity_patterns": {
"type": "array",
"items": {
"enum": [
"ssn",
"credit_card",
"email",
"phone",
"ip_address",
"custom_regex"
],
"type": "string"
}
},
"classification_threshold": {
"type": "number",
"default": 0.8,
"maximum": 1,
"minimum": 0
}
}
}Change the investigation status and assignment of data access policy violations with audit trail
{
"type": "object",
"required": [
"violation_id",
"status"
],
"properties": {
"status": {
"enum": [
"open",
"investigating",
"resolved",
"false_positive",
"escalated"
],
"type": "string"
},
"assignee_id": {
"type": "string"
},
"violation_id": {
"type": "string"
},
"resolution_notes": {
"type": "string"
},
"notify_stakeholders": {
"type": "boolean",
"default": true
},
"remediation_actions": {
"type": "array",
"items": {
"enum": [
"access_revoked",
"policy_updated",
"user_training",
"technical_control",
"no_action"
],
"type": "string"
}
}
}
}