# Get endpoint by ID

Returns a single endpoint with connections (users and resources). Users in connections have risk_level not None.

Endpoint: GET /endpoints/{endpoint_id}
Version: 1.0.0
Security: ApiKeyAuth

## Query parameters:

  - `domain_id` (string)
    Domain UUID(s) to scope the request. Comma-separated for multiple. If omitted, all non-archived domains of the organization are used.
    Example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"

## Path parameters:

  - `endpoint_id` (string, required)

## Response 200 fields (application/json):

  - `data` (object)

  - `data.id` (string)
    Example: "d4e5f6a7-b8c9-0123-def0-456789012345"

  - `data.date` (string,null)
    Example: "2025-12-04T14:30:00.000Z"

  - `data.added_at` (string,null)
    Example: "2025-12-05T01:09:22.879Z"

  - `data.metadata` (object,null)
    May contain exfiltration_date (ISO 8601) and other fields
    Example: {"exfiltration_date":"2025-12-04T14:30:00.000Z"}

  - `data.risk_level` (integer)
    Example: 4

  - `data.risk_level_name` (string)
    Enum: "none", "low", "medium", "high"

  - `data.status` (string)
    Enum: "new", "investigating", "resolved", "false_positive"

  - `data.filename` (string)
    Example: "[US]93.101.28.33.rar"

  - `data.tree` (array)
    File paths extracted from the stealer log archive
    Example: ["[US]93.101.28.33.rar/All Passwords.txt","[US]93.101.28.33.rar/System.txt"]

  - `data.connections` (object)

  - `data.connections.users` (array)

  - `data.connections.users.login` (string)
    Example: "user@example.com"

  - `data.connections.users.identity_type` (string)
    Enum: "email", "username"

  - `data.connections.resources` (array)

  - `data.connections.resources.resource` (string)
    Example: "api.example.com"

  - `data.connections.resources.type` (string)
    Enum: "domain", "ip", "apk"

## Response 401 fields (application/json):

  - `type` (string)
    Example: "validation_error"

  - `status` (integer)
    Example: 400

  - `detail` (string)
    Example: "Invalid sort field: \"foo\". Valid: [\"risk_level\", \"first_seen\", \"added_at\"]."

## Response 403 fields (application/json):

  - `type` (string)
    Example: "validation_error"

  - `status` (integer)
    Example: 400

  - `detail` (string)
    Example: "Invalid sort field: \"foo\". Valid: [\"risk_level\", \"first_seen\", \"added_at\"]."

## Response 404 fields (application/json):

  - `type` (string)
    Example: "validation_error"

  - `status` (integer)
    Example: 400

  - `detail` (string)
    Example: "Invalid sort field: \"foo\". Valid: [\"risk_level\", \"first_seen\", \"added_at\"]."