About Cisco Threatgrid API

[betuluy]

Hi team,

I want to connect to Cisco Threatgrid API and then pull the user list and delete specific users. I want to pull the user list because I need the user IDs to delete these users. But I couldn't find the appropriate endpoint. There are different URLs in the UI and in the documents on the internet, can you give me information about which one is correct and the current API document

Thanks,

[Matthew Franks]

To pull all the users from the Threatgrid API, you can use the /organizations/:org-id/users API call found here. It would look like this:
curl -i -XGET 'https://panacea.threatgrid.com/api/v3/organizations/<ORG_ID>/users' -H 'Content-Type: application/json' -H 'Authorization: bearer <API_KEY>'

Be sure to replace <ORG_ID> and <API_KEY> with your actual values. You can find your ORG_ID by going to Administration > Organization and looking at the URL. The ORG_ID will be a 5 digit number at the end.

Hope that helps,

-Matt

[betuluy]

Hi Matt,

Thank you for quick response. 
I logged in my UI. But, I can't see "Organization" tab. Also, my role is admin. When I click to the "Manage Organization" field. I saw my URL like https://x.x.x.x/organizations/1 (not 5 digit number at the end)

Also, I didn't see https://panacea.threatgrid.com/mask/api-doc/api/v3/organizations/:org-id/users?region=US this page. Because, I dont have account.

Thanks for your help,

Good days

[Matthew Franks]

Without additional information on your account, I can't really help further. If you open a TAC case, they can help you gather the information you would need to make the API call.

Thanks,

-Matt

[bmahsan · Accepted solution]

Hi 

It looks like you have a SMA (Threat Grid) appliance.

For appliance it will not be a 5 digit number. for appliance you can try this - 

curl -i -XGET 'https://<IP or hostname of Clean Interface>/api/v3/organizations/<ORG_ID>/users' -H 'Content-Type: application/json' -H 'Authorization: bearer <API_KEY>'

Org_ID you can find it in the URL as you have already found it `1`, you can use your Admin API Key 

In appliance you can access the API reference doc from Help, there should be a ? icon on upper left corner. 
or you can access it from https://<IP or hostname of Clean Interface>/mask/doc/mask/help-api-overview