Centroids endpoint
The centroids endpoint allows clients to get the latest restricted and allowed centroids available.
Request
Item | Description |
|---|---|
URL | GET /centroids |
Parameters | format (string, optional): The content format can only be JSON or proto. The default is proto.model (int, optional): The specific model of the centroid. The value must be a valid model ID. If a value is not given, the result is centroids for all of the models. If the model has no centroids or the model ID is invalid, a 204 (No Content) response is returned. |
Examples | GET /centroids?format=proto&model=131308214743030001 GET /centroids?format=json&model=131308214743030001 |
Headers | For format=json , it is recommended that you pass the Accept-Encoding: gzip header to compress the centroids.For format=proto , the centroids are already compressed using LZMA compression; specifying the Accept-Encoding: gzip header does not further compress the content. |
Response
A successful response returns status code 200 (OK), 204 (No Content), 302 (Moved), or 304 (Not Modified).
- For a status code 200, the response includes the requested centroid document. If the client requests a gzip encoding, the contents are gzipped.
- For a status code 204, it means that there are no centroids for the model specified in the request.
- For a status code 302, in the response header, the location field contains the URL that the client is being redirected to and where the centroids document is found. If the client requests a gzip encoding, the centroid document is gzipped. The URL expiration time is between 1 hour and 1 day.
- For a status code 304, which means that there are no new centroids yet, the client gets an empty response body.
If an error occurred, the service returns either 400 or 503. For either of these response codes, the body will contain the following JSON documentation with a message field describing the error.
Centroids endpoint response
{ "message" : "reason of failure" }
For
format=proto
, the result is a binary file, which can be loaded directly into the scoring models. For
format=json
, the result has the following structure:JSON data structure
{ "131037481645565647": { "white": { "timestamp": 1470700127 "items": [ { "Identifier": "trusted", "Radius": 1.0, "DistanceMean": 1.0, "DistanceStdDev": 0.2, "Kind": "subspace", "Type":"PE", "Indices": [832, 1562, 4981, 36992], "Values": [1.0, 1.0, 1.0, 1.0], "Status": "ACTIVE", "Timestamp": 1470700127 }, { "Identifier": "something-deleted", "Status": "DELETED", "Timestamp": 1470690127 }, ... ] }, "black": { "timestamp": 1470700127 "items": [ { "Identifier": "mimikatz", "Radius": 45.0, "DistanceMean": 32.0, "DistanceStdDev": 8.0, "Kind": "fullspace", "Type": "PE", "Indices": [832, 834, 1562, 2630], "Values": [0.19337, 0.19337, 1.0, 0.535912], "Status": "ACTIVE", "Timestamp": 1470700127 }, { "Identifier": "mimikatz2", "Radius": 40.0, "DistanceMean": 31.0, "DistanceStdDev": 7.0, "Kind": "fullprojected", "Type": "PE", "Indices": [830, 874, 1362, 2660], "Values": [0.193378, 0.10337, 1.0, 0.035912], "Status": "ACTIVE", "Timestamp": 1470700127 } ] } }, "130906327596576539": { "white": { "timestamp": 1470700127, "items": [ { "Identifier": "trusted", "Radius": 1.0, "DistanceMean": 1.0, "DistanceStdDev": 0.2, "Indices": [832, 1562, 4981, 36992], "Values": [1.0, 1.0, 1.0, 1.0], "Status": "ACTIVE", "Timestamp": 1470700127, } ] }, "black": { "timestamp": 1470700127, "items": [ { "Identifier": "mimikatz", "Radius": 45.0, "DistanceMean": 32.0, "DistanceStdDev": 8.0, "Indices": [832, 834, 1562, 2630], "Values": [0.19337, 0.19337, 1.0, 0.535912], "Status": "ACTIVE", "Timestamp": 1470700127, }, { "Identifier": "mimikatz2", "Radius": 40.0, "DistanceMean": 31.0, "DistanceStdDev": 7.0, "Indices": [830, 874, 1362, 2660], "Values": [0.193378, 0.10337, 1.0, 0.035912], "Status": "ACTIVE", "Timestamp": 1470700127, } ] } } }