Amazon Detective

amazonaws · Cloud

Cloud No Auth Free & Open cloud Sandbox

Detective uses machine learning and purpose-built visualizations to help you to analyze and investigate security issues across your Amazon Web Services (Amazon Web Services) workloads. Detective automatically extracts time-based events such as login attempts, API calls, and network traffic from CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by Amazon GuardDuty. The Detective API primarily supports the creation and management of be

Authentication

No authentication requiredFree to use with no key needed.

Sample Requests

GET ListTagsForResource

Returns the tag values that are assigned to a behavior graph.

https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}

Hover any highlighted part to learn what it does

curl -X GET "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}"

import requests
response = requests.get(
    "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}",
)
print(response.json())

const url = 'https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}';

const response = await fetch(url); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	targetURL := "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}"
	req, _ := http.NewRequest("GET", targetURL, nil)

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}")

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Get.new(uri)

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/tags/{ResourceArn}";
$opts = ["http" => [
    "method" => "GET",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

POST ListGraphs

Returns the list of behavior graphs that the calling account is an administrator account of. This operation can only be called by an administrator account. Because an account can currently only be the administrator of one behavior graph within a Region, the results always contain a single

https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list?NextToken=example&MaxResults=example

Hover any highlighted part to learn what it does

curl -X POST "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list?NextToken=example&MaxResults=example"

import requests
params = {
    "NextToken": "example",
    "MaxResults": "example"
}
response = requests.post(
    "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list",
    params=params,
)
print(response.json())

const url = new URL('https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list');
url.searchParams.set('NextToken', 'example');
url.searchParams.set('MaxResults', 'example');

const response = await fetch(url, {
  method: 'POST',
}); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"net/url"
)

func main() {
	baseURL, _ := url.Parse("https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list")
	q := baseURL.Query()
	q.Set("NextToken", "example")
	q.Set("MaxResults", "example")
	baseURL.RawQuery = q.Encode()
	targetURL := baseURL.String()
	req, _ := http.NewRequest("POST", targetURL, nil)

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list")
uri.query = URI.encode_www_form({
  "NextToken" => "example",
  "MaxResults" => "example"
})

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Post.new(uri)

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/graphs/list?" . http_build_query([
    "NextToken" => "example",
    "MaxResults" => "example"
]);
$opts = ["http" => [
    "method" => "POST",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

POST ListInvitations

Retrieves the list of open and accepted behavior graph invitations for the member account. This operation can only be called by an invited member account. Open invitations are invitations that the member account has not responded to. The results do not include behavior graphs for wh

https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list?NextToken=example&MaxResults=example

Hover any highlighted part to learn what it does

curl -X POST "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list?NextToken=example&MaxResults=example"

import requests
params = {
    "NextToken": "example",
    "MaxResults": "example"
}
response = requests.post(
    "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list",
    params=params,
)
print(response.json())

const url = new URL('https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list');
url.searchParams.set('NextToken', 'example');
url.searchParams.set('MaxResults', 'example');

const response = await fetch(url, {
  method: 'POST',
}); 
const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"net/url"
)

func main() {
	baseURL, _ := url.Parse("https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list")
	q := baseURL.Query()
	q.Set("NextToken", "example")
	q.Set("MaxResults", "example")
	baseURL.RawQuery = q.Encode()
	targetURL := baseURL.String()
	req, _ := http.NewRequest("POST", targetURL, nil)

	client := &http.Client{}
	resp, _ := client.Do(req)
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}

require "net/http"
require "json"

uri = URI("https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list")
uri.query = URI.encode_www_form({
  "NextToken" => "example",
  "MaxResults" => "example"
})

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"

req = Net::HTTP::Post.new(uri)

res = http.request(req)
puts JSON.parse(res.body)

<?php
$url = "https://api.apis.guru/v2/specs/amazonaws.com/detective/2018-10-26/invitations/list?" . http_build_query([
    "NextToken" => "example",
    "MaxResults" => "example"
]);
$opts = ["http" => [
    "method" => "POST",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));

Postman Setup Guide

Get Postman ↗

See official documentation for authentication and setup.

What can you build with Amazon Detective?

Amazon Detective is a Cloud API. Developers commonly use cloud APIs for:

provisioning and managing cloud infrastructure
automating deployments and container orchestration
monitoring uptime and performance metrics
managing storage buckets and databases
setting up auto-scaling and load balancing

No authentication required. This API is open — no signup or key needed. Ideal for quick prototypes and public-facing features. Amazon Detective is free to use, making it a low-risk choice to experiment with.

New to APIs? Read our beginner's guide · Learn about API keys · What is REST?

Open documentation ↗