action threatjammer_logchanges_ip_v1_log_ip_ip_address_get {
  label: "Get the changes logged in the different datasets of an IP address."
  description: "### What\nObtain a list of changes logged in the different datasets of the IP address given.\n\n### Parameters\nThe endpoint accepts the following parameters in the path:\n- ``ip_address``: (Mandatory) The public IPv4 or IPv6 addresses to be queried.\n\nThe endpoint accepts the following parameters in the query string:\n- ``dataset``: (Optional) Name of the dataset to filter the query. If not given, then all datasets are queried. If given, then only the changes logged in the given dataset are returned. The list of datasets is obtained from the ``/v1/dataset/ip`` endpoint.\n- ``logged_after``: (Optional) The UNIX timestamp in milliseconds of the earliest date to be included in the query. If not given, then the earliest date is the date of the first change logged in the dataset.\n\n\n### Result\nThe result is a JSON object with the following structure:\n- ``self``: the URI of the API call\n- ``logs``: The list of log changes. Each element of the list is a JSON object of a specific log change with the structure described in the endpoint ``/v1/log/ip/id/logchange_id``.\n### Errors\nThe endpoint will return the following errors:\n- a `400 Bad Request` error if the IP address is not public.\n- a `400 Bad Request` error if the timestamp is in the future.\n- a `400 Bad Request` error if the dataset is not a string that can have numbers, upper and lower case letters, and underscores.\n- a `404 Not Found` error if the dataset was not found.\n- a `422 Unprocessable Entity` error if the IP address is malformed.\n\nIt will also return the API Global errors described in the API description."
  provider: threatjammer
  method: GET
  path: "/v1/log/ip/{ip_address}"
  encoding: json
  input: {
    type: "object"
    properties: {
      dataset: {
        type: "string"
        description: "The name of the dataset to restrict the query"
      }
      ip_address: {
        type: "string"
        format: "ipvanyaddress"
        description: "The IPv4 or IPv6 address to asses the risk"
      }
      logged_after: {
        type: "integer"
        description: "A UNIX timestamp in milliseconds to restrict the results of the query to entries logged after this value."
      }
    }
    required: ["ip_address"]
    additionalProperties: false
  }
  output: {
    type: "object"
    required: ["debug", "logs"]
    properties: {
      logs: {
        type: "array"
        items: {
          type: "object"
          required: ["risk", "dataset", "source", "lapse", "action", "timestamp", "debug"]
          properties: {
            action: {
              type: "string"
              enum: ["ADD", "DELETE"]
            }
            cidr: {
              type: "string"
            }
            dataset: {
              type: "string"
            }
            lapse: {
              type: "string"
              enum: ["1H", "6H", "12H", "1D", "7D", "30D", "90D", "180D", "365D"]
            }
            risk: {
              type: "string"
              enum: ["UNKNOWN", "LOW", "MEDIUM", "HIGH"]
            }
            score: {
              type: "integer"
            }
            self: {
              type: "string"
            }
            source: {
              type: "string"
            }
            timestamp: {
              type: "integer"
            }
          }
        }
      }
      self: {
        type: "string"
      }
    }
  }
}