Threat Management

4 operations. Call any of them with omada_call_operation (or, in full tool mode, as a tool named by its operationId).

Operation	Method	Summary
getThreatList	GET	Get grid threat list
deleteThreatList	POST	Delete archived ips threat
getThreatDetail	GET	Get threat entry detail
operateThreats	POST	Block/Isolate Device/Signature Suppression/Allow ips threat

getThreatList

GET /openapi/v1/{omadacId}/sites/{siteId}/ips/grid/threat-management

Get grid threat list

Parameter	In	Type	Required	Description
omadacId	path	string	auto	Omada ID (filled in automatically)
siteId	path	string	yes	Site ID (site ID or site name)
archived	query	boolean	yes	archived
page	query	integer	no	Start page number. Start from 1. (default 1)
pageSize	query	integer	no	Number of entries per page. It should be within the range of 1–1000. (default 100)
filters.startTime	query	integer	yes	Start timestamp, in seconds, such as 1682000000
filters.endTime	query	integer	yes	End timestamp, in seconds, such as 1682000000
filters.severity	query	integer	no	Threat Severity, such as 0:Critical, 1: Major, 2:Moderate, 3:Minor, 4:Low
sorts.time	query	string	no	Sort parameter may be one of asc or desc. Optional parameter. If it is not carried, it means it is not sorted by this field. When there are more than one, the first one takes effect
searchKey	query	string	no	Fuzzy query parameters, support field Threat Description/Classification/Classification Description

// omada_call_operation
{
  "operationId": "getThreatList",
  "params": {
    "siteId": "<siteId>",
    "archived": "<archived>",
    "filters.startTime": "<filters.startTime>",
    "filters.endTime": "<filters.endTime>"
  }
}

Details, permissions and error codes

Get grid threat list.
The interface requires one of the permissions:
Site Insight Manager View Only
Global Threat Manager View Only
Device Config Page View Only
Site Device Manager View Only

deleteThreatList

POST /openapi/v1/{omadacId}/sites/{siteId}/ips/threat

Delete archived ips threat

Parameter	In	Type	Required	Description
omadacId	path	string	auto	Omada ID (filled in automatically)
siteId	path	string	yes	Site ID (site ID or site name)

Request body — application/json (required) — schema Delete Ips Threat

Field	Type	Required	Description
threatId	array<Ips operate threatId and time>	no	IPS threatId and Time list.

// omada_call_operation
{
  "operationId": "deleteThreatList",
  "params": {
    "siteId": "<siteId>"
  },
  "body": "{...}"
}

Details, permissions and error codes

Delete archived ips threat.
The interface requires one of the permissions:
Site Insight Manager Modify
Global Threat Manager Modify
Device Config Page Modify
Site Device Manager Modify

getThreatDetail

GET /openapi/v1/{omadacId}/sites/{siteId}/ips/threat/{threatId}

Get threat entry detail

Parameter	In	Type	Required	Description
omadacId	path	string	auto	Omada ID (filled in automatically)
siteId	path	string	yes	Site ID (site ID or site name)
threatId	path	string	yes	threatId
time	query	integer	yes	Timestamp, in seconds, such as 1682000000

// omada_call_operation
{
  "operationId": "getThreatDetail",
  "params": {
    "siteId": "<siteId>",
    "threatId": "<threatId>",
    "time": "<time>"
  }
}

Details, permissions and error codes

Get threat entry detail.
The interface requires one of the permissions:
Site Insight Manager View Only
Global Threat Manager View Only
Device Config Page View Only
Site Device Manager View Only

operateThreats

POST /openapi/v1/{omadacId}/sites/{siteId}/ips/threat/multi-ops

Block/Isolate Device/Signature Suppression/Allow ips threat

Parameter	In	Type	Required	Description
omadacId	path	string	auto	Omada ID (filled in automatically)
siteId	path	string	yes	Site ID (site ID or site name)

Request body — application/json (required) — schema Ips Operate Threat

Field	Type	Required	Description
threatId	array<Ips operate threatId and time>	no	IPS signature type should be a value as follows: 0: all traffic; 1: packet tracking respectively.
type	integer	yes	IPS Operate Threat type should be a value as follows: 0: block; 1:isolate device; 2: signature Suppression; 3: allow
signatureSuppression	SignatureSuppression	no	(SignatureSuppression not expanded; call omada_get_schema "SignatureSuppression")
blockName	string	no	IPS block name should not be empty when type is 0 or 1.

// omada_call_operation
{
  "operationId": "operateThreats",
  "params": {
    "siteId": "<siteId>"
  },
  "body": "{...}"
}

Details, permissions and error codes

Block/Isolate Device/Signature Suppression/Allow ips threat.
The interface requires one of the permissions:
Site Insight Manager Modify
Global Threat Manager Modify
Device Config Page Modify
Site Device Manager Modify
The possible error code for the interface in the returned body is one of the following error codes (non generic error codes):
-35202 - The number of allow list entries has reached the limit.
-35203 - The number of block list entries has reached the limit.
-35204 - The number of signature suppression entries has reached the limit.