canonical: https://jentic.com/apis/trendmicro.com/trendmicro

# Trendmicro Trend Vision One API

Trend Micro Vision One (formerly XDR) REST API v3.0. Provides programmatic access to detection, response, threat intelligence, and security operations capabilities including alerts, suspicious objects, endpoint actions, email actions, network security, and workbench management. The API exposes 52 endpoints secured with bearer authentication.

## For AI agents

Programmatically list workbench alerts, get alert details. Covers 52 operations with bearer authentication.

## Scope

Does not handle payments, communications, or crm - use for security only.

## Capabilities

- List Workbench Alerts
- Get Alert Details
- Update Alert Status
- Add Suspicious Objects
- Delete Suspicious Objects

## Use cases

### Security Operations

Use the Trend Vision One API to perform security operations programmatically. The API provides 52 endpoints covering core functionality including list workbench alerts, get alert details, update alert status.

Example prompt: Call GET `/v3.0/workbench/alerts` to list workbench alerts

### Automated Alerts Management

Automate alerts operations by combining multiple Trend Vision One API endpoints. Agents can get alert details and then update alert status in a single workflow.

Example prompt: Call GET `/v3.0/workbench/alerts/{alertId}` to get alert details, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Trend Vision One API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle bearer tokens manually.

Example prompt: Search Jentic for 'list workbench alerts', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/v3.0/workbench/alerts` | List Workbench Alerts |
| GET | `/v3.0/workbench/alerts/{alertId}` | Get Alert Details |
| PATCH | `/v3.0/workbench/alerts/{alertId}` | Update Alert Status |
| POST | `/v3.0/threatintel/suspiciousObjects` | Add Suspicious Objects |
| GET | `/v3.0/threatintel/suspiciousObjects` | List Suspicious Objects |
| POST | `/v3.0/threatintel/suspiciousObjects/delete` | Delete Suspicious Objects |
| POST | `/v3.0/threatintel/suspiciousObjectExceptions` | Add Suspicious Object Exceptions |
| GET | `/v3.0/threatintel/suspiciousObjectExceptions` | List Suspicious Object Exceptions |

## Key resources

- **Alerts** — Operations related to Alerts
- **Suspicious Objects** — Operations related to Suspicious Objects
- **Suspicious Object Exceptions** — Operations related to Suspicious Object Exceptions
- **Detection Models** — Operations related to Detection Models
- **Endpoint Actions** — Operations related to Endpoint Actions

## Why Jentic

- **Setup:** Wiring the Trend Vision One API by hand means setting up its bearer token auth and picking the right regional host among the US, Japan, EU, India, Australia, and Singapore endpoints yourself. Through Jentic you install once, import the Trend Vision One API from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** Trend Vision One puts the alert id in the URL path (`/v3.0/workbench/alerts/{alertId}`), so a rule can pin your agent to one alert: it can read that alert and nothing else. You choose the operations it may call, so updating an alert or deleting suspicious objects is not included unless you add it.
- **Credential handling:** Your Trend Vision One API token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list workbench alerts' or 'add a suspicious object', and Jentic returns the matching Trend Vision One API operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Snyk** — Alternative security API
- **Crowdstrike** — Alternative security API

## FAQ

### What authentication does the Trend Vision One API use?

The Trend Vision One API uses a Bearer token in the Authorization header. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I list workbench alerts with the Trend Vision One API?

Yes. Use the GET `/v3.0/workbench/alerts` endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Trend Vision One API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I list workbench alerts through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'list workbench alerts'. Jentic returns the matching Trend Vision One API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Trend Vision One API have?

The Trend Vision One API exposes 52 endpoints covering alerts, suspicious objects, suspicious object exceptions operations.

### Can I limit what my agent is allowed to do with the Trend Vision One API?

Yes. Because Jentic One is self-hosted, you decide which Trend Vision One operations your agent may call, so an action like updating an alert (PATCH `/v3.0/workbench/alerts/{alertId}`) or deleting suspicious objects is off-limits unless you add it. Since the alert id sits in the URL path, a rule can pin the agent to a single alert, letting it read that one alert with GET `/v3.0/workbench/alerts/{alertId}` and nothing else. Your bearer token is held by your own instance and injected only for the operations you approve.