detections
Copy Page
Anzenna Public API
How To Use the Anzenna Public API
data exfiltration
Query database exfiltration events
POST
List file movement activities
POST
Get file movement activity by id
GET
List files used with data exfiltration.
POST
Get a specific data exfiltration file
GET
List git events
POST
Get a specific git event by id
GET
List git repositories
POST
Get a specific git repository
GET
api key
Get API key information
GET
login events
List login events
POST
Get a login event by ID
GET
browser applications
Query all browser applications
POST
Get a browser application by id
GET
List browser application instances
POST
browser history
List browser history entries
POST
data sharing
List file sharing instances
POST
Query database share grants
POST
Query database share user additions
POST
List documents
POST
Get document by id
GET
devices
List devices
Get a device
List USB device connection events
Get a USB connection event
device policies
List device policies
Get a device policy
device applications
List device applications
Get a device application
Query device application instances.
device infections
List device infections
Get a device infection
ide applications
List IDE applications
Get an IDE application
ide application instances
Query IDE application instances.
mcp servers
List MCP servers
Get an MCP server
Query MCP server installations
mfa
Query all mfa statuses
oauth applications
Query all OAuth applications
Get an OAuth application by id
Query all OAuth application instances
passwords
Query all password reuse instances
people
Query all people
Get a person by id
Add a category to multiple people
Remove a category from multiple people
account
List accounts
Get an account by id
phishing interactions
Query all phishing interactions
email flows
Query all outbound email events
Get an outbound email event by id
company wide risk trends
Get company risk trends
high risk organizations
Get number of high risk organizations
detections
Get key finding detections
POST
Get detection details
GET
List users associated with a given detection
GET
events
List security events
shadow it
Query all Shadow IT instances
web host
Query all web host resources
Get a web host resource by id
advanced query
Execute an advanced query
sources
Query raw events
allowlist
Query all allowlists
Create a new allowlist
Delete an allowlist
Update an allowlist
detections
Copy Page
List users associated with a given detection
GET
/detections/{detection_id}/users
Try it
Run in Apidog
Run in Apidog
Fetches a list of unique user email addresses involved in a given detection.
Returns distinct emails of people impacted by the detection based on the detection's
filters and security event type.
Request
Authorization
Path Params
Generate Code
Responses
🟢
200
OK
application/json
Successful operation
Body
application/json
Generate Code
ðŸŸ
401
Unauthorized
ðŸŸ
403
Forbidden
ðŸŸ
404
Record Not Found
Request
Request Example
Shell
JavaScript
Java
Swift
cURL
cURL-Windows
Httpie
wget
PowerShell
curl
--location
'/detections//users'
Response
Response Example
{
"users"
:
[
"alice@example.com"
,
"bob@example.com"
]
}
Modified atÂ
2026-03-31 19:28:57
Previous
Get detection details
Next
List security events