Detection
Copy Page
Anzenna Public API
How To Use the Anzenna Public API
AI Governance
Query all Shadow AI instances
POST
Get a Shadow AI instance by id
GET
Query all AI interactions
POST
Get an AI interaction by id
GET
List MCP servers
POST
Get an MCP server
GET
Query MCP server installations
POST
Investigation
Query all investigations
POST
Start an investigation
POST
Get an investigation by id
GET
Dismiss an investigation
POST
Get detection investigation prompts
GET
Get global investigation prompts
GET
Get user investigation prompts
GET
Query all risk registers
POST
Query all risk register catalog entries
POST
Identity
List accounts
POST
Get an account by id
GET
List login events
POST
Get a login event by ID
GET
Query all mfa statuses
POST
Get an MFA status by id
GET
Query all OAuth applications
POST
Get an OAuth application by id
GET
Query all OAuth application instances
POST
Query all password reuse instances
POST
Advanced
Execute an advanced query
List security events
Receive a webhook event
Query raw events
Detection
Query all allowlists
GET
Create a new allowlist
POST
Delete an allowlist
DELETE
Update an allowlist
PUT
Get an anomaly by ID
GET
Get key finding detections
POST
Get detection details
GET
List users associated with a given detection
GET
Execute a remediation
POST
Browser
Query all browser applications
Get a browser application by id
List browser application instances
List browser history entries
Query all remote machines
Get a remote machine by id
Query all web host resources
Get a web host resource by id
Data & IP
Query database exfiltration events
List file delete events
List file movement activities
Get file movement activity by id
List files used with data exfiltration.
Get a specific data exfiltration file
List git events
Get a specific git event by id
List git repositories
Get a specific git repository
List file sharing instances
Query database share grants
Query database share user additions
List documents
Get document by id
List DLP policies
Get a DLP policy by id
List DLP policy detectors
Query all DLP alerts
Get a DLP alert by id
Device
List devices
Get a device
List device applications
Get a device application
Query device application instances.
List device infections
Get a device infection
List device policies
Get a device policy
List USB device connection events
Get a USB connection event
List IDE applications
Get an IDE application
Query IDE application instances.
Email
Query all outbound email events
Get an outbound email event by id
Query all phishing interactions
Company
List groups
Query all people
Get departure analysis for a person
Get a person by id
Add a category to multiple people
Remove a category from multiple people
Get company risk trends
Get number of high risk organizations
SaaS
Query all Shadow IT instances
Outreach
List training campaigns
Create a training campaign
API Key
Get API key information
Detection
Copy Page
List users associated with a given detection
GET
/detections/{detection_id}/users
Try it
Run in Apidog
Run in Apidog
Fetches a list of unique user email addresses involved in a given detection.
Returns distinct emails of people impacted by the detection based on the detection's
filters and security event type.
Request
Authorization
Path Params
Generate Code
Responses
🟢
200
OK
application/json
Successful operation
Body
application/json
Generate Code
ðŸŸ
401
Unauthorized
ðŸŸ
403
Forbidden
ðŸŸ
404
Record Not Found
Request
Request Example
Shell
JavaScript
Java
Swift
cURL
cURL-Windows
Httpie
wget
PowerShell
curl
--location
'/detections//users'
Response
Response Example
{
"users"
:
[
"alice@example.com"
,
"bob@example.com"
]
}
Modified atÂ
2026-10-20 18:32:30
Previous
Get detection details
Next
Execute a remediation