> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Recommend hunt pivots

## Scope and credits

| Requirement     | Value                 |
| --------------- | --------------------- |
| Required scopes | `read:hunt_pivots`    |
| Credits         | 8 credits per request |


## OpenAPI

````yaml POST /v2/hunt-pivots
openapi: 3.1.0
info:
  description: Deterministic, evidence-backed threat assessment API for machine consumers.
  title: Threat Investigator API v2
  version: 0.1.0
servers: []
security: []
paths:
  /v2/hunt-pivots:
    post:
      tags:
        - Hunt Pivots
      summary: Ranked hunt pivot recommendations
      operationId: hunt_pivots_v2_hunt_pivots_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HuntPivotRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HuntPivotResponse'
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - ApiKeyAuth: []
components:
  schemas:
    HuntPivotRequest:
      additionalProperties: false
      properties:
        agent_context:
          anyOf:
            - $ref: '#/components/schemas/AgentContext'
            - type: 'null'
        environment_context:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Environment Context
        observed:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Observed
        options:
          $ref: '#/components/schemas/HuntPivotOptions'
        subject:
          anyOf:
            - $ref: '#/components/schemas/AssessmentSubject'
            - type: 'null'
      title: HuntPivotRequest
      type: object
    HuntPivotResponse:
      properties:
        caveats:
          items:
            type: string
          title: Caveats
          type: array
        likely_attack_chains:
          items:
            $ref: '#/components/schemas/HuntAttackChain'
          title: Likely Attack Chains
          type: array
        metadata:
          additionalProperties: true
          title: Metadata
          type: object
        mode:
          enum:
            - subject_led
            - observation_led
          title: Mode
          type: string
        next_decision:
          additionalProperties:
            type: string
          title: Next Decision
          type: object
        recommended_pivots:
          items:
            $ref: '#/components/schemas/RecommendedHuntPivot'
          title: Recommended Pivots
          type: array
        resolution_status:
          enum:
            - resolved
            - unresolved
            - not_applicable
          title: Resolution Status
          type: string
        subject:
          anyOf:
            - $ref: '#/components/schemas/AssessmentSubject'
            - type: 'null'
      required:
        - mode
        - resolution_status
        - likely_attack_chains
        - recommended_pivots
        - next_decision
        - caveats
        - metadata
      title: HuntPivotResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    AgentContext:
      additionalProperties: false
      properties:
        client:
          anyOf:
            - $ref: '#/components/schemas/AgentClientInfo'
            - type: 'null'
        constraints:
          anyOf:
            - $ref: '#/components/schemas/AgentConstraints'
            - type: 'null'
        objective:
          maxLength: 280
          minLength: 8
          title: Objective
          type: string
        parent_step_id:
          anyOf:
            - maxLength: 64
              type: string
            - type: 'null'
          title: Parent Step Id
        priority:
          anyOf:
            - enum:
                - low
                - normal
                - high
                - urgent
              type: string
            - type: 'null'
          title: Priority
        requested_outcome:
          maxLength: 280
          minLength: 3
          title: Requested Outcome
          type: string
        run_id:
          maxLength: 64
          minLength: 4
          title: Run Id
          type: string
        step_id:
          maxLength: 64
          minLength: 1
          title: Step Id
          type: string
        tags:
          anyOf:
            - items:
                type: string
              maxItems: 12
              type: array
            - type: 'null'
          title: Tags
        workflow_stage:
          enum:
            - resolve
            - evidence
            - relationships
            - assessment
            - hunt
            - hydrate
            - batch
            - finalize
            - other
          title: Workflow Stage
          type: string
      required:
        - objective
        - requested_outcome
        - workflow_stage
        - run_id
        - step_id
      title: AgentContext
      type: object
    HuntPivotOptions:
      additionalProperties: false
      properties:
        include_attack_chains:
          default: true
          title: Include Attack Chains
          type: boolean
        max_pivots:
          default: 10
          maximum: 20
          minimum: 1
          title: Max Pivots
          type: integer
      title: HuntPivotOptions
      type: object
    AssessmentSubject:
      additionalProperties: false
      properties:
        canonical_id:
          title: Canonical Id
          type: string
        canonical_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Canonical Name
        entity_type:
          title: Entity Type
          type: string
      required:
        - entity_type
        - canonical_id
      title: AssessmentSubject
      type: object
    HuntAttackChain:
      properties:
        chain_id:
          title: Chain Id
          type: string
        confidence:
          title: Confidence
          type: number
        evidence_refs:
          items:
            type: string
          title: Evidence Refs
          type: array
        steps:
          items:
            $ref: '#/components/schemas/HuntAttackChainStep'
          title: Steps
          type: array
      required:
        - chain_id
        - confidence
        - steps
      title: HuntAttackChain
      type: object
    RecommendedHuntPivot:
      properties:
        caveats:
          items:
            type: string
          title: Caveats
          type: array
        confidence:
          title: Confidence
          type: number
        evidence_refs:
          items:
            type: string
          title: Evidence Refs
          type: array
        pivot_type:
          enum:
            - telemetry_search
            - ioc_expansion
            - technique_hunt
            - asset_exposure_check
            - identity_pivot
            - network_pivot
            - process_pivot
            - case_escalation
            - suppression_check
          title: Pivot Type
          type: string
        priority:
          enum:
            - low
            - medium
            - high
            - critical
          title: Priority
          type: string
        query_intent:
          title: Query Intent
          type: string
        question:
          title: Question
          type: string
        related_entities:
          items:
            additionalProperties: true
            type: object
          title: Related Entities
          type: array
        required_fields:
          items:
            type: string
          title: Required Fields
          type: array
        time_window:
          anyOf:
            - type: string
            - type: 'null'
          title: Time Window
        why:
          title: Why
          type: string
      required:
        - pivot_type
        - priority
        - question
        - query_intent
        - why
        - confidence
        - required_fields
      title: RecommendedHuntPivot
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
    AgentClientInfo:
      additionalProperties: false
      properties:
        agent_name:
          anyOf:
            - maxLength: 64
              type: string
            - type: 'null'
          title: Agent Name
        agent_version:
          anyOf:
            - maxLength: 32
              type: string
            - type: 'null'
          title: Agent Version
        framework:
          anyOf:
            - maxLength: 32
              type: string
            - type: 'null'
          title: Framework
      title: AgentClientInfo
      type: object
    AgentConstraints:
      additionalProperties: false
      properties:
        latency_budget_ms:
          anyOf:
            - maximum: 30000
              minimum: 50
              type: integer
            - type: 'null'
          title: Latency Budget Ms
        max_results_budget:
          anyOf:
            - maximum: 200
              minimum: 1
              type: integer
            - type: 'null'
          title: Max Results Budget
        min_resolution_confidence:
          anyOf:
            - maximum: 1
              minimum: 0
              type: number
            - type: 'null'
          title: Min Resolution Confidence
        strict_mode:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Strict Mode
      title: AgentConstraints
      type: object
    HuntAttackChainStep:
      properties:
        reason:
          title: Reason
          type: string
        tactic:
          title: Tactic
          type: string
        technique:
          anyOf:
            - type: string
            - type: 'null'
          title: Technique
      required:
        - tactic
        - reason
      title: HuntAttackChainStep
      type: object
  securitySchemes:
    ApiKeyAuth:
      description: ApiKey <key_id>:<secret>
      in: header
      name: Authorization
      type: apiKey

````