> ## Documentation Index > Fetch the complete documentation index at: https://docs.truu.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get structured persona detail for a user > Structured projection of the user's identity persona: declared identity, observed role, workstreams (with cited artifacts and collaborators), scanned access inventories (entitlements, applications, privileged grants), IAM/NHI posture, and a coarse risk lens. The communication graph, item-level NHI detail, sign-in method/network patterns, and free-text risk narratives are never exposed on this endpoint. ## OpenAPI ````yaml https://eris.platform.total.truu.ai/api/v1/external/docs get /personas/{tuid}/detail openapi: 3.0.3 info: title: TOTAL Public API version: 2.3.10 description: > The TOTAL API gives you programmatic access to your organization's security data. Use it to query cases and threat events, and to feed verdicts back into the platform. ## Authentication All routes in this specification are served under `/api/v1/external` and require a domain-scoped API key via the `X-API-Key` header. Generate and manage keys from the API Keys page in Settings. The admin console (Atlas) uses separate JWT-authenticated routes under `/api/v1/eris/...` (for example `GET /api/v1/eris/integrations`); those are not part of this public API surface. ## Pagination List routes use cursor pagination: `page_size` (default 50, max 200) and optional `next_cursor` (pass the `case_id` or `event_id` UUID from the last item of the previous page). Responses include `next_cursor` when more results are available. ## Rate Limits Read endpoints in this API are limited to 1,000 requests/minute. Write endpoints in this API are limited to 200 requests/minute. ## Availability Some routes may return `423 Locked` when the requested data is not yet available for your domain. --- ## Appendix A — Azure Log Analytics: source_event_ids → KQL lookup Threat events include a `source_event_ids` array. Each value is the `_ItemId` of the originating row in your Azure Log Analytics workspace — the per-row GUID stamped by Log Analytics at ingest. It is row-unique on every supported table, so the same lookup pattern works regardless of source: | where _ItemId == "" Run the lookup against your Log Analytics workspace (the same workspace that backs Azure Log Analytics / Defender XDR Advanced Hunting). Use the `source` field on the event to pick the table. | Source table | KQL field | Example KQL | |---|---|---| | SigninLogs | _ItemId | `SigninLogs | where _ItemId == ""` | | AuditLogs | _ItemId | `AuditLogs | where _ItemId == ""` | | AADUserRiskEvents | _ItemId | `AADUserRiskEvents | where _ItemId == ""` | | CloudAppEvents | _ItemId | `CloudAppEvents | where _ItemId == ""` | | OfficeActivity | _ItemId | `OfficeActivity | where _ItemId == ""` | | EmailEvents | _ItemId | `EmailEvents | where _ItemId == ""` | | EmailPostDeliveryEvents | _ItemId | `EmailPostDeliveryEvents | where _ItemId == ""` | | EmailUrlInfo | _ItemId | `EmailUrlInfo | where _ItemId == ""` | | EmailAttachmentInfo | _ItemId | `EmailAttachmentInfo | where _ItemId == ""` | | UrlClickEvents | _ItemId | `UrlClickEvents | where _ItemId == ""` | | SecurityEvent | _ItemId | `SecurityEvent | where _ItemId == ""` | | IdentityLogonEvents | _ItemId | `IdentityLogonEvents | where _ItemId == ""` | | IdentityQueryEvents | _ItemId | `IdentityQueryEvents | where _ItemId == ""` | | IdentityDirectoryEvents | _ItemId | `IdentityDirectoryEvents | where _ItemId == ""` | | BehaviorAnalytics | _ItemId | `BehaviorAnalytics | where _ItemId == ""` | | Anomalies | _ItemId | `Anomalies | where _ItemId == ""` | | AzureActivity | _ItemId | `AzureActivity | where _ItemId == ""` | | MicrosoftPurviewInformationProtection | _ItemId | `MicrosoftPurviewInformationProtection | where _ItemId == ""` | | CommonSecurityLog | _ItemId | `CommonSecurityLog | where _ItemId == ""` | | Syslog | _ItemId | `Syslog | where _ItemId == ""` | | AADProvisioningLogs | _ItemId | `AADProvisioningLogs | where _ItemId == ""` | servers: - url: https://eris.platform.total.truu.ai/api/v1/external description: TOTAL Public API security: - ApiKeyAuth: [] tags: - name: Cases description: Threat investigation cases and verdicts - name: Users description: Provisioned users and monitoring - name: Personas description: Persona overviews - name: Threats description: Raw threat events paths: /personas/{tuid}/detail: get: tags: - Personas summary: Get structured persona detail for a user description: | Structured projection of the user's identity persona: declared identity, observed role, workstreams (with cited artifacts and collaborators), scanned access inventories (entitlements, applications, privileged grants), IAM/NHI posture, and a coarse risk lens. The communication graph, item-level NHI detail, sign-in method/network patterns, and free-text risk narratives are never exposed on this endpoint. operationId: getPersonaDetail parameters: - name: tuid in: path required: true schema: type: string format: uuid responses: '200': description: Persona detail or placeholder when none exists yet content: application/json: schema: oneOf: - $ref: '#/components/schemas/PersonaDetail' - $ref: '#/components/schemas/PersonaMissing' '400': description: Invalid path parameters content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Invalid or inactive API key content: application/json: schema: $ref: '#/components/schemas/Error' '423': description: Resource not ready yet for this domain content: application/json: schema: $ref: '#/components/schemas/ResourceNotReady' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: PersonaDetail: type: object description: > Structured persona projection. Sections are null when the underlying data is unavailable; `coverage` reports per-section data sufficiency. properties: tuid: type: string format: uuid generated_at: type: string format: date-time nullable: true contract_version: type: integer overview: type: object nullable: true properties: summary: type: string nullable: true key_points: type: array items: type: string nullable: true identity: type: object nullable: true properties: name: type: string nullable: true email: type: string nullable: true title: type: string nullable: true department: type: string nullable: true manager: type: string nullable: true admin_account: type: string nullable: true account_created: type: string nullable: true account_age: type: string nullable: true role: type: object nullable: true properties: observed_role: type: string nullable: true title_match: type: string nullable: true confidence: type: number nullable: true workstreams: type: object nullable: true properties: summary: type: string nullable: true items: type: array nullable: true items: type: object properties: name: type: string nullable: true description: type: string nullable: true systems: type: array nullable: true description: >- Generator-cited artifacts (documents, email and meeting subjects). items: type: string collaborators: type: array items: type: string nullable: true access: type: object nullable: true properties: summary: type: string nullable: true directory_role_count: type: integer nullable: true privileged_entitlement_count: type: integer nullable: true privileged_classes: type: array nullable: true description: Distinct privilege class labels held (e.g. approver, owner). items: type: string application_count: type: integer nullable: true dormant_entitlement_count: type: integer nullable: true applications: type: array nullable: true description: Application names observed for the identity. items: type: string privileges: type: array nullable: true description: Privileged grants held by the identity. items: type: object properties: name: type: string nullable: true privilege_class: type: string nullable: true source: type: string nullable: true entitlements: type: array nullable: true description: >- Full scanned entitlement inventory; null for personas generated before it existed. items: $ref: '#/components/schemas/PersonaEntitlement' posture: type: object nullable: true properties: device_classes: type: array items: type: string nullable: true os_types: type: array items: type: string nullable: true signin_active_days: type: integer nullable: true signin_total_logons: type: integer nullable: true nhi: type: object nullable: true properties: service_account_count: type: integer nullable: true service_principal_count: type: integer nullable: true oauth_grant_count: type: integer nullable: true agent_count: type: integer nullable: true owns_secrets: type: boolean nullable: true can_create_agents: type: boolean nullable: true risk_lens: type: object nullable: true properties: blast_radius: type: string nullable: true reaches_control_plane: type: boolean nullable: true dormant_count: type: integer nullable: true credential_exposure: type: string nullable: true anomaly_count: type: integer nullable: true coverage: type: object nullable: true description: Per-section data-sufficiency verdicts. additionalProperties: type: string enum: - present - confirmed-empty - partial - truncated - sparse - absent PersonaMissing: type: object properties: tuid: type: string format: uuid persona_overview: type: string nullable: true Error: type: object properties: error: type: string ResourceNotReady: type: object properties: error: type: string description: Always `resource_not_ready` resource: type: string description: One of `cases`, `threats`, `personas` message: type: string description: Human-readable readiness status message details: type: string description: Resource-specific not-ready detail days_until_ready: type: number format: float description: Days remaining until the resource is available external_api_enabled_at_utc: type: string format: date-time now_utc: type: string format: date-time PersonaEntitlement: type: object description: > One held entitlement. `*_source: inferred` fields are name-derived heuristics, not telemetry facts — present them as such. properties: name: type: string type: type: string enum: - group - directory_role - application - access_package assignment: type: string enum: - birthright - assigned - role - observed-signin assignment_source: type: string enum: - sourced - inferred privileged: type: boolean privileged_source: type: string enum: - sourced - inferred access_domain: type: string nullable: true first_seen: type: string nullable: true last_used: type: string nullable: true peer_prevalence: type: number nullable: true description: Fraction of the user's peers holding this entitlement. securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: | Domain-scoped API key. Generate and manage keys from the API Keys page in Settings. Accepted in two forms: - `X-API-Key: ` header (preferred) - `Authorization: Bearer ` header (also accepted) ````