Create an Actor

post

https://example.com/public/v1/entities/actors

Create a new actor. Request body is an ActorCorrelation object (not wrapped in a property). Provide adescription that explains the person or entity, and a risk_level (high, low,or escalated) so automated agents can prioritize correlated content. Optional fieldsinclude primary_entity_id, primary_entity_type, user_identifier, tags, and groups.Omit actor_id to receive a server-generated ID. When risk_level is escalated, setescalated_till to a future UTC timestamp.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Actor to create. Set description and risk_level for automated analysis; actor_id is optional.

actor_id

string

Unique actor ID. Optional on create; omitted values receive a server-generated ID.

organization_id

string

Your organization ID (set automatically on create).

description

string

Human-readable summary of who or what this actor represents. Automated agents use this text together with risk_level when analyzing correlated users, hosts, and security content.

primary_entity_id

string

Primary identifier for the actor (for example a canonical user or host ID from your environment).

primary_entity_type

string

Type of the primary entity (for example user, host, or service account).

nebulock_provider_name

string

Source of the record. API-created actors typically use api.

user_identifier

string

Display label for the actor (for example an email or friendly name shown in search results).

users

array | null

Users linked to this actor.

hosts

array | null

Hosts linked to this actor.

searchable

string

Indexed text used for keyword search (derived from description, users, hosts, and tags).

risk_level

string

Defaults to low

How urgently this actor should be handled: high, low, or escalated. Automated agents use risk_level with the description to prioritize analysis.

escalated_till

When risk_level is escalated, UTC time until the escalation automatically expires.

nebulock_tags

array | null

Platform-managed tags on this actor.

all_tags

array | null

Combined tags from the actor and linked users/hosts.

all_groups

array | null

Combined groups from the actor and linked users/hosts.

created_at

When this actor was created (UTC).

updated_at

When this actor was last updated (UTC).

modified

boolean

Defaults to false

Whether the actor has been modified

Headers

X-API-Key-ID

string

required

Your API Key ID

X-API-Key-Secret

string

Your API Key Secret

Responses

200Successful Response

422Validation Error