API ReferenceTalon Studio v1.0.2-beta

Validation

Read a workspace's validation readiness rollup.

Get validation summary

GET/api/v1/validate/summaryvalidate:read

The workspace's validation rollup: the readiness spine (can each detection run in the SIEM), the optional simulation results, and drift, gap and noise signals. Returned as a flat object, with no data envelope.

Query parameters

workspaceIdstring (UUID)

Required with an org-scoped token; a workspace-bound token uses its own workspace.

Response

totalinteger

readyinteger

Readiness spine — detections whose environment-readiness check passes.

notReadyinteger

readinessUnknowninteger

readinessScoreinteger

0–100 — ready as a share of total.

simPassinginteger

Simulation results (replay and other efficacy runs) — a bonus signal, never a blocker.

simFailinginteger

simNotRuninteger

driftDetectedinteger

degradedinteger

openGapsinteger

driftAlertsarray

Each: detectionId, name, techniqueId (nullable), streamName (nullable), status, lastResult (nullable), driftDetected, firstDetectedAt (nullable), failureReason (nullable).

noisyDetectionsarray

Detections whose triage outcomes over the last 30 days (SOC case dispositions and manual feedback) skew false-positive: at least 5 classified outcomes with a false-positive rate of 60% or more. Each: detectionId, name, total, falsePositives, fpRate.

The response also carries the legacy aliases passing, failing, notValidated and coverageScore, which mirror the readiness-spine fields for older consumers. Prefer the named fields above.

Request

curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/validate/summary?workspaceId=…"

Response

{
  "total": 24,
  "ready": 18,
  "notReady": 4,
  "readinessUnknown": 2,
  "readinessScore": 75,
  "simPassing": 9,
  "simFailing": 1,
  "simNotRun": 14,
  "driftDetected": 1,
  "degraded": 0,
  "openGaps": 3,
  "driftAlerts": [],
  "noisyDetections": []
}