Retrieve suggested items and identify asynchronous suggestion groups.
Key Concept
There are two types of suggestion payloads:
- Without async group information — Returns initial suggestions and async group identifiers.
- With async group information — Used to fetch async suggestion results separately.
Example
- Entity: Investigation
- Total suggestion rules: 5
- Async rules: 2 (IDs: 12, 13)
Behaviour
- For the async groups, separate API calls must be sent.
- The remaining 3 suggestion rules are included in the initial API call itself.
- 2 suggestions → require separate async API calls.
HTTP Method
POST
Endpoint
/api/engine/suggestion/run
Request URL
{Base URL}/api/engine/suggestion/run
Sample Request Body
{
"QueryInfo": {
"Meta": {},
"Nodes": [
{
"Id": "Node0",
"Queries": [
{
"Name": "Investigation"
}
],
"FilterByTeam": true
}
],
"Hints": {
"AsyncRuleInputInfo": {},
"SuggestionFetcherType": "Promoted"
}
},
"VizInfo": {
"IntelVizLayoutName": "GridTableLayout"
}
}
Parameters
| Param Name | Data Type | Description |
|---|---|---|
| Name | String | Entity type (for example, Investigation, Domain) |
| FilterGroupJoinCondition | Condition | Logical operator used to combine filters. AND / OR. |
| FilterByTeam | Boolean | true - Returns only entities within your organization/team. false - Returns entities across the system, regardless of organization/team. |
| SuggestionFetcherType | String | Type of suggestion logic to apply (for example, Promoted) |
| IntelVizLayoutName | String | Layout type. For example, GridTableLayout. |
Missing or invalid credentials returns a 401 Unauthorized error.
Curl Example
Multi-line format (for readability)
curl --header "Accept-Language: en" \
--http1.1 \
--insecure \
--verbose \
--ntlm \
--user "device-name1\jdoe:P@ssw0rd" \
-X POST \
"https://hubstreamproduction.hubstreamonline.com/api/engine/suggestion/run" \
-H "Content-Type: application/json" \
-d '{
"QueryInfo": {
"Meta": {},
"Nodes": [
{
"Id": "Node0",
"Queries": [
{
"Name": "Investigation"
}
],
"FilterByTeam": true
}
],
"Hints": {
"AsyncRuleInputInfo": {},
"SuggestionFetcherType": "Promoted"
}
},
"VizInfo": {
"IntelVizLayoutName": "GridTableLayout"
}
}'
Single-line format (for terminal use)
curl --header "Accept-Language: en" --http1.1 --insecure --verbose --ntlm --user "device-name1\jdoe:P@ssw0rd" -X POST "https://hubstreamproduction.hubstreamonline.com/api/engine/suggestion/run" -H "Content-Type: application/json" -d "{\"QueryInfo\":{\"Meta\":{},\"Nodes\":[{\"Id\":\"Node0\",\"Queries\":[{\"Name\":\"Investigation\"}],\"FilterByTeam\":true}],\"Hints\":{\"AsyncRuleInputInfo\":{},\"SuggestionFetcherType\":\"Promoted\"}},\"VizInfo\":{\"IntelVizLayoutName\":\"GridTableLayout\"}}"
Sample Responses
Status code 2XX indicates a successful request and response.
200 OK
Description: Operation succeeded
Response Body
{
"SuggestionItems": [
{
"Name": "IOTGo",
"Caption": "Task",
"Description": "Go to All Tasks at Closest Level",
"Count": 0,
"Type": "Single",
"LinkEntityName": "Task",
"LinkLevel": "Closest",
"IsPromoted": true,
"IsAsync": true,
"AsyncGroupName": "AsyncGroup-QhOl4",
"Icon": "hourglass",
"RuleID": 70
},
{
"Name": "W3Dma",
"Caption": "URLs",
"Description": "Go to All URLs at Closest Level",
"Count": 1,
"Type": "Single",
"LinkEntityName": "URL",
"LinkLevel": "Closest",
"IsPromoted": true,
"Icon": "link",
"RuleID": 67
}
],
"AsyncGroupMap": {
"AsyncGroup-QhOl4": [
{
"ID": 70,
"FilteredEntities": [11]
}
]
}
}
Response Explanation
| Field | Type | Description |
|---|---|---|
| Name | string | Internal identifier of the suggestion |
| Caption | string | Display name shown in UI |
| Description | string | Description of the suggestion |
| Count | integer | Number of related linked entities |
| Type | string | Suggestion type (e.g., Single) |
| LinkEntityName | string | Entity linked to the suggestion |
| LinkLevel | string | Relationship level (e.g., Closest) |
| IsPromoted | boolean | Indicates if the suggestion is promoted |
| IsAsync | boolean | Indicates if data is fetched asynchronously |
| AsyncGroupName | string | Group identifier for async suggestions |
| Icon | string | Icon used in UI |
| RuleID | integer | Identifier of the rule generating the suggestion |