Add documentation for API 4.0 endpoints equivalence table

[davidjiglesias]

Hello team,

With the development of new API 4.0 we should include a table of equivalences between old API endpoints and new ones as well as changes in the output and/or parameters for those endpoints.

Tasks:

• Review all the old API endpoints and write a table to link them with the new endpoints, detailing any changes that may change the usage.
• Review and update new API CHANGES.MD with all current changes

[CarlosRS9]

Status update

Here is the equivalence table for the /agents endpoint:

Agents	API 3.x usage	API 4.0 usage	Differences
Delete agents	DELETE /agents	DELETE /agents	Use the list_agents parameter instead of ids to indicate which agents must be deleted. If no list_agents is provided all agents will be removed.
Delete an agent	DELETE /agents/{agent_id}	DELETE /agents	Use the list_agents parameter to indicate which agents must be deleted.
Remove all agents groups	DELETE /agents/{agent_id}/group	DELETE /agents/{agent_id}/group	The new version works in the same way but its also allows the user to indicate which groups should be removed from the agent by using the list_groups parameter.
Remove a single group of an agent	DELETE /agents/{agent_id}/group/{group_id}	DELETE /agents/{agent_id}/group	Use the list_groups parameter to indicate which group must be removed from the agent.
Remove a single group of multiple agents	DELETE /agents/group/{group_id}	DELETE /agents/group/	Use the list_agents parameter to indicate from which agents the group should me removed.
Delete a list of groups	DELETE /agents/groups	DELETE /groups	The new version can delete all groups or a list of them. Use the list_groups to choose which ones should be deleted.
Remove a group	DELETE /agents/groups/{group_id}	DELETE /groups	Use the list_groups parameter to indicate which group must be deleted.
Get all agents	GET /agents	GET /agents	The usage is the same in API 4.0.
Get an agent	GET /agents/{agent_id}	GET /agents	Use the list_agents parameter to indicate from which agents you want to get the information.
Get active configuration	GET /agents/{agent_id}/config/{component}/{configuration}	GET /agents/{agent_id}/config/{component}/{configuration}	The usage is the same in API 4.0.
Get sync status of agent	GET /agents/{agent_id}/group/is_sync	GET /agents/{agent_id}/group/is_sync	The usage is the same in API 4.0.
Get agent key	GET /agents/{agent_id}/key	GET /agents/{agent_id}/key	The usage is the same in API 4.0.
Get upgrade result from agent	GET /agents/{agent_id}/upgrade_result	GET /agents/{agent_id}/upgrade_result	The usage is the same in API 4.0.
Get groups	GET /agents/groups	GET /groups	The new endpoint works in the same way by default.
Get agents in a group	GET /agents/groups/{group_id}	GET /groups	Use the list_groups parameter to indicate from which group you want to get the information.
Get group configuration	GET /agents/groups/{group_id}/configuration	GET /groups/{group_id}/configuration	The usage is the same in API 4.0.
Get group files	GET /agents/groups/{group_id}/files	GET /groups/{group_id}/files	The usage is the same in API 4.0.
Get a file in group	GET /agents/groups/{group_id}/files/{filename}	GET /groups/{group_id}/files/{filename}/json or GET /groups/{group_id}/files/{filename}/xml	The new endpoint allows the user to get the specified group file parsed to JSON or XML.
Get an agent by its name	GET /agents/name/{agent_name}	GET /agents	Use the name parameter to indicate from which agent you want to get the information.
Get agents without group	GET /agents/no_group	GET /agents/no_group	The usage is the same in API 4.0.
Get outdated agents	GET /agents/outdated	GET /agents/outdated	The usage is the same in API 4.0.
Get distinct fields in agents	GET /agents/stats/distinct	GET /agents/stats/distinct	The usage is the same in API 4.0.
Get agents summary	GET /agents/summary	GET /agents/summary/status	The new Endpoint works in the same way.
Get OS summary	GET /agents/summary/os	GET /agents/summary/os	The usage is the same in API 4.0.
Add agent	POST /agents	POST /agents	The usage is the same in API 4.0.
Add a list of agents to a group	POST /agents/group/{group_id}	PUT /agents/group	Use PUT instead of POST and specify the group id using the group_id parameter.
Put configuration file (agent.conf) into a group	POST /agents/groups/{group_id}/configuration	PUT /groups/{group_id}/configuration	The new endpoint works in the same way but using PUT.
Upload file into a group	POST /agents/groups/{group_id}/files/{file_name}	PUT /groups/{group_id}/configuration	The new endpoint is used to update the group configuration. Use PUT instead of POST.
Insert agent			POST /agents/insert
Restart a list of agents	POST /agents/restart	PUT /agents/restart	Works the same way but using PUT instead of POST.
Add agent group	PUT /agents/{agent_id}/group/{group_id}	PUT /agents/{agent_id}/group/{group_id}	The usage is the same in API 4.0.
Restart an agent	PUT /agents/{agent_id}/restart	PUT /agents/{agent_id}/restart	The usage is the same in API 4.0.
Upgrade agent using online repository	PUT /agents/{agent_id}/upgrade	PUT /agents/{agent_id}/upgrade	The usage is the same in API 4.0.
Upgrade agent using custom file	PUT /agents/{agent_id}/upgrade_custom	PUT /agents/{agent_id}/upgrade_custom	The usage is the same in API 4.0.
Add agent (quick method)	PUT /agents/{agent_name}	POST /agents/insert/quick	Use POST instead of PUT and the agent_name parameter to specify the name of the new agent.
Create a group	PUT /agents/groups/{group_id}	POST /groups	Use POST instead of PUT and the group_id parameter to specify the name of the new group.
Restart agents which belong to a group	PUT /agents/groups/{group_id}/restart	PUT /groups/{group_id}/restart	The usage is the same in API 4.0.
Restart all agents	PUT /agents/restart	PUT /agents/restart	The usage is the same in API 4.0.

[CarlosRS9]

Status Update

Here are more equivalence tables, this time for Active Response, Cache and Ciscat.

Active Response

Active Response	API 3.x usage	API 4.0 usage	Differences
Run an AR command in the agent	PUT /active-response/{agent_id}	PUT /active-response/	Active Response will now run commands in all agents by default. If you want to apply it to only one agent or a list of agents use the list_agents parameter instead of specifying the agent_id in the URL

Cache

Cache	API 3.x usage	API 4.0 usage	Differences
Delete cache index	DELETE /cache	None	Not needed anymore. Cache is managed by the cluster.
Clear group cache	DELETE /cache/{group}	None	Not needed anymore. Cache is managed by the cluster.
Get cache index	GET /cache	None	Not needed anymore. Cache is managed by the cluster.
Return cache configuration	GET /cache/config	GET /cluster/api/config	The current cache configuration now can be retrieved with the cluster endpoint.

Ciscat

Ciscat	API 3.x usage	API 4.0 usage	Differences
Get CIS-CAT results from an agent	GET /ciscat/{agent_id}/results	GET /ciscat/{agent_id}/results	The usage is the same in API 4.0.

[CarlosRS9]

Status Update

Equivalence table for Cluster

Cluster	API 3.x usage	API 4.0 usage	Differences
Delete a remote file in a cluster node	DELETE /cluster/{node_id}/files	DELETE /cluster/{node_id}/files	The usage is the same in API 4.0.
Get active configuration in node node_id	GET /cluster/{node_id}/config/{component}/{configuration}	GET /cluster/{node_id}/configuration/{component}/{configuration}	The usage is the same in API 4.0 but “config” has been renamed to “configuration” in the endpoint.
Get node node_id’s configuration	GET /cluster/{node_id}/configuration	GET /cluster/{node_id}/configuration	The usage is the same in API 4.0.
Check Wazuh configuration in a cluster node	GET /cluster/{node_id}/configuration/validation	GET /cluster/configuration/validation	Use this endpoint to check if Wazuh configuration is correct for al cluster nodes or use list_nodes parameter to check only for a list of nodes.
Get local file from any cluster node	GET /cluster/{node_id}/files	GET /cluster/{node_id}/files	The usage is the same in API 4.0.
Get node_id’s information	GET /cluster/{node_id}/info	GET /cluster/{node_id}/info	The usage is the same in API 4.0.
Get ossec.log from a specific node in cluster.	GET /cluster/{node_id}/logs	GET /cluster/{node_id}/logs	The usage is the same in API 4.0.
Get summary of ossec.log from a specific node in cluster.	GET /cluster/{node_id}/logs/summary	GET /cluster/{node_id}/logs/summary	The usage is the same in API 4.0.
Get node node_id’s stats	GET /cluster/{node_id}/stats	GET /cluster/{node_id}/stats	The usage is the same in API 4.0.
Get node node_id’s analysisd stats	GET /cluster/{node_id}/stats/analysisd	GET /cluster/{node_id}/stats/analysisd	The usage is the same in API 4.0.
Get node node_id’s stats by hour	GET /cluster/{node_id}/stats/hourly	GET /cluster/{node_id}/stats/hourly	The usage is the same in API 4.0.
Get node node_id’s remoted stats	GET /cluster/{node_id}/stats/remoted	GET /cluster/{node_id}/stats/remoted	The usage is the same in API 4.0.
Get node node_id’s stats by week	GET /cluster/{node_id}/stats/weekly	GET /cluster/{node_id}/stats/weekly	The usage is the same in API 4.0.
Get node node_id’s status	GET /cluster/{node_id}/status	GET /cluster/{node_id}/status	The usage is the same in API 4.0.
Get the cluster configuration	GET /cluster/config	GET /cluster/local/config	Use the cluster/local/config endpoint instead. This will get the current configuration of the node receiving the request.
Check Wazuh configuration in all cluster nodes	GET /cluster/configuration/validation	GET /cluster/configuration/validation	The usage is the same in API 4.0.
Show cluster health	GET /cluster/healthcheck	GET /cluster/healthcheck	The usage is the same in API 4.0.
Get local node info	GET /cluster/node	GET /cluster/nodes	Use the list_agents parameter to indicate from which agents you want to get the information.
Get nodes info	GET /cluster/nodes	GET /cluster/nodes	The usage is the same in API 4.0.
Get node info	GET /cluster/nodes/{node_name}	GET /cluster/nodes	Use the list_nodes parameter to indicate from which nodes you want to get the information.
Get info about cluster status	GET /cluster/status	GET /cluster/status	The usage is the same in API 4.0.
Update local file at any cluster node	POST /cluster/{node_id}/files	PUT /cluster/{node_id}/files	Use PUT instead of POST.
Restart a specific node in cluster	PUT /cluster/{node_id}/restart	PUT /cluster/restart	Use the list_nodes parameter to indicate which nodes want to restart.
Restart all nodes in cluster	PUT /cluster/restart	PUT /cluster/restart	The usage is the same in API 4.0.

[CarlosRS9]

Status Update

Equivalence table for Decoders, Experimental and Lists endpoints.

Decoders

Decoders	API 3.x usage	API 4.0 usage	Differences
Get all decoders	GET /decoders	GET /decoders	The usage is the same in API 4.0.
Get decoders by name	GET /decoders/{decoder_name}	GET /decoders	Use the decoder_name parameter to indicate from which decoder get the information.
Get all decoders files	GET /decoders/files	GET /decoders/files	The usage is the same in API 4.0.
Get all parent decoders	GET /decoders/parents	GET /decoders/parents	The usage is the same in API 4.0.

Experimental

Experimental	API 3.x usage	API 4.0 usage	Differences
Clear syscheck database	DELETE /experimental/syscheck	DELETE /experimental/syscheck	The usage is the same in API 4.0.
Get CIS-CAT results	GET /experimental/ciscat/results	GET /experimental/ciscat/results	The usage is the same in API 4.0.
Get hardware info of all agents	GET /experimental/syscollector/hardware	GET /experimental/syscollector/hardware	The usage is the same in API 4.0.
Get network address info of all agents	GET /experimental/syscollector/netaddr	GET /experimental/syscollector/netaddr	The usage is the same in API 4.0.
Get network interface info of all agents	GET /experimental/syscollector/netiface	GET /experimental/syscollector/netiface	The usage is the same in API 4.0.
Get network protocol info of all agents	GET /experimental/syscollector/netproto	GET /experimental/syscollector/netproto	The usage is the same in API 4.0.
Get os info of all agents	GET /experimental/syscollector/os	GET /experimental/syscollector/os	The usage is the same in API 4.0.
Get packages info of all agents	GET /experimental/syscollector/packages	GET /experimental/syscollector/packages	The usage is the same in API 4.0.
Get ports info of all agents	GET /experimental/syscollector/ports	GET /experimental/syscollector/ports	The usage is the same in API 4.0.
Get processes info of all agents	GET /experimental/syscollector/processes	GET /experimental/syscollector/processes	The usage is the same in API 4.0.

Lists

Lists	API 3.x usage	API 4.0 usage	Differences
Get all lists	GET /lists	GET /lists	The usage is the same in API 4.0.
Get paths from all lists	GET /lists/files	GET /lists/files	The usage is the same in API 4.0.

[CarlosRS9]

Status Update

Equivalence table for Manager, Rootcheck and Rules endpoints.

Manager

Manager	API 3.x usage	API 4.0 usage	Differences
Delete a local file	DELETE /manager/files	DELETE /manager/files	The usage is the same in API 4.0.
Get manager active configuration	GET /manager/config/{component}/{configuration}	GET /manager/configuration/{component}/{configuration}	The usage is the same in API 4.0 but “config” has been renamed to “configuration” in the endpoint.
Get manager configuration	GET /manager/configuration	GET /manager/configuration	The usage is the same in API 4.0.
Check Wazuh configuration	GET /manager/configuration/validation	GET /manager/configuration/validation	The usage is the same in API 4.0.
Get local file	GET /manager/files	GET /manager/files	The usage is the same in API 4.0.
Get manager information	GET /manager/info	GET /manager/info	The usage is the same in API 4.0.
Get ossec.log	GET /manager/logs	GET /manager/logs	The usage is the same in API 4.0.
Get summary of ossec.log	GET /manager/logs/summary	GET /manager/logs/summary	The usage is the same in API 4.0.
Get manager stats	GET /manager/stats	GET /manager/stats	The usage is the same in API 4.0.
Get analysisd stats	GET /manager/stats/analysisd	GET /manager/stats/analysisd	The usage is the same in API 4.0.
Get manager stats by hour	GET /manager/stats/hourly	GET /manager/stats/hourly	The usage is the same in API 4.0.
Get remoted stats	GET /manager/stats/remoted	GET /manager/stats/remoted	The usage is the same in API 4.0.
Get manager stats by week	GET /manager/stats/weekly	GET /manager/stats/weekly	The usage is the same in API 4.0.
Get manager status	GET /manager/status	GET /manager/status	The usage is the same in API 4.0.
Update local file	POST /manager/files	PUT /manager/files	The new endpoint works in the same way but using PUT.
Restart Wazuh manager	PUT /manager/restart	PUT /manager/restart	The usage is the same in API 4.0.

Roocheck

Rootcheck	API 3.x usage	API 4.0 usage	Differences
Clear rootcheck database	DELETE /rootcheck	DELETE /rootcheck	The usage is the same in API 4.0.
Clear rootcheck database of an agent	DELETE /rootcheck/{agent_id}	DELETE /rootcheck/{agent_id}	The usage is the same in API 4.0.
Get rootcheck database	GET /rootcheck/{agent_id}	GET /rootcheck/{agent_id}	The usage is the same in API 4.0.
Get rootcheck CIS requirements	GET /rootcheck/{agent_id}/cis	GET /rootcheck/{agent_id}/cis	The usage is the same in API 4.0.
Get last rootcheck scan	GET /rootcheck/{agent_id}/last_scan	GET /rootcheck/{agent_id}/last_scan	The usage is the same in API 4.0.
Get rootcheck pci requirements	GET /rootcheck/{agent_id}/pci	GET /rootcheck/{agent_id}/pci	The usage is the same in API 4.0.
Run rootcheck scan in all agents	PUT /rootcheck	PUT /rootcheck	The usage is the same in API 4.0.
Run rootcheck scan in an agent	`PUT /rootcheck/{agent_id}	PUT /rootcheck/{agent_id}	The usage is the same in API 4.0.

Rules

Rules	API 3.x usage	API 4.0 usage	Differences
Get all rules	GET /rules	GET /rules	The usage is the same in API 4.0.
Get rules by id	GET /rules/{rule_id}	GET /rules	Use the rules_id parameter to specify from which rules you want to get the information.
Get files of rules	GET /rules/files	GET /rules/files	The usage is the same in API 4.0.
Get rule gdpr requirements	GET /rules/gdpr	GET /rules	Use the gdpr parameter to get the GDPR requirements of a rule or list of rules.
Get rule gpg13 requirements	GET /rules/gpg13	GET /rules	Use the gdpr13 parameter to get the GDPR requirements of a rule or list of rules.
Get rule groups	GET /rules/groups	GET /rules/groups	The usage is the same in API 4.0.
Get rule hipaa requirements	GET /rules/hipaa	GET /rules	Use the hipaa parameter to get the HIPAA requirements of a rule or list of rules.
Get rule nist-800-53 requirements	GET /rules/nist-800-53	GET /rules	Use the hipaa parameter to get the NIST-800-53 requirements of a rule or list of rules.
Get rule pci requirements	GET /rules/pci	GET /rules	Use the hipaa parameter to get the PCI requirements of a rule or list of rules.

[CarlosRS9]

Status Update

Equivalence table for SCA, Summary, Syscheck and Syscollector endpoints.

SCA

Security Configuration Assessment	API 3.x usage	API 4.0 usage	Differences
Get security configuration assessment (SCA) database	GET /sca/{agent_id}	GET /sca/{agent_id}	The usage is the same in API 4.0.
Get security configuration assessment (SCA) checks database	GET /sca/{agent_id}/checks/{policy_id}	GET /sca/{agent_id}/checks/{policy_id}	The usage is the same in API 4.0.

Summary

Summary	API 3.x usage	API 4.0 usage	Differences
Get a full summary of agents	GET /summary/agents	GET /overview/agents	Use the new /overview/agents endpoint instead.

Syscheck

Syscheck	API 3.x usage	API 4.0 usage	Differences
Clear syscheck database of an agent	DELETE /syscheck/{agent_id}	DELETE /syscheck/{agent_id}	The usage is the same in API 4.0.
Get syscheck files	GET /syscheck/{agent_id}	GET /syscheck/{agent_id}	The usage is the same in API 4.0.
Get last syscheck scan	GET /syscheck/{agent_id}/last_scan	GET /syscheck/{agent_id}/last_scan	The usage is the same in API 4.0.
Run syscheck scan in all agents	PUT /syscheck	PUT /syscheck	The usage is the same in API 4.0.
Run syscheck scan in an agent	PUT /syscheck/{agent_id}	PUT /syscheck	Use the list_agents parameter to indicate which agents must run a syscheck scan.

Syscollector

Syscollector	API 3.x usage	API 4.0 usage	Differences
Get hardware info	GET /syscollector/{agent_id}/hardware	GET /syscollector/{agent_id}/hardware	The usage is the same in API 4.0.
Get hotfixes info	GET /syscollector/{agent_id}/hotfixes	GET /syscollector/{agent_id}/hotfixes	The usage is the same in API 4.0.
Get network address info of an agent	GET /syscollector/{agent_id}/netaddr	GET /syscollector/{agent_id}/netaddr	The usage is the same in API 4.0.
Get network interface info of an agent	GET /syscollector/{agent_id}/netiface	GET /syscollector/{agent_id}/netiface	The usage is the same in API 4.0.
Get network protocol info of an agent	GET /syscollector/{agent_id}/netproto	GET /syscollector/{agent_id}/netproto	The usage is the same in API 4.0.
Get os info	GET /syscollector/{agent_id}/os	GET /syscollector/{agent_id}/os	The usage is the same in API 4.0.
Get packages info	GET /syscollector/{agent_id}/packages	GET /syscollector/{agent_id}/packages	The usage is the same in API 4.0.
Get ports info of an agent	GET /syscollector/{agent_id}/ports	GET /syscollector/{agent_id}/ports	The usage is the same in API 4.0.
Get processes info	GET /syscollector/{agent_id}/processes	GET /syscollector/{agent_id}/processes	The usage is the same in API 4.0.

[CarlosRS9]

Status Update

The changes.md file has been reviewed and updated. Changes will be merged in 5042.

[CarlosRS9]

Status Update

A new Wazuh documentation page has been created with the updated equivalence tables of the endpoints in user manual > RESTful API > API changes from 3.x to 4.0 in 2413-endpoints-new-api branch.

Notice those equivalence tables contains more information that the ones in the previous comments of this issue.