API archive entry · source-reported
Amazon Detective
Detective uses machine learning and purpose-built visualizations to help you to analyze and investigate security issues across your Amazon Web Services (Amazon Web Services) workloads. Detective automatically extracts time-based events such as login attempts, API calls, and network traffic from CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by Amazon GuardDuty. The Detective API primarily supports the creation and management of behavior graphs. A behavior graph contains the extracted data from a set of member accounts, and is created and managed by an administrator account. To add a member account to the behavior graph, the administrator account sends an invitation to the account. When the account accepts the invitation, it becomes a member account in the behavior graph. Detective is also integrated with Organizations. The organization management account designates the Detective administrator account for the organization. That account becomes the administrator account for the organization behavior graph. The Detective administrator account is also the delegated administrator account for Detective in Organizations. The Detectiv
Plan the first integration safely
The access fields below come from the connected directory. Their likely implementation impact is explained without assuming provider-specific behavior.
Authentication
OAuth is reported. Confirm flows, scopes, consent, token lifetime, and refresh rules.
Transport
HTTPS is not confirmed. Do not send credentials or production data until secure transport is verified.
Browser access
CORS is unknown. Treat direct browser access as unconfirmed and test before choosing a client-only architecture.
First-request sequence
- Identify the current base URL, version, and endpoint for the use case.
- Confirm how credentials are issued and where they may be stored.
- Test success, invalid input, throttling, unavailable data, and timeouts.
- Record response fields, pagination, caching, and error shapes.
- Add monitoring, retries with backoff, and an appropriate fallback.
Questions to resolve before production
Pricing and quotas
Confirm current plans, free-tier limits, overages, and request ceilings.
Endpoint coverage
Check that the operations and response fields match the intended workload.
Reliability
Look for uptime history, a status page, support routes, and service commitments.
Data and privacy
Review retention, licensing, regional processing, and compliance requirements.
Versioning
Confirm the active version, change policy, deprecation window, and migration guidance.
Developer experience
Validate SDKs, examples, error formats, pagination, and test environments.
Source reference
This page separates source-reported facts from questions that need live provider verification.