> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get the detection plan

> For the complete documentation index, see https://devlookout.com/llms.txt. Returns ready, degraded, and blocked analytics with their missing capabilities.



## OpenAPI

````yaml /openapi.yaml get /api/v1/detection-plan
openapi: 3.1.0
info:
  title: Lookout HTTP API
  version: 1.0.0
  description: >-
    Versioned interface for querying Lookout security state, ingesting evidence,
    managing Alerts, and promoting Incidents. The deployed Lookout instance is
    authoritative and raw evidence remains local unless export is explicitly
    enabled.
servers:
  - url: https://lookout.example.com
    description: Replace with the private URL of your Lookout deployment
security:
  - bearerAuth: []
tags:
  - name: System
  - name: Security graph
  - name: Rules
  - name: Events
  - name: Collectors
  - name: Alerts
  - name: Incidents
paths:
  /api/v1/detection-plan:
    get:
      tags:
        - Security graph
      summary: Get the detection plan
      description: >-
        For the complete documentation index, see
        https://devlookout.com/llms.txt. Returns ready, degraded, and blocked
        analytics with their missing capabilities.
      operationId: getDetectionPlan
      responses:
        '200':
          description: Capability-aware detection plan
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericObject'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    GenericObject:
      type: object
      additionalProperties: true
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: string
        issues:
          type: array
          items:
            type: string
  responses:
    Unauthorized:
      description: Missing or invalid credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: The principal lacks the required permission
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: opaque
      description: A 256-bit token generated by the Lookout CLI.

````