Reco v1.8.0: External API migration, multi-severity filter (PRO-303), 5 new commands

[yanivblumReco]

Summary

• External API migration: Moved ~11 client methods from Reco's internal table APIs (base64-encoded cell rows) to the new /api/v1/external-api/ endpoints, which return clean JSON. Affected commands: alert fetch/detail, comments, labels, identities, risky users, apps, app auth status, files, and API key validation.
• PRO-303 — Multi-severity fetch filter: The Risk level configuration parameter now accepts a comma-separated list (e.g. HIGH,CRITICAL or 30,40). Values are parsed into a SCIM OR filter: (severity eq "HIGH" or severity eq "CRITICAL"). Single values continue to work unchanged.
• Rate-limit handling: All External API calls go through _rate_limited_request() which retries on HTTP 429 (up to 3× with exponential backoff, honouring Retry-After header).
• 5 new commands backed by the External API list endpoints (all accept SCIM v2 filters and limit):
  • reco-list-events
  • reco-list-posture-issues
  • reco-list-accounts
  • reco-list-devices
  • reco-list-ai-agents
• Updated output schemas: Context paths for reco-get-risky-users, reco-get-user-context-by-email-address, reco-get-sensitive-assets-by-id, reco-get-assets-by-id, and reco-get-apps updated to camelCase External API field names.
• Pack README rewrite: Updated to Reco's current "SaaS & AI Security" positioning, five-sprawl problem framing, and four use-case sections (AI Governance, AI Agent Security, Posture Management, Threat Detection & Response).
• Version bump: 1.7.4 → 1.8.0.

Key API endpoint changes

Command	Old endpoint	New endpoint
fetch-incidents / alert list	PUT /policy-subsystem/alert-inbox/table	GET /external-api/alerts/list
get_single_alert	GET /policy-subsystem/alert-inbox/{id}	GET /external-api/alert-details/{id}
reco-add-comment-to-alert	POST /share-service/share-comment	POST /external-api/comments/create
label commands	PUT /set-label-status	POST /external-api/labels/add
reco-get-user-context-by-email-address	PUT /risk-management/get-risk-management-table	GET /external-api/users/list
reco-get-risky-users	identity table with label filter	GET /external-api/accounts/list?filters=isRiskyUser eq true
reco-get-apps	PUT /asset-management/query	GET /external-api/apps/list
reco-set-app-authorization-status	PUT /app-risk-management/insert-risk-management-app	PUT /external-api/apps/{id}/auth-status
sensitive assets / files	PUT /asset-management/query	GET /external-api/files/list
test-module	GET /policy-subsystem/alert-inbox?limit=1	GET /external-api/alerts/list?count=1

Commands kept on internal APIs (no external equivalent): reco-change-alert-status, reco-resolve-visibility-event, reco-get-assets-user-has-access-to, reco-get-sensitive-assets-with-public-link, reco-get-3rd-parties-accessible-to-data-list, reco-get-files-shared-with-3rd-parties, reco-get-files-exposed-to-email-address, reco-get-assets-shared-externally, reco-get-private-email-list-with-access, reco-add-exclusion-filter, reco-get-link-to-user-overview-page, reco-get-alert-ai-summary.

Test plan

• test-module passes against a live Reco instance
• fetch-incidents with Risk level = HIGH,CRITICAL returns only HIGH and CRITICAL alerts
• fetch-incidents with Risk level = 30 (single numeric) continues to work
• reco-list-events, reco-list-accounts, reco-list-devices, reco-list-ai-agents, reco-list-posture-issues return results with SCIM filter examples from README
• reco-get-risky-users returns Account objects (camelCase fields: accountEmail, hasMfa, isRiskyUser)
• reco-get-apps returns App objects (camelCase fields: usersCount, vendorGrade, aiCapability)
• reco-add-comment-to-alert posts a comment via the external API
• reco-add-risky-user-label labels an identity via the external labels endpoint

Resolves PRO-303

🤖 Generated with Claude Code