Infoblox Threat Defense BloxOne – Studio Project

Studio Project workflows for Infoblox Threat Defense (BloxOne) security policy and filtering

Infoblox Threat Defense (BloxOne) is a cloud-native DNS security service that protects networks and roaming users at the DNS layer — enforcing security policies, category and application filtering, custom allow/block lists, and threat-intelligence feeds to stop malicious and unwanted domains before a connection is made.

This project provides the OpenAPI spec for automating against the Infoblox Threat Defense (BloxOne) API via an Integration Model.

Table of Contents

• Contents
• Requirements
• Integration Configuration
• OpenAPIs
  • infoblox_threat_defense_bloxone-latest.json
  • infoblox_threat_defense_bloxone-1.json
• Studio Projects
  • Infoblox Threat Defense (BloxOne) Project
    • Folder Structure
    • Dependencies

Contents

Requirements

Integration Configuration

Import the OpenAPI spec from OpenAPIs/ as an Integration Model in Admin > Integrations, then create an integration pointing at csp.infoblox.com.

Authentication is an API key in the Authorization header:

Authorization: Token <your-infoblox-api-key>

Generate an API key in the Infoblox Cloud Services Portal under Administration → API Keys.

The instance's authentication/server properties should look like this once configured:

{
  "authentication": {
    "apiKeyAuth": {
      "value": "<your-api-key>"
    }
  },
  "server": {
    "protocol": "https",
    "host": "csp.infoblox.com",
    "base_path": "/api/atcfw/v1"
  }
}

OpenAPIs

infoblox_threat_defense_bloxone-latest.json

Actively-maintained spec (x-vendor-api-version: 1). Trimmed to 60 of 61 upstream operations covering DNS security policy management (security policies and rules, application/category/network filters, named and internal domain lists, threat feeds, content categories, PoP regions, access codes, and application/address-block approvals).

Operations included, by category:

• Security Policies: List, create, delete (bulk), get, update, delete a security policy; list security policy rules
• Filters: Application Filters (list/create/delete/get/update/delete-by-id), Category Filters (list/create/delete/get/update/delete-by-id), Content Categories (list — reference data for building category filters)
• Network Lists: List, create, delete (bulk), get, update, delete a network list
• Named Lists (threat-intel/custom lists): List, create, delete (bulk), patch (bulk), get, update, delete, patch a named list; insert/delete/partial-update list items; download named lists as CSV
• Internal Domain Lists: List, create, delete (bulk), get, update, delete an internal domain list; patch list items
• DoH FQDNs: Create or retrieve a DNS-over-HTTPS FQDN
• Threat Feeds: List available threat-intelligence feeds (reference data referenced by security policy rules)
• Access Codes: List, create, delete (bulk), get, delete-by-id, update an access code
• Approvals: List/update/patch Application Approvals; read/patch Address Block Approvals
• PoP Regions: List, get a Point-of-Presence region (reference data for policy/proxy placement)

infoblox_threat_defense_bloxone-1.json

Full, unmodified vendor spec for Infoblox Threat Defense (BloxOne) API version 1 (61 operations) — the vendor's complete API surface, preserved as-is. See infoblox_threat_defense_bloxone-latest.json above for the curated subset if you just need common CRUD automation.

Studio Projects

Infoblox Threat Defense (BloxOne) Project

Backed by the Infoblox Threat Defense (BloxOne):latest Integration Model (see infoblox_threat_defense_bloxone-latest.json above). The project contains 25 workflows organized into 5 folders, one atomic workflow per API operation, covering the common-CRUD subset of the curated spec.

Folder Structure

Dependencies