abnormal-security-api-patterns

# Abnormal Security REST API Patterns ## Overview The Abnormal Security REST API provides programmatic access to threat detection, cases, abuse mailbox submissions, message analysis, and per-message remediation. This skill covers authentication, request patterns, pagination, filtering, rate limiting, error handling, and performance optimization. The paths below are the ones this plugin's MCP server actually calls. The vendor's wider API surface is out of scope here — if a path is not listed, no tool reaches it. ## Authentication ### Bearer Token Authentication Abnormal Security uses a static Bearer token for API authentication: ```http GET https://api.abnormalplatform.com/v1/threats Authorization: Bearer YOUR_API_TOKEN Accept: application/json ``` ### Token Management | Field | Description | |-------|-------------| | Type | Static API token (no expiry rotation required) | | Format | Long alphanumeric string | | Header | `Authorization: Bearer <token>` | | Scope | Full API access (determined at token creation) | ### Environment Variables ```bash export ABNORMAL_API_TOKEN="your-api-token" export ABNORMAL_MCP_URL="https://conduit.wyre.ai/v1/abnormal-security/mcp" ``` ### MCP Gateway Headers When used through the MCP Gateway, credentials are passed via the `Authorization` header: ```json { "headers": { "Authorization": "Bearer ${ABNORMAL_API_TOKEN}" } } ``` The gateway forwards this header to the Abnormal Security MCP server, which uses it to authenticate w...