> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Tines
> The Tines integration enables AirMDR to authenticate with a Tines tenant and perform the operations supported by the configured integration skills.
## Purpose
Connect Tines with AirMDR to securely execute supported automation and orchestration operations using the Tines REST API.
Tines does not generate a separate **Tenant Key**. In AirMDR, the required value is labelled **Tenant Domain**. Enter the base URL of your Tines tenant, such as `https://company.tines.com`.
## Supported Versions
| Component | Supported configuration |
| -------------------------- | -------------------------------------------------------------- |
| Tines deployment | Tines cloud and API-accessible self-hosted deployments |
| API | Tines REST API |
| Authentication | API key |
| API authentication headers | `Authorization: Bearer ` or `X-User-Token: ` |
| Network protocol | HTTPS |
| AirMDR connection fields | Tenant Domain and API Key |
For a self-hosted Tines deployment, confirm that its installed version supports the API endpoints required by the AirMDR skills.
Tines API endpoints can use `/api/v1/` or `/api/v2/`, depending on the resource being accessed. AirMDR automatically uses the endpoint required by each supported integration skill.
## Authentication
The integration requires the following values:
| AirMDR field | What to enter | Where to get it |
| ----------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| **Tenant Domain** | Base URL of the Tines tenant, such as `https://company.tines.com` | Copy the origin from the browser address bar after signing in to the required tenant |
| **API Key** | API key generated for the AirMDR integration | Tines **Settings → Access & security → API keys** |
Enter the complete base URL: [https://company.tines.com](https://company.tines.com)
For a self-hosted environment: [https://tines.example.com](https://tines.example.com)
Do not enter: [https://login.tines.com](https://login.tines.com), or [https://company.tines.com/api/v1/](https://company.tines.com/api/v1/) or company.tines.com/team/123/stories
Avoid API paths, team paths, story paths, query parameters, and unnecessary trailing characters.
### Pre-requisites
>
> Users must have Administrator access to the **Tines** UI with sufficient privileges to create an API key or approval from a Tines tenant owner.
>
>
>
> Permission to create and access the Tines **API keys** settings.
>
A tenant owner can restrict API-key creation. When this restriction is enabled, only tenant owners and users assigned the `API_KEY_CREATE` tenant permission can create API keys.
## Setup Steps
1. Sign in to the Tines tenant that you want to connect with AirMDR.
2. Confirm that you are in the correct tenant.
3. In the browser address bar, copy only the base URL. Example: [https://company.tines.com](https://company.tines.com)
4. Save this value securely. You will enter it in the AirMDR **Tenant Domain** field.
**If your organisation has multiple Tines tenants, verify that you copy the domain from the tenant containing the teams, stories, cases, or other resources required by AirMDR.**
1. Sign in to your Tines tenant.
2. Open **Settings** from the Tines navigation menu or user menu.
3. Under **Access & security**, select **API keys**.
4. Select **New API key** or **Create API key**.
5. Select the appropriate API-key type:
* Select **Team API key** when AirMDR only needs access to a specific team.
* Select **Service API key** when AirMDR requires selected tenant-level permissions.
* Use a **Personal API key** only for temporary testing.
* Do not select **Tenant owner API key** unless full tenant access is necessary.
To further understand the Tines API key types refer to the below content
Tines supports four API-key types:
| API-key type | Access model | Recommendation |
| ------------------------ | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| **Personal API key** | Inherits the access of the user who created it | Avoid for production integrations because it is tied to an individual user |
| **Service API key** | Uses a separate service account and can be assigned specific tenant permissions | Recommended when AirMDR requires selected tenant-level permissions |
| **Team API key** | Uses a service account with role-based access to a specific Tines team | Recommended when AirMDR only needs access to one team |
| **Tenant owner API key** | Provides full owner access across the tenant | Avoid unless the supported AirMDR operations explicitly require owner-level access |
Tines records operations performed through service, team, and tenant-owner keys against their associated service-account users. An underprivileged key may return `404 Not Found` when it attempts to access a protected resource.
Prefer a **Team API key** or restricted **Service API key** and grant only the access required by the enabled AirMDR skills.
6. Enter a descriptive name, for example: AirMDR Integration
7. If prompted, enter a description: `API key used by AirMDR to access approved Tines resources.`
8. For a Team API key, select the Tines team and the minimum role required by the enabled AirMDR skills.
9. For a Service API key, select only the required tenant permissions.
10. Select **Create**.
11. Copy the generated API key and store it in an approved secrets-management system.
12. Store and share the token securely with AirMDR.
Tines displays the token only once. Make sure to record the token, Tines will never again provide that token to you, this is your one and only chance to record it.
**If it is lost, generate a new token.**
### Tines Credential Reference Table
| AirMDR Field | What to Enter | Where to Get It in the Tines UI | Example |
| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------- |
| **Tenant Domain** | Base URL of the Tines tenant | Sign in to the required Tines tenant and copy the base URL from the browser address bar. Do not include API, team, or story paths. | `https://company.tines.com` |
| **API Key** | API key generated for the AirMDR integration | In Tines, navigate to **Settings → Access & security → API keys → New API key**. Configure the appropriate key type and permissions, create the key, and copy its value. | `` |
Tines does not generate a separate Tenant Key. Enter the Tines tenant’s base URL in the AirMDR **Tenant Domain** field.
### Validate Connectivity
Use the following request to confirm that the tenant domain and API key can access the Tines Teams API:
```text theme={null}
curl --proto '=https' --tlsv1.2 \
-X GET "https:///api/v1/teams" \
-H "content-type: application/json" \
-H "Authorization: Bearer "
```
**Sample Successful Response:**
```text theme={null}
A successful request returns the teams accessible to the API key. The /api/v1/teams endpoint and bearer-token format are documented by Tines.
```
\{
"teams": \[
\{
"id": 1,
"name": "Security Team",
"groups": \[
\{
"id": 3,
"name": "Tier 1"
}
]
},
\{
"id": 2,
"name": "Engineering Team",
"groups": \[]
}
],
"meta": \{
"current\_page": "https\://\/api/v1/teams?per\_page=20\&page=1",
"previous\_page": null,
"next\_page": null,
"next\_page\_number": null,
"per\_page": 20,
"pages": 1,
"count": 2
}
}
A successful request returns the teams accessible to the API key. The `/api/v1/teams` endpoint and bearer-token format are documented by Tines.
Do not run the command on shared systems or save the API key in shell history. Use environment variables or an approved secret manager where possible.
### Configure Tines in AirMDR Integrations Dashboard
1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**Tines**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:
| AirMDR Field | Description | Example |
| :---------------- | :----------------------------- | :----------------------------- |
| **Instance** | Unique name for the connection | `Tines-Production` |
| **Organization** | \ | `AirMDR Organization` |
| **Description** | Purpose of the connection | `Tines production integration` |
| **Tenant Domain** | Base URL copied from Tines | `https://company.tines.com` |
| **API Key** | API key generated in Tines | `` |
1. In **Remote Agent**, select an AirMDR Remote Agent only when the Tines tenant is self-hosted, privately accessible, or must be reached through an approved private network route.
2. In **Expiry**, select the date on which AirMDR should treat the stored connection credentials as expired, according to your organisation’s credential-rotation policy.
The AirMDR **Expiry** setting is a connection-management control. It does not automatically configure or rotate the API key in Tines.
5. Click **Save**.
### Skills provided by this Integration
| Skill ID | Purpose |
| ---------------------- | ---------------------------------------------------------------------------------------------- |
| **Get Tines Artifact** | Retrieves large text-based data or content stored as an artifact for a specified Tines record. |
| Skill ID | Purpose |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| **List Tines Stories** | Retrieves stories from the Tines instance, with optional filtering by team or folder. |
| **Get Tines Story** | Retrieves the details and configuration of a specified Tines story using its story ID. |
| **Create Tines Story** | Creates a story within a specified Tines team, with optional folder placement and tag configuration. |
| **Update Tines Story** | Updates an existing story’s properties, including its name, enabled or disabled status, tags, and event-retention settings. |
| Skill ID | Purpose |
| --------------------- | --------------------------------------------------------------------------------------------- |
| **List Tines Cases** | Retrieves cases available in the connected Tines instance. |
| **Get Tines Case** | Retrieves the complete details of a specified Tines case using its case ID. |
| **Create Tines Case** | Creates a case within a specified Tines team using the supplied case information. |
| **Update Tines Case** | Updates the information or configuration of an existing case in the connected Tines instance. |
| Skill ID | Purpose |
| ------------------------- | ----------------------------------------------------------------------------------------------------------- |
| **List Tines Resources** | Retrieves resources from the Tines instance, with optional filtering by team or folder. |
| **Get Tines Resource** | Retrieves the details and stored value of a specified Tines resource using its resource ID. |
| **Update Tines Resource** | Updates a live resource or its test version, including its name, stored value, and access-control settings. |
| Skill ID | Purpose |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Create Tines Record** | Creates a record within a specified Tines record type (widget) and can optionally associate the record with one or more cases. |
| Skill ID | Purpose |
| --------------------- | -------------------------------------------------------------------------------------------- |
| **List Tines Events** | Retrieves recent events from the Tines instance, with optional filtering by story or team. |
| **Get Tines Event** | Retrieves the payload and associated metadata of a specified Tines event using its event ID. |
| Skill ID | Purpose |
| ---------------------- | ------------------------------------------------------------------------------------------------------- |
| **Send Tines Webhook** | Sends a webhook request to a specified Tines webhook endpoint to initiate or continue a Tines workflow. |
To view the details of Input Parameters and Output for the respective skills
* Go to [AirMDR → Tines](https://app.airmdr.com/integrationsv2/126ec408-3021-4002-acab-1d125e1b8a71/skills?search=TINES) Integration page.
* Select the **Skills** tab and click on the required listed skills.
## Additional Information
| Error or symptom | Likely cause | Resolution |
| ------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| **Invalid tenant domain** | Login URL, API path, team path, or incorrect tenant was entered | Enter only the base tenant URL, such as `https://company.tines.com` |
| **401 Unauthorized** | API key is missing, invalid, deleted, or incorrectly copied | Generate or copy a valid key and update the AirMDR connection |
| **404 Not Found** | Resource does not exist, or the key lacks permission to access it | Verify the resource and assign the required team role or tenant permission |
| **403 Forbidden** | Access is blocked by tenant security or access-control policy | Review tenant permissions, IP restrictions, and organisational security controls |
| **429 Too Many Requests** | Tines API rate limit was reached | Reduce request frequency and retry with exponential backoff |
| **Connection timeout** | DNS, firewall, proxy, or Remote Agent connectivity issue | Allow outbound TCP 443 and verify access to the configured tenant domain |
| **TLS or certificate error** | Invalid, expired, or untrusted certificate, commonly in self-hosted deployments | Install a trusted certificate and verify the certificate chain |
| **Some skills work, but others fail** | The API key has partial access | Map each failing skill to the required Tines resource and grant only the missing permissions |
| **Connection stops after the AirMDR expiry date** | The AirMDR connection has reached its configured expiry | Rotate or validate the key and update the AirMDR expiry setting |
| **Wrong tenant data returned** | Domain belongs to a different Tines tenant | Delete or update the connection using the correct tenant domain |
### AirMDR monitoring
Use the AirMDR application to review:
* Connection status.
* Skill execution status.
* Execution start and completion times.
* API error codes and error messages.
* Remote Agent connectivity, when applicable.
The exact log location and displayed fields can vary according to the AirMDR module from which the skill was executed.
### Tines audit logs
Tines automatically records changes made through both its UI and API. Tenant administrators can access audit logs through the Tines UI or API and forward them to a SIEM or log-analysis platform. API-key creation, editing, and deletion are logged as authentication-token operations. Sensitive credential values are not included in Tines audit logs.
**Relevant audit operations include:**
`AuthenticationTokenCreation` `AuthenticationTokenEdit` `AuthenticationTokenDeletion`
**Sample Tines audit log**
`{` ` "created_at": "2026-08-14T10:30:00Z",` ` "request_ip": "192.0.2.10",` ` "tenant_id": 9,` ` "user_email": "airmdr-service@example.com",` ` "user_id": 123,` ` "user_name": "AirMDR Integration",` ` "operation_name": "AuthenticationTokenCreation"` `}`
This sample illustrates the documented Tines audit-log structure. Actual values depend on the tenant and operation.
### Recommended monitoring
* Monitor repeated `401`, `404`, `429`, and `5xx` responses.
* Review API-key creation, modification, and deletion events.
* Alert on unexpected activity from the AirMDR service account.
* Review the API key’s team roles and tenant permissions periodically.
* Monitor the AirMDR connection expiry date and planned key-rotation date.
### ✅ Do
* Use a dedicated Team or Service API key for AirMDR.
* Follow the principle of least privilege.
* Restrict a Team API key to the team AirMDR must access.
* Store the API key only in approved secret-storage systems.
* Rotate the key periodically and after any suspected exposure.
* Set an AirMDR connection expiry date aligned with the rotation policy.
* Review Tines audit logs for unexpected API-key activity.
* Use HTTPS and validate certificates.
* Use a Remote Agent for privately accessible self-hosted environments when required.
* Delete unused or superseded keys promptly.
### ❌ Don’t
* Do not use a Tenant owner API key unless full tenant access is explicitly required.
* Do not use a personal API key for a long-running production integration.
* Do not enter `login.tines.com` as the tenant domain.
* Do not include `/api/v1`, `/api/v2`, team paths, or story paths in the Tenant Domain field.
* Do not store API keys in documentation, source control, or plain-text files.
* Do not send API keys through email, chat, or support tickets.
* Do not reuse the AirMDR API key across unrelated integrations.
* Do not log authentication headers or API-key values.
* 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
* 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
* 🔄 **Reconnect in AirMDR immediately when secrets are changed.**
### Data flow
| Direction | Data exchanged |
| :------------- | :----------------------------------------------------------------------------------------------------------- |
| AirMDR → Tines | Authenticated API requests required by the selected Tines skill |
| Tines → AirMDR | API responses containing permitted team, story, case, event, record, status, or execution information |
| AirMDR → Tines | Create, update, or execution requests only when supported by the selected skill and permitted by the API key |
The exact information exchanged depends on the AirMDR skill being executed and the permissions assigned to the Tines API key.
### Authentication flow
1. AirMDR sends an HTTPS request to the configured Tines tenant domain.
2. The Tines API key is supplied in the request authentication header.
3. Tines validates the key and its associated user, service account, team role, or tenant permissions.
4. Tines processes the request only when the key has access to the requested resource.
5. The API response is returned to AirMDR over HTTPS.
### Encryption
* Tines requires authenticated API communication over HTTPS.
* Tines states that customer personal data is encrypted in transit using at least TLS 1.2.
* Tines states that customer personal data stored at rest is encrypted using AES-256.
* AirMDR should store the API key as a secret and must not expose it in skill inputs, logs, screenshots, or exported troubleshooting data.
### Ports and endpoints
| Requirement | Value |
| :------------------- | :---------------------------------------------------- |
| Protocol | HTTPS |
| Outbound port | TCP 443 |
| Base endpoint | `https://` |
| API endpoint pattern | `https:///api/v1/...` or `/api/v2/...` |
| Authentication | Bearer token or `X-User-Token` header |
No inbound connection from Tines is required for standard AirMDR-initiated API requests. If a supported workflow uses Tines webhooks, configure and secure the required inbound webhook separately