> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Container Runtime Insight



## OpenAPI

````yaml /api-reference/openapi.yaml get /accounts/{account_id}/container_runtime_insights/{id}
openapi: 3.0.0
info:
  description: |
    The RAD Security API specification
  title: RAD Security API Spec
  version: 0.0.21
servers:
  - url: https://api.prd.rad.security
security: []
tags:
  - name: integrations
    x-displayName: Integrations
  - name: documents
    x-displayName: Documents
  - name: collections
    x-displayName: Collections
  - name: public
    x-displayName: public
  - name: Knowledge Base
    x-displayName: Knowledge Base
paths:
  /accounts/{account_id}/container_runtime_insights/{id}:
    get:
      tags:
        - Fingerprints
      summary: Get Container Runtime Insight
      parameters:
        - description: Account id
          in: path
          name: account_id
          required: true
          schema:
            type: string
        - description: Insight id
          in: path
          name: id
          required: true
          schema:
            type: string
        - description: Children limit
          in: query
          name: children_limit
          schema:
            type: integer
            default: 100
        - description: Most recent limit
          in: query
          name: most_recent_limit
          schema:
            type: integer
            default: 1000
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContainerRuntimeInsight'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIError'
components:
  schemas:
    ContainerRuntimeInsight:
      properties:
        accountID:
          type: string
        analysis:
          items:
            $ref: '#/components/schemas/RuntimeInsightLLMAnalysis'
          type: array
        baseline:
          $ref: '#/components/schemas/Fingerprint'
        baselineCaptured:
          type: boolean
        baselineID:
          type: string
        clusterID:
          type: string
        createdAt:
          type: string
        deletedAt:
          type: string
        hasDrift:
          type: boolean
        id:
          type: string
        llmAnalysis:
          $ref: '#/components/schemas/RuntimeInsightLLMAnalysis'
        malicious:
          type: boolean
        ongoing:
          $ref: '#/components/schemas/Fingerprint'
        severity:
          type: string
        state:
          type: string
        summary:
          $ref: '#/components/schemas/ContainerRuntimeInsightSummary'
        updatedAt:
          type: string
      type: object
    APIError:
      properties:
        code:
          type: string
        request_id:
          type: string
        status:
          type: integer
        validation_details:
          items:
            $ref: '#/components/schemas/ValidationDetail'
          type: array
      type: object
      required:
        - status
    RuntimeInsightLLMAnalysis:
      properties:
        accountID:
          type: string
        action:
          type: string
        category:
          type: string
        clusterID:
          type: string
        createdAt:
          type: string
        deletedAt:
          type: string
        description:
          type: string
        falsePositive:
          type: boolean
        falsePositiveMatchedRules:
          items:
            type: string
          type: array
        falsePositiveReason:
          type: string
        id:
          type: string
        insightID:
          type: string
        insightIDs:
          items:
            type: string
          type: array
        llmProvider:
          type: string
        maliciousProcessIDs:
          items:
            type: string
          type: array
        mitreAttackTactics:
          items:
            $ref: '#/components/schemas/domain.MitreAttackTactic'
          type: array
        mitreAttackTechniques:
          items:
            $ref: '#/components/schemas/domain.MitreAttackTechnique'
          type: array
        model:
          type: string
        partial:
          type: boolean
        prompt:
          type: string
        promptDigest:
          type: string
        refs:
          items:
            type: string
          type: array
        remediation:
          type: string
        severity:
          type: string
        stale:
          type: boolean
        status:
          type: string
        totalRequests:
          type: integer
        triggeredBy:
          type: string
        updatedAt:
          type: string
      type: object
    Fingerprint:
      properties:
        apiVersion:
          type: string
        containers:
          items:
            $ref: '#/components/schemas/Container'
          type: array
        kind:
          type: string
        metadata:
          $ref: '#/components/schemas/Metadata'
      type: object
    ContainerRuntimeInsightSummary:
      properties:
        container_meta:
          $ref: '#/components/schemas/agentv1.ContainerMeta'
        createdAt:
          type: string
        deletedAt:
          type: string
        kube_meta:
          $ref: '#/components/schemas/agentv1.KubeMeta'
      type: object
    ValidationDetail:
      properties:
        code:
          type: string
        field:
          type: string
        message:
          type: string
        param:
          type: string
      type: object
      required:
        - code
        - field
        - message
    domain.MitreAttackTactic:
      properties:
        id:
          type: string
        link:
          type: string
        name:
          type: string
      type: object
    domain.MitreAttackTechnique:
      properties:
        id:
          type: string
        link:
          type: string
        name:
          type: string
        tactics:
          items:
            $ref: '#/components/schemas/domain.MitreAttackTactic'
          type: array
      type: object
    Container:
      properties:
        id:
          type: string
        imageDigest:
          type: string
        imageName:
          type: string
        name:
          type: string
        processes:
          items:
            $ref: '#/components/schemas/Process'
          type: array
      type: object
    Metadata:
      properties:
        creationTimestamp:
          type: string
      type: object
    agentv1.ContainerMeta:
      properties:
        container_id:
          type: string
        container_image_digest:
          type: string
        container_image_name:
          type: string
        container_name:
          type: string
        runtime_name:
          type: string
      type: object
    agentv1.KubeMeta:
      properties:
        cluster_id:
          type: string
        container_name:
          type: string
        namespace:
          type: string
        node_name:
          type: string
        pod_name:
          type: string
      type: object
    Process:
      properties:
        children:
          items:
            $ref: '#/components/schemas/Process'
          type: array
        connections:
          description: Unique Connections of this Process.
          items:
            $ref: '#/components/schemas/Connection'
          type: array
        drift:
          type: boolean
        files:
          description: Unique Files opened by this Process.
          items:
            $ref: '#/components/schemas/File'
          type: array
        gid:
          type: integer
        id:
          type: string
        parentId:
          type: string
        programs:
          description: >-
            Programs run by this Process. A Program can load and run another
            Program

            within the same Process. Hence, a Process can execute several
            Programs,

            but at any given moment in times there is only one active Program
            running.
          items:
            $ref: '#/components/schemas/Program'
          type: array
        repetition:
          $ref: '#/components/schemas/Repetition'
        timestamp:
          type: string
        trustedIPPrefixes:
          description: TrustedIPPrefixes is a map of trusted IP prefixes and their names.
          items:
            $ref: '#/components/schemas/TrustedIPPrefix'
          type: array
        uid:
          type: integer
      type: object
    Connection:
      properties:
        address:
          type: string
        drift:
          type: boolean
        hostname:
          type: string
        k8sName:
          type: string
        k8sNamespace:
          type: string
        port:
          type: integer
        timestamp:
          type: string
        trustedCIDR:
          type: string
      type: object
    File:
      properties:
        drift:
          type: boolean
        path:
          type: string
        timestamp:
          type: string
      type: object
    Program:
      properties:
        args:
          items:
            type: string
          type: array
        comm:
          type: string
        drift:
          type: boolean
        hasPattern:
          type: boolean
        sampleArgs:
          items:
            items:
              type: string
            type: array
          type: array
        timestamp:
          description: Timestamp when this program was executed.
          type: string
      type: object
    Repetition:
      properties:
        execCount:
          type: integer
        recentTimestamp:
          type: string
      type: object
    TrustedIPPrefix:
      properties:
        cidr:
          type: string
        name:
          type: string
        port:
          type: integer
      type: object

````