<Workflow name="Levo_Vulnerability_API"
          version="1.0"
          xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V1">

    <Parameters>
        <Parameter name="authorization" label="Authorization Bearer Token (unused)" required="false"/>
        <Parameter name="x-levo-organization-id" label="Levo Organization ID (unused)" required="false"/>
        <Parameter name="x-levo-workspace-id" label="Levo Workspace ID (unused)" required="false"/>
        <Parameter name="envId" label="Environment ID (reference only)" required="false"/>
    </Parameters>

    <Actions>

        <CallEndpoint
            url="YOUR_LEVO_API_BASE_URL/graphql"
            method="POST"
            savePath="/response">

            <RequestHeader name="accept" value="application/json"/>
            <RequestHeader name="Content-Type" value="application/json"/>

            <!-- Replace YOUR_BEARER_TOKEN with your actual Levo API token -->
            <RequestHeader
                name="authorization"
                value="Bearer YOUR_BEARER_TOKEN"/>

            <RequestHeader name="x-levo-organization-id" value="YOUR_ORGANIZATION_ID"/>
            <RequestHeader name="x-levo-workspace-id" value="YOUR_WORKSPACE_ID"/>

            <RequestBody type="application/json" encoding="UTF-8">
{
  "query": "query GetVulnerabilities($input: AiLevoRiskscoringServiceV1GetVulnerabilitiesRequestInput) { aiLevoRiskscoringServiceV1RiskScoringServiceGetVulnerabilities(input: $input) { vulnerabilities { id name message level transaction category severity appId appName endpointId endpointPath endpointMethod status firstSeen lastSeen count ticketUrl assignedTo generic authenticationOptional testCaseMetadata { runId suiteRunId testCaseRunId } } meta { currentPage pageSize totalPages totalItems } } }",
  "variables": {
    "input": {
      "meta": {
        "page": 0,
        "pageSize": 1,
        "filter": {
          "filterConditions": [
            {
              "comparisonOperator": "Within",
              "fieldName": "modifiedDate",
              "filterValue": {
                "dateLiteral": {
                  "literalType": "LAST",
                  "value": 10,
                  "timeUnit": "Minutes"
                }
              }
            },
            {
              "comparisonOperator": "Within",
              "fieldName": "status",
              "filterValue": {
                "values": [
                  "UNRESOLVED"
                ]
              }
            },
            {
              "comparisonOperator": "Eq",
              "fieldType": "StringFieldType",
              "fieldName": "env_id",
              "filterValue": {
                "values": [
                  "YOUR_ENVIRONMENT_ID"
                ]
              }
            }
          ]
        }
      }
    }
  }
}
            </RequestBody>

        </CallEndpoint>

        <PostEvent
            path="/response"
            source="Levo_Vulnerability_API"/>

    </Actions>

</Workflow>
