> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracectrl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Attack Paths

> Ranked attack paths from TAGAAI rules

Returns all detected attack paths ordered by risk score descending.

### Query Parameters

<ParamField query="service" type="string">Filter by service name</ParamField>

### Response

Array of attack path objects:

<ResponseField name="path_id" type="string">Unique path identifier</ResponseField>
<ResponseField name="rule_name" type="string">TAGAAI rule that fired (e.g., `vulnerableToExcessiveAgency`)</ResponseField>
<ResponseField name="owasp_tag" type="string">OWASP ASI category tag (e.g., `ASI01`)</ResponseField>
<ResponseField name="agents_involved" type="string[]">Agent IDs in the attack chain</ResponseField>

<ResponseField name="path_steps" type="object[]">
  Step-by-step attack chain. Each step has:

  <Expandable>
    <ResponseField name="node_id" type="string">Node identifier</ResponseField>
    <ResponseField name="node_type" type="string">Type of node (agent, tool, ingress)</ResponseField>
    <ResponseField name="vulnerability" type="string">Vulnerability label</ResponseField>
    <ResponseField name="description" type="string">Human-readable description</ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="risk_score" type="float">Computed risk score</ResponseField>
<ResponseField name="severity" type="string">Critical, High, Medium, or Low</ResponseField>
<ResponseField name="detected_at" type="string">ISO-8601 timestamp when this path was detected</ResponseField>