binalyze-air-sdk 1.0.1__py3-none-any.whl

binalyze_air/queries/authentication.py

@@ -0,0 +1,56 @@
+"""
+Authentication-related queries for the Binalyze AIR SDK.
+"""
+
+from ..base import Query
+from ..models.authentication import AuthStatus, User, UserProfile, UserRole
+from ..http_client import HTTPClient
+
+
+class CheckAuthStatusQuery(Query[AuthStatus]):
+    """Query to check authentication status."""
+    
+    def __init__(self, http_client: HTTPClient):
+        self.http_client = http_client
+    
+    def execute(self) -> AuthStatus:
+        """Execute the auth status check query."""
+        # Try different endpoint patterns since auth endpoints may vary
+        endpoints_to_try = [
+            "auth/check",  # Original pattern
+            # Note: /api/public/auth/check may not exist in all API versions
+            # The HTTP client will add the api_prefix automatically
+        ]
+        
+        last_exception = None
+        
+        for endpoint in endpoints_to_try:
+            try:
+                response = self.http_client.get(endpoint)
+                
+                if response.get("success"):
+                    result = response.get("result", {})
+                    
+                    # Use Pydantic to parse the User data with proper field aliasing
+                    user = User.model_validate(result)
+                    return AuthStatus(authenticated=True, user=user)
+                else:
+                    # Return unauthenticated status for failed responses
+                    return AuthStatus(authenticated=False)
+                    
+            except Exception as e:
+                last_exception = e
+                continue  # Try next endpoint
+        
+        # If all endpoints failed, check if it's because auth features are disabled
+        if last_exception and "auth-management-via-api" in str(last_exception):
+            # Auth features are disabled - this is a configuration issue, not authentication failure
+            # We can't determine auth status, so return a special state
+            return AuthStatus(authenticated=False)
+        
+        # If we get here, all endpoints failed
+        if last_exception:
+            raise last_exception
+        
+        # Return unauthenticated status as fallback
+        return AuthStatus(authenticated=False) 

binalyze_air/queries/auto_asset_tags.py

@@ -0,0 +1,60 @@
+"""
+Auto Asset Tags-related queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.auto_asset_tags import AutoAssetTag, AutoAssetTagFilter
+from ..http_client import HTTPClient
+
+
+class ListAutoAssetTagsQuery(Query[List[AutoAssetTag]]):
+    """Query to list auto asset tags."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[AutoAssetTagFilter] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params
+    
+    def execute(self) -> List[AutoAssetTag]:
+        """Execute the list auto asset tags query."""
+        params = {}
+        
+        # Add default organization filtering if no filter is provided
+        if self.filter_params:
+            params = self.filter_params.to_params()
+        else:
+            # Default organization filtering - critical for the API to work
+            params["filter[organizationIds]"] = "0"
+        
+        # Ensure organization filtering is always present
+        if "filter[organizationIds]" not in params and "filter[organizationId]" not in params:
+            params["filter[organizationIds]"] = "0"
+        
+        response = self.http_client.get("auto-asset-tag", params=params)
+        
+        if response.get("success"):
+            tags_data = response.get("result", {}).get("entities", [])
+            # Use Pydantic parsing with proper field aliasing
+            return [AutoAssetTag.model_validate(tag_data) for tag_data in tags_data]
+        
+        return []
+
+
+class GetAutoAssetTagQuery(Query[AutoAssetTag]):
+    """Query to get auto asset tag by ID."""
+    
+    def __init__(self, http_client: HTTPClient, tag_id: str):
+        self.http_client = http_client
+        self.tag_id = tag_id
+    
+    def execute(self) -> AutoAssetTag:
+        """Execute the get auto asset tag query."""
+        response = self.http_client.get(f"auto-asset-tag/{self.tag_id}")
+        
+        if response.get("success"):
+            tag_data = response.get("result", {})
+            # Use Pydantic parsing with proper field aliasing
+            return AutoAssetTag.model_validate(tag_data)
+        
+        raise Exception(f"Auto asset tag not found: {self.tag_id}") 

binalyze_air/queries/baseline.py

@@ -0,0 +1,185 @@
+"""
+Baseline-related queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.baseline import (
+    Baseline, BaselineProfile, BaselineComparison, BaselineChange,
+    BaselineSchedule, BaselineFilter, BaselineStatus, ComparisonStatus
+)
+from ..http_client import HTTPClient
+
+
+class ListBaselinesQuery(Query[List[Baseline]]):
+    """Query to list baselines with optional filtering."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[BaselineFilter] = None, organization_ids: Optional[List[int]] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or BaselineFilter()
+        self.organization_ids = organization_ids or [0]
+    
+    def execute(self) -> List[Baseline]:
+        """Execute the query to list baselines."""
+        params = {}
+        if self.filter_params:
+            params = self.filter_params.model_dump(exclude_none=True)
+        
+        response = self.http_client.get("baselines", params=params)
+        
+        if response.get("success"):
+            baselines_data = response.get("result", {}).get("entities", [])
+            # Use Pydantic parsing with proper field aliasing
+            return [Baseline.model_validate(baseline_data) for baseline_data in baselines_data]
+        
+        return []
+
+
+class GetBaselineQuery(Query[Baseline]):
+    """Query to get a specific baseline by ID."""
+    
+    def __init__(self, http_client: HTTPClient, baseline_id: str):
+        self.http_client = http_client
+        self.baseline_id = baseline_id
+    
+    def execute(self) -> Baseline:
+        """Execute the query to get baseline details."""
+        response = self.http_client.get(f"baselines/{self.baseline_id}")
+        
+        if response.get("success"):
+            baseline_data = response.get("result", {})
+            # Use Pydantic parsing with proper field aliasing
+            return Baseline.model_validate(baseline_data)
+        
+        raise Exception(f"Baseline not found: {self.baseline_id}")
+
+
+class GetBaselineComparisonsQuery(Query[List[BaselineComparison]]):
+    """Query to get baseline comparisons."""
+    
+    def __init__(self, http_client: HTTPClient, baseline_id: str):
+        self.http_client = http_client
+        self.baseline_id = baseline_id
+    
+    def execute(self) -> List[BaselineComparison]:
+        """Execute the query to get baseline comparisons."""
+        response = self.http_client.get(f"baselines/{self.baseline_id}/comparisons")
+        
+        if response.get("success"):
+            comparisons_data = response.get("result", {}).get("entities", [])
+            comparisons = []
+            for comparison_data in comparisons_data:
+                # Parse changes if present
+                changes = []
+                for change_data in comparison_data.get("changes", []):
+                    # Use Pydantic parsing for changes
+                    changes.append(BaselineChange.model_validate(change_data))
+                
+                # Add parsed changes to comparison data
+                comparison_data["changes"] = changes
+                
+                # Use Pydantic parsing with proper field aliasing
+                comparisons.append(BaselineComparison.model_validate(comparison_data))
+            
+            return comparisons
+        
+        return []
+
+
+class GetBaselineComparisonQuery(Query[BaselineComparison]):
+    """Query to get a specific baseline comparison by ID."""
+    
+    def __init__(self, http_client: HTTPClient, comparison_id: str):
+        self.http_client = http_client
+        self.comparison_id = comparison_id
+    
+    def execute(self) -> BaselineComparison:
+        """Execute the query to get baseline comparison details."""
+        response = self.http_client.get(f"baselines/comparisons/{self.comparison_id}")
+        
+        if response.get("success"):
+            comparison_data = response.get("result", {})
+            
+            # Parse changes if present
+            changes = []
+            for change_data in comparison_data.get("changes", []):
+                # Use Pydantic parsing for changes
+                changes.append(BaselineChange.model_validate(change_data))
+            
+            # Add parsed changes to comparison data
+            comparison_data["changes"] = changes
+            
+            # Use Pydantic parsing with proper field aliasing
+            return BaselineComparison.model_validate(comparison_data)
+        
+        raise Exception(f"Baseline comparison not found: {self.comparison_id}")
+
+
+class ListBaselineProfilesQuery(Query[List[BaselineProfile]]):
+    """Query to list baseline profiles."""
+    
+    def __init__(self, http_client: HTTPClient, organization_ids: Optional[List[int]] = None):
+        self.http_client = http_client
+        self.organization_ids = organization_ids or [0]
+    
+    def execute(self) -> List[BaselineProfile]:
+        """Execute the query to list baseline profiles."""
+        params = {
+            "filter[organizationIds]": ",".join(map(str, self.organization_ids))
+        }
+        
+        response = self.http_client.get("baseline-profiles", params=params)
+        
+        if response.get("success"):
+            profiles_data = response.get("result", {}).get("entities", [])
+            # Use Pydantic parsing with proper field aliasing
+            return [BaselineProfile.model_validate(profile_data) for profile_data in profiles_data]
+        
+        return []
+
+
+class GetBaselineProfileQuery(Query[BaselineProfile]):
+    """Query to get a specific baseline profile by ID."""
+    
+    def __init__(self, http_client: HTTPClient, profile_id: str):
+        self.http_client = http_client
+        self.profile_id = profile_id
+    
+    def execute(self) -> BaselineProfile:
+        """Execute the query to get baseline profile details."""
+        response = self.http_client.get(f"baseline-profiles/{self.profile_id}")
+        
+        if response.get("success"):
+            profile_data = response.get("result", {})
+            # Use Pydantic parsing with proper field aliasing
+            return BaselineProfile.model_validate(profile_data)
+        
+        raise Exception(f"Baseline profile not found: {self.profile_id}")
+
+
+class GetBaselineSchedulesQuery(Query[List[BaselineSchedule]]):
+    """Query to get baseline schedules."""
+    
+    def __init__(self, http_client: HTTPClient, baseline_id: Optional[str] = None, organization_ids: Optional[List[int]] = None):
+        self.http_client = http_client
+        self.baseline_id = baseline_id
+        self.organization_ids = organization_ids or [0]
+    
+    def execute(self) -> List[BaselineSchedule]:
+        """Execute the query to get baseline schedules."""
+        params = {
+            "filter[organizationIds]": ",".join(map(str, self.organization_ids))
+        }
+        
+        if self.baseline_id:
+            params["baselineId"] = self.baseline_id
+        
+        response = self.http_client.get("baseline-schedules", params=params)
+        
+        if response.get("success"):
+            schedules_data = response.get("result", {}).get("entities", [])
+            # Use Pydantic parsing with proper field aliasing
+            return [BaselineSchedule.model_validate(schedule_data) for schedule_data in schedules_data]
+        
+        return [] 

binalyze_air/queries/cases.py

@@ -0,0 +1,293 @@
+"""
+Case-related queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.cases import (
+    Case, CaseActivity, CaseEndpoint, CaseTask, User, CaseFilter, CaseActivityFilter,
+    CaseEndpointFilter, CaseTaskFilter, CaseUserFilter
+)
+from ..http_client import HTTPClient
+
+
+class ListCasesQuery(Query[List[Case]]):
+    """Query to list cases with optional filtering."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[CaseFilter] = None, organization_ids: Optional[List[int]] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or CaseFilter()
+        self.organization_ids = organization_ids or [0]
+    
+    def execute(self) -> List[Case]:
+        """Execute the query to list cases."""
+        params = self.filter_params.to_params()
+        
+        # Add organization IDs
+        params["filter[organizationIds]"] = ",".join(map(str, self.organization_ids))
+        
+        # Ensure consistent sorting to match API defaults
+        if "sortBy" not in params:
+            params["sortBy"] = "createdAt"
+        if "sortType" not in params:
+            params["sortType"] = "ASC"
+        
+        response = self.http_client.get("cases", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return [Case.model_validate(entity_data) for entity_data in entities]
+
+
+class GetCaseQuery(Query[Case]):
+    """Query to get a specific case by ID."""
+    
+    def __init__(self, http_client: HTTPClient, case_id: str):
+        self.http_client = http_client
+        self.case_id = case_id
+    
+    def execute(self) -> Case:
+        """Execute the query to get case details."""
+        response = self.http_client.get(f"cases/{self.case_id}")
+        
+        entity_data = response.get("result", {})
+        
+        # Use Pydantic parsing with proper field aliasing
+        return Case.model_validate(entity_data)
+
+
+class GetCaseActivitiesQuery(Query[List[CaseActivity]]):
+    """Query to get activities for a specific case."""
+    
+    def __init__(self, http_client: HTTPClient, case_id: str, filter_params: Optional[CaseActivityFilter] = None):
+        self.http_client = http_client
+        self.case_id = case_id
+        self.filter_params = filter_params or CaseActivityFilter()
+    
+    def execute(self) -> List[CaseActivity]:
+        """Execute the query to get case activities."""
+        params = {}
+        
+        # Add pagination parameters
+        if self.filter_params.page_number is not None:
+            params["pageNumber"] = self.filter_params.page_number
+        if self.filter_params.page_size is not None:
+            params["pageSize"] = self.filter_params.page_size
+            
+        # Add sorting parameters
+        if self.filter_params.sort_by is not None:
+            params["sortBy"] = self.filter_params.sort_by
+        if self.filter_params.sort_type is not None:
+            params["sortType"] = self.filter_params.sort_type
+            
+        # Add filter parameters
+        if self.filter_params.performed_by is not None:
+            params["filter[performedBy]"] = ",".join(self.filter_params.performed_by)
+        if self.filter_params.types is not None:
+            params["filter[types]"] = ",".join(self.filter_params.types)
+        if self.filter_params.search_term is not None:
+            params["filter[searchTerm]"] = self.filter_params.search_term
+        if self.filter_params.occurred_at is not None:
+            params["filter[occurredAt]"] = self.filter_params.occurred_at
+        
+        response = self.http_client.get(f"cases/{self.case_id}/activities", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return [CaseActivity.model_validate(entity_data) for entity_data in entities]
+
+
+class GetCaseEndpointsQuery(Query[List[CaseEndpoint]]):
+    """Query to get endpoints for a specific case."""
+    
+    def __init__(self, http_client: HTTPClient, case_id: str, filter_params: Optional[CaseEndpointFilter] = None):
+        self.http_client = http_client
+        self.case_id = case_id
+        self.filter_params = filter_params or CaseEndpointFilter()
+    
+    def execute(self) -> List[CaseEndpoint]:
+        """Execute the query to get case endpoints."""
+        params = {}
+        
+        # Add pagination parameters
+        if self.filter_params.page_number is not None:
+            params["pageNumber"] = self.filter_params.page_number
+        if self.filter_params.page_size is not None:
+            params["pageSize"] = self.filter_params.page_size
+            
+        # Add sorting parameters
+        if self.filter_params.sort_by is not None:
+            params["sortBy"] = self.filter_params.sort_by
+        if self.filter_params.sort_type is not None:
+            params["sortType"] = self.filter_params.sort_type
+            
+        # Add filter parameters
+        if self.filter_params.organization_ids is not None:
+            params["filter[organizationIds]"] = ",".join(map(str, self.filter_params.organization_ids))
+        else:
+            # Default to organization 0 if not specified
+            params["filter[organizationIds]"] = "0"
+            
+        if self.filter_params.search_term is not None:
+            params["filter[searchTerm]"] = self.filter_params.search_term
+        if self.filter_params.name is not None:
+            params["filter[name]"] = self.filter_params.name
+        if self.filter_params.ip_address is not None:
+            params["filter[ipAddress]"] = self.filter_params.ip_address
+        if self.filter_params.group_id is not None:
+            params["filter[groupId]"] = self.filter_params.group_id
+        if self.filter_params.group_full_path is not None:
+            params["filter[groupFullPath]"] = self.filter_params.group_full_path
+        if self.filter_params.label is not None:
+            params["filter[label]"] = self.filter_params.label
+        if self.filter_params.last_seen is not None:
+            params["filter[lastSeen]"] = self.filter_params.last_seen
+        if self.filter_params.managed_status is not None:
+            params["filter[managedStatus]"] = ",".join(self.filter_params.managed_status)
+        if self.filter_params.isolation_status is not None:
+            params["filter[isolationStatus]"] = ",".join(self.filter_params.isolation_status)
+        if self.filter_params.platform is not None:
+            params["filter[platform]"] = ",".join(self.filter_params.platform)
+        if self.filter_params.issue is not None:
+            params["filter[issue]"] = ",".join(self.filter_params.issue)
+        if self.filter_params.online_status is not None:
+            params["filter[onlineStatus]"] = ",".join(self.filter_params.online_status)
+        if self.filter_params.tags is not None:
+            params["filter[tags]"] = ",".join(self.filter_params.tags)
+        if self.filter_params.version is not None:
+            params["filter[version]"] = self.filter_params.version
+        if self.filter_params.policy is not None:
+            params["filter[policy]"] = self.filter_params.policy
+        if self.filter_params.included_endpoint_ids is not None:
+            params["filter[includedEndpointIds]"] = ",".join(self.filter_params.included_endpoint_ids)
+        if self.filter_params.excluded_endpoint_ids is not None:
+            params["filter[excludedEndpointIds]"] = ",".join(self.filter_params.excluded_endpoint_ids)
+        if self.filter_params.aws_regions is not None:
+            params["filter[awsRegions]"] = ",".join(self.filter_params.aws_regions)
+        if self.filter_params.azure_regions is not None:
+            params["filter[azureRegions]"] = ",".join(self.filter_params.azure_regions)
+        
+        response = self.http_client.get(f"cases/{self.case_id}/endpoints", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return [CaseEndpoint.model_validate(entity_data) for entity_data in entities]
+
+
+class GetCaseTasksQuery(Query[List[CaseTask]]):
+    """Query to get tasks for a specific case."""
+    
+    def __init__(self, http_client: HTTPClient, case_id: str, filter_params: Optional[CaseTaskFilter] = None):
+        self.http_client = http_client
+        self.case_id = case_id
+        self.filter_params = filter_params or CaseTaskFilter()
+    
+    def execute(self) -> List[CaseTask]:
+        """Execute the query to get case tasks."""
+        params = {}
+        
+        # Add pagination parameters
+        if self.filter_params.page_number is not None:
+            params["pageNumber"] = self.filter_params.page_number
+        if self.filter_params.page_size is not None:
+            params["pageSize"] = self.filter_params.page_size
+            
+        # Add sorting parameters
+        if self.filter_params.sort_by is not None:
+            params["sortBy"] = self.filter_params.sort_by
+        if self.filter_params.sort_type is not None:
+            params["sortType"] = self.filter_params.sort_type
+            
+        # Add filter parameters
+        if self.filter_params.organization_ids is not None:
+            params["filter[organizationIds]"] = ",".join(map(str, self.filter_params.organization_ids))
+        else:
+            # Default to organization 0 if not specified
+            params["filter[organizationIds]"] = "0"
+            
+        if self.filter_params.search_term is not None:
+            params["filter[searchTerm]"] = self.filter_params.search_term
+        if self.filter_params.name is not None:
+            params["filter[name]"] = self.filter_params.name
+        if self.filter_params.endpoint_ids is not None:
+            params["filter[endpointIds]"] = ",".join(self.filter_params.endpoint_ids)
+        if self.filter_params.execution_type is not None:
+            params["filter[executionType]"] = self.filter_params.execution_type
+        if self.filter_params.status is not None:
+            params["filter[status]"] = self.filter_params.status
+        if self.filter_params.type is not None:
+            params["filter[type]"] = self.filter_params.type
+        if self.filter_params.asset_names is not None:
+            params["filter[assetNames]"] = self.filter_params.asset_names
+        if self.filter_params.started_by is not None:
+            params["filter[startedBy]"] = self.filter_params.started_by
+        
+        response = self.http_client.get(f"cases/{self.case_id}/tasks", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return [CaseTask.model_validate(entity_data) for entity_data in entities]
+
+
+class GetCaseUsersQuery(Query[List[User]]):
+    """Query to get users for a specific case."""
+    
+    def __init__(self, http_client: HTTPClient, case_id: str, filter_params: Optional[CaseUserFilter] = None):
+        self.http_client = http_client
+        self.case_id = case_id
+        self.filter_params = filter_params or CaseUserFilter()
+    
+    def execute(self) -> List[User]:
+        """Execute the query to get case users."""
+        params = {}
+        
+        # Add pagination parameters
+        if self.filter_params.page_number is not None:
+            params["pageNumber"] = self.filter_params.page_number
+        if self.filter_params.page_size is not None:
+            params["pageSize"] = self.filter_params.page_size
+            
+        # Add sorting parameters
+        if self.filter_params.sort_by is not None:
+            params["sortBy"] = self.filter_params.sort_by
+        if self.filter_params.sort_type is not None:
+            params["sortType"] = self.filter_params.sort_type
+            
+        # Add filter parameters
+        if self.filter_params.organization_ids is not None:
+            params["filter[organizationIds]"] = ",".join(map(str, self.filter_params.organization_ids))
+        else:
+            # Default to organization 0 if not specified
+            params["filter[organizationIds]"] = "0"
+            
+        if self.filter_params.search_term is not None:
+            params["filter[searchTerm]"] = self.filter_params.search_term
+        
+        response = self.http_client.get(f"cases/{self.case_id}/users", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return [User.model_validate(entity_data) for entity_data in entities]
+
+
+class CheckCaseNameQuery(Query[bool]):
+    """Query to check if a case name is available."""
+    
+    def __init__(self, http_client: HTTPClient, name: str):
+        self.http_client = http_client
+        self.name = name
+    
+    def execute(self) -> bool:
+        """Execute the query to check case name availability."""
+        params = {"name": self.name}
+        
+        response = self.http_client.get("cases/check", params=params)
+        
+        # Return the actual result (whether name is taken/available)
+        return response.get("result", False) 

binalyze_air/queries/endpoints.py

@@ -0,0 +1,25 @@
+"""
+Endpoints queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.endpoints import EndpointTag, EndpointTagFilter
+from ..http_client import HTTPClient
+
+
+class GetEndpointTagsQuery(Query[List[EndpointTag]]):
+    """Query to get endpoint tags."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[EndpointTagFilter] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or EndpointTagFilter()
+    
+    def execute(self) -> List[EndpointTag]:
+        """Execute the query to get endpoint tags."""
+        params = self.filter_params.to_params()
+        response = self.http_client.get("endpoints/tags", params=params)
+        
+        entities = response.get("result", [])
+        return [EndpointTag(**item) for item in entities] 

binalyze_air/queries/event_subscription.py

@@ -0,0 +1,55 @@
+"""
+Event Subscription queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.event_subscription import EventSubscription, EventSubscriptionFilter
+from ..http_client import HTTPClient
+
+
+class ListEventSubscriptionsQuery(Query[List[EventSubscription]]):
+    """Query to list event subscriptions."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[EventSubscriptionFilter] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or EventSubscriptionFilter()
+    
+    def execute(self) -> List[EventSubscription]:
+        """Execute the query to get event subscriptions."""
+        params = self.filter_params.to_params()
+        response = self.http_client.get("event-subscription", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Use Pydantic parsing with proper field aliasing
+        subscriptions = []
+        for item in entities:
+            # Convert id to string as Pydantic expects
+            if "id" in item:
+                item["id"] = str(item["id"])
+            subscriptions.append(EventSubscription.model_validate(item))
+        
+        return subscriptions
+
+
+class GetEventSubscriptionQuery(Query[EventSubscription]):
+    """Query to get a specific event subscription."""
+    
+    def __init__(self, http_client: HTTPClient, subscription_id: str):
+        self.http_client = http_client
+        self.subscription_id = subscription_id
+    
+    def execute(self) -> EventSubscription:
+        """Execute the query to get a specific event subscription."""
+        response = self.http_client.get(f"event-subscription/{self.subscription_id}")
+        
+        entity_data = response.get("result", {})
+        
+        # Convert id to string as Pydantic expects
+        if "id" in entity_data:
+            entity_data["id"] = str(entity_data["id"])
+        
+        # Use Pydantic parsing with proper field aliasing
+        return EventSubscription.model_validate(entity_data)