{"components":{"responses":{},"schemas":{"EntraDirectoryResponse":{"description":"Response schema for single Entra Directory","properties":{"data":{"$ref":"#/components/schemas/EntraDirectory"}},"title":"EntraDirectoryResponse","type":"object"},"IruDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/IruDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"IruDeviceListResponse","type":"object"},"ActorResponse":{"description":"Response schema for single Actor","properties":{"data":{"$ref":"#/components/schemas/Actor"}},"title":"ActorResponse","type":"object"},"GoogleAuthProviderListResponse":{"description":"Response schema for multiple Google Auth Providers","properties":{"data":{"description":"Google Auth Provider details","items":{"$ref":"#/components/schemas/GoogleAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"GoogleAuthProviderListResponse","type":"object"},"GroupResponse":{"description":"Response schema for single Group","properties":{"data":{"$ref":"#/components/schemas/Group"}},"title":"GroupResponse","type":"object"},"GoogleDirectoryResponse":{"description":"Response schema for single Google Directory","properties":{"data":{"$ref":"#/components/schemas/GoogleDirectory"}},"title":"GoogleDirectoryResponse","type":"object"},"MembershipPutRequest":{"description":"PUT body for updating Memberships","properties":{"memberships":{"example":[{"actor_id":"4ddfa557-7dfc-484f-894c-2024ec3fe9f7"},{"actor_id":"89d22f71-939d-442d-b148-897b730adfb4"}],"items":{"properties":{"actor_id":{"description":"Actor ID","format":"uuid","type":"string"}},"type":"object"},"type":"array"}},"required":["memberships"],"title":"MembershipPutRequest","type":"object"},"ipv6 no_value device comparison":{"additionalProperties":false,"properties":{"field":{"description":"ipv6 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv6"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ipv6 no_value device comparison","type":"object"},"IruPostureProvider":{"description":"Iru (formerly Kandji) posture provider","properties":{"account_id":{"format":"uuid","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"name":{"type":"string"},"region":{"enum":["us","eu"],"type":"string"},"subdomain":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"type":{"enum":["iru"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","name","region","subdomain","synced_at","type","updated_at"],"title":"IruPostureProvider","type":"object"},"ipv4 no_value device comparison":{"additionalProperties":false,"properties":{"field":{"description":"ipv4 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv4"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ipv4 no_value device comparison","type":"object"},"ip list provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"ip field; see PolicyPostureNode for platform applicability","enum":["defender.last_external_ip_address","defender.last_ip_address","santa.last_preflight_ip","sentinelone.external_ip","sentinelone.last_ip_to_management"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ip list provider comparison","type":"object"},"SentinelOneDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/SentinelOneDevice"}},"title":"SentinelOneDeviceResponse","type":"object"},"boolean no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"boolean field; see PolicyPostureNode for platform applicability","enum":["defender.enrolled","defender.entra_joined","defender.is_excluded","defender.is_potential_duplication","defender.os_up_to_date","intune.attestation_bit_locker_enabled","intune.attestation_boot_debugging","intune.attestation_code_integrity","intune.attestation_data_execution_policy_enabled","intune.attestation_early_launch_anti_malware_driver_protection","intune.attestation_operating_system_kernel_debugging","intune.attestation_safe_mode","intune.attestation_secure_boot","intune.attestation_supported","intune.attestation_test_signing","intune.attestation_virtual_secure_mode","intune.attestation_windows_pe","intune.config_manager_compliance_policy","intune.config_manager_device_configuration","intune.config_manager_inventory","intune.config_manager_modern_apps","intune.config_manager_resource_access","intune.config_manager_windows_update_for_business","intune.eas_activated","intune.enrolled","intune.entra_registered","intune.is_encrypted","intune.is_supervised","intune.jail_broken","intune.os_up_to_date","intune.require_user_enrollment_approval","iru.activation_lock_allowed_while_supervised","iru.activation_lock_bypass_code_failed","iru.activation_lock_supported","iru.agent_installed","iru.any_signed_os","iru.apple_silicon","iru.bootstrap_token_auth","iru.bootstrap_token_escrowed","iru.data_roaming","iru.device_activation_lock_enabled","iru.enrolled","iru.filevault_enabled","iru.filevault_key_escrowed","iru.filevault_regeneration_needed","iru.firewall_allow_signed_applications","iru.firewall_block_all_incoming","iru.firewall_enabled","iru.firewall_logging","iru.firewall_stealth_mode","iru.firewall_unloading","iru.gatekeeper_enabled","iru.gatekeeper_trusted_developers","iru.hotspot","iru.is_missing","iru.is_removed","iru.kext_requires_bootstrap_token","iru.mdm_enabled","iru.mdm_manages_kext","iru.os_up_to_date","iru.shared_ipad","iru.sip_enabled","iru.software_update_requires_bootstrap_token","iru.ssv_enabled","iru.user_activation_lock_enabled","iru.user_is_archived","iru.user_manages_kext","santa.enrolled","santa.os_up_to_date","sentinelone.allow_remote_shell","sentinelone.encrypted_applications","sentinelone.enrolled","sentinelone.firewall_enabled","sentinelone.has_containerized_workload","sentinelone.in_remote_shell_session","sentinelone.infected","sentinelone.is_active","sentinelone.is_ad_connector","sentinelone.is_decommissioned","sentinelone.is_hyper_automate","sentinelone.is_pending_uninstall","sentinelone.is_uninstalled","sentinelone.is_up_to_date","sentinelone.location_enabled","sentinelone.network_quarantine_enabled","sentinelone.os_up_to_date","sentinelone.proxy_console","sentinelone.proxy_deep_visibility","sentinelone.proxy_pac_file_usage","sentinelone.threat_reboot_required","sophos.cloned","sophos.enrolled","sophos.isolation_admin_isolated","sophos.isolation_self_isolated","sophos.online","sophos.os_is_server","sophos.os_up_to_date","sophos.tamper_protection_enabled","sophos.tamper_protection_supported"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"boolean no_value provider comparison","type":"object"},"DeviceMembershipAllDevices":{"additionalProperties":false,"description":"Every Client in the Account","example":{"device":{"field":"account_id","op":"eq","value":{"subject":"account_id"}}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["account_id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"additionalProperties":false,"properties":{"subject":{"enum":["account_id"],"type":"string"}},"required":["subject"],"type":"object"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipAllDevices","type":"object"},"IntuneDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/IntuneDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"IntuneDeviceListResponse","type":"object"},"DeviceMembershipActorGroup":{"additionalProperties":false,"description":"The Clients of every Actor in one Group","example":{"actor_group":{"field":"id","op":"eq","value":"b3a1c6e2-5f4d-4e7a-9c8b-1d2e3f4a5b6c"}},"properties":{"actor_group":{"additionalProperties":false,"properties":{"field":{"enum":["id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"description":"Group ID","format":"uuid","type":"string"}},"required":["field","op","value"],"type":"object"}},"required":["actor_group"],"title":"DeviceMembershipActorGroup","type":"object"},"PolicyCreateParams":{"description":"Policy attributes accepted when creating a Policy","properties":{"conditions":{"description":"Conditions that must be satisfied for the Policy to grant access","example":[{"operator":"is_in","property":"remote_ip_location_region","values":["US","CA"]}],"items":{"$ref":"#/components/schemas/PolicyCondition"},"type":"array"},"description":{"description":"Policy Description","example":"Policy to allow something","nullable":true,"type":"string"},"flow_log_uploads_enabled":{"default":true,"description":"Whether flow logs are reported for connections authorized by this Policy. Defaults to true. Always false for Internet Resource policies.","example":true,"type":"boolean"},"group_id":{"description":"Group ID","example":"88eae9ce-9179-48c6-8430-770e38dd4775","format":"uuid","type":"string"},"is_disabled":{"default":false,"description":"Whether the Policy is disabled. A disabled Policy grants no access but is otherwise retained. Defaults to false.","example":false,"type":"boolean"},"postures":{"anyOf":[{"$ref":"#/components/schemas/PolicyPostureNode"},{"enum":[null],"nullable":true,"type":"object"}],"description":"Device posture expression required in addition to every entry in conditions. Omit or set to null for no posture requirement. A non-null expression requires the account's device_posture entitlement (Enterprise); otherwise returns HTTP 403. See PolicyPostureNode for fields, operators, platform behavior, and limits.","example":{"and":[{"field":"intune.enrolled","op":"is","value":true},{"field":"intune.compliance_state","op":"is","rows":"all","value":"compliant"},{"field":"intune.last_sync_at","op":"within_last","value":"PT24H"},{"or":[{"field":"firezone.last_seen_version","op":"gte","value":"@latest"},{"not":{"field":"firezone.hostname","op":"starts_with","value":"test-"}}]}]},"nullable":true},"require_attestation":{"default":false,"description":"Whether the Client must present a valid X.509 certificate from one of the account's trust anchors on its current connection. Device posture checks then match only on the identifiers that certificate proves. Defaults to false. Setting it to true returns 422 when the account has no trust anchors.","example":false,"type":"boolean"},"resource_id":{"description":"Resource ID","example":"a9f60587-793c-46ae-8525-597f43ab2fb1","format":"uuid","type":"string"}},"required":["group_id","resource_id"],"title":"PolicyCreateParams","type":"object"},"string list provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string list provider comparison","type":"object"},"SantaDevice":{"description":"Santa host synced from North Pole Security Workshop","properties":{"account_id":{"format":"uuid","nullable":false,"type":"string"},"configured_client_mode":{"nullable":true,"type":"string"},"first_seen_at":{"format":"date-time","nullable":true,"type":"string"},"hostname":{"nullable":true,"type":"string"},"id":{"format":"uuid","nullable":false,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"last_preflight_at":{"format":"date-time","nullable":true,"type":"string"},"last_preflight_ip":{"nullable":true,"type":"string"},"last_seen_client_mode":{"nullable":true,"type":"string"},"last_sync_at":{"format":"date-time","nullable":true,"type":"string"},"machine_model":{"nullable":true,"type":"string"},"os_build":{"nullable":true,"type":"string"},"os_type":{"nullable":true,"type":"string"},"os_version":{"nullable":true,"type":"string"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"},"primary_user":{"nullable":true,"type":"string"},"primary_user_groups":{"items":{"type":"string"},"nullable":true,"type":"array"},"rule_sync_at":{"format":"date-time","nullable":true,"type":"string"},"santa_id":{"nullable":false,"type":"string"},"santa_version":{"nullable":true,"type":"string"},"santanetd_version":{"nullable":true,"type":"string"},"serial_number":{"nullable":true,"type":"string"},"sip_status":{"nullable":true,"type":"integer"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"tags":{"items":{"type":"string"},"nullable":true,"type":"array"},"temporary_admin_mode_ends_at":{"format":"date-time","nullable":true,"type":"string"},"temporary_admin_mode_user":{"nullable":true,"type":"string"},"temporary_monitor_mode_ends_at":{"format":"date-time","nullable":true,"type":"string"},"updated_at":{"format":"date-time","nullable":true,"type":"string"}},"required":["account_id","id","santa_id","posture_provider_id","serial_number","machine_model","hostname","os_version","os_build","os_type","sip_status","primary_user","primary_user_groups","santa_version","santanetd_version","last_seen_client_mode","last_sync_at","rule_sync_at","last_preflight_at","last_preflight_ip","tags","configured_client_mode","temporary_monitor_mode_ends_at","first_seen_at","temporary_admin_mode_ends_at","temporary_admin_mode_user","synced_at","inserted_at","updated_at"],"title":"SantaDevice","type":"object"},"IntunePostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/IntunePostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"IntunePostureProviderListResponse","type":"object"},"datetime scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["before","after"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"format":"date-time","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime scalar provider comparison","type":"object"},"SantaPostureProvider":{"description":"Santa posture provider backed by North Pole Security Workshop","properties":{"account_id":{"format":"uuid","type":"string"},"api_url":{"format":"uri","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"name":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"type":{"enum":["santa"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","api_url","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","name","synced_at","type","updated_at"],"title":"SantaPostureProvider","type":"object"},"version scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["defender.agent_version","intune.attestation_boot_app_security_version","intune.attestation_boot_manager_security_version","intune.attestation_boot_manager_version","intune.attestation_code_integrity_check_version","intune.attestation_content_version","intune.attestation_tpm_version","intune.os_version","iru.agent_version","iru.display_os_version","iru.firewall_version","iru.gatekeeper_opaque_version","iru.gatekeeper_version","iru.malware_removal_tool_version","iru.os_version","iru.supplemental_os_version_extra","iru.xprotect_version","santa.os_version","santa.santa_version","santa.santanetd_version","sentinelone.agent_version","sentinelone.os_revision","sentinelone.ranger_version"],"type":"string"},"op":{"enum":["is","is_not","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Segment-wise version, or @latest for firezone.last_seen_version only","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"version scalar provider comparison","type":"object"},"boolean scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"boolean field; see PolicyPostureNode for platform applicability","enum":["defender.enrolled","defender.entra_joined","defender.is_excluded","defender.is_potential_duplication","defender.os_up_to_date","intune.attestation_bit_locker_enabled","intune.attestation_boot_debugging","intune.attestation_code_integrity","intune.attestation_data_execution_policy_enabled","intune.attestation_early_launch_anti_malware_driver_protection","intune.attestation_operating_system_kernel_debugging","intune.attestation_safe_mode","intune.attestation_secure_boot","intune.attestation_supported","intune.attestation_test_signing","intune.attestation_virtual_secure_mode","intune.attestation_windows_pe","intune.config_manager_compliance_policy","intune.config_manager_device_configuration","intune.config_manager_inventory","intune.config_manager_modern_apps","intune.config_manager_resource_access","intune.config_manager_windows_update_for_business","intune.eas_activated","intune.enrolled","intune.entra_registered","intune.is_encrypted","intune.is_supervised","intune.jail_broken","intune.os_up_to_date","intune.require_user_enrollment_approval","iru.activation_lock_allowed_while_supervised","iru.activation_lock_bypass_code_failed","iru.activation_lock_supported","iru.agent_installed","iru.any_signed_os","iru.apple_silicon","iru.bootstrap_token_auth","iru.bootstrap_token_escrowed","iru.data_roaming","iru.device_activation_lock_enabled","iru.enrolled","iru.filevault_enabled","iru.filevault_key_escrowed","iru.filevault_regeneration_needed","iru.firewall_allow_signed_applications","iru.firewall_block_all_incoming","iru.firewall_enabled","iru.firewall_logging","iru.firewall_stealth_mode","iru.firewall_unloading","iru.gatekeeper_enabled","iru.gatekeeper_trusted_developers","iru.hotspot","iru.is_missing","iru.is_removed","iru.kext_requires_bootstrap_token","iru.mdm_enabled","iru.mdm_manages_kext","iru.os_up_to_date","iru.shared_ipad","iru.sip_enabled","iru.software_update_requires_bootstrap_token","iru.ssv_enabled","iru.user_activation_lock_enabled","iru.user_is_archived","iru.user_manages_kext","santa.enrolled","santa.os_up_to_date","sentinelone.allow_remote_shell","sentinelone.encrypted_applications","sentinelone.enrolled","sentinelone.firewall_enabled","sentinelone.has_containerized_workload","sentinelone.in_remote_shell_session","sentinelone.infected","sentinelone.is_active","sentinelone.is_ad_connector","sentinelone.is_decommissioned","sentinelone.is_hyper_automate","sentinelone.is_pending_uninstall","sentinelone.is_uninstalled","sentinelone.is_up_to_date","sentinelone.location_enabled","sentinelone.network_quarantine_enabled","sentinelone.os_up_to_date","sentinelone.proxy_console","sentinelone.proxy_deep_visibility","sentinelone.proxy_pac_file_usage","sentinelone.threat_reboot_required","sophos.cloned","sophos.enrolled","sophos.isolation_admin_isolated","sophos.isolation_self_isolated","sophos.online","sophos.os_is_server","sophos.os_up_to_date","sophos.tamper_protection_enabled","sophos.tamper_protection_supported"],"type":"string"},"op":{"enum":["is"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"boolean"}},"required":["field","op","value"],"title":"boolean scalar provider comparison","type":"object"},"string_array scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["contains","does_not_contain"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string_array scalar provider comparison","type":"object"},"OktaAuthProvider":{"description":"Okta Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_id":{"description":"Client ID","example":"0oa1b2c3d4e5EXAMPLE","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_default":{"description":"Whether provider is default","example":false,"type":"boolean"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"issuer":{"description":"Issuer","example":"https://example.okta.com","type":"string"},"name":{"description":"Provider name","example":"Okta","type":"string"},"okta_domain":{"description":"Okta domain","example":"example.okta.com","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_id","client_session_lifetime_secs","context","id","inserted_at","is_default","is_disabled","issuer","name","okta_domain","portal_session_lifetime_secs","updated_at"],"title":"OktaAuthProvider","type":"object"},"GatewayResponse":{"description":"Response schema for single Gateway","properties":{"data":{"$ref":"#/components/schemas/Gateway"}},"title":"GatewayResponse","type":"object"},"ResourceCreateRequest":{"description":"POST body for creating a Resource. `site_id` is required for every type except `device_pool`, which needs `device_membership_criteria` instead.","properties":{"resource":{"properties":{"address":{"description":"Resource address. Required for `cidr`, `ip` and `dns`. `device_pool` and `internet` Resources ignore it.","example":"10.0.0.10","nullable":true,"type":"string"},"address_description":{"description":"Resource address description","example":"Production Database","nullable":true,"type":"string"},"device_membership_criteria":{"$ref":"#/components/schemas/DeviceMembershipCriteria"},"filters":{"description":"Traffic filters restricting the protocols and ports the Resource exposes","example":[{"ports":["5432"],"protocol":"tcp"}],"items":{"$ref":"#/components/schemas/ResourceFilter"},"type":"array"},"ip_stack":{"description":"IP stack type. Only supported for DNS resources.","enum":["ipv4_only","ipv6_only","dual"],"nullable":true,"type":"string"},"name":{"description":"Resource name","example":"Prod DB","type":"string"},"site_id":{"description":"Site to connect the Resource to. Required for all types except `device_pool`, which takes none. The Internet Site is reserved for the Internet Resource and cannot be used.","example":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","format":"uuid","nullable":true,"title":"SiteID","type":"string"},"type":{"description":"Resource type. `internet` is accepted only in the Internet Site. `device_pool` takes no `site_id` and no `address`.","enum":["cidr","ip","dns","internet","device_pool"],"example":"ip","type":"string"}},"required":["name","type"],"type":"object"}},"required":["resource"],"title":"ResourceCreateRequest","type":"object"},"ClientTokenCreateResponse":{"description":"Response schema for a new Client Token","properties":{"data":{"$ref":"#/components/schemas/ClientTokenWithSecret"}},"title":"ClientTokenCreateResponse","type":"object"},"PostureField":{"description":"A field a Policy's `postures` expression can test","properties":{"field":{"description":"Value for a leaf's `field`, as `<provider>.<attribute>`","example":"intune.compliance_state","type":"string"},"operators":{"description":"Values for a leaf's `op` that this field accepts","example":["is","is_not","exists","does_not_exist"],"items":{"enum":["eq","ne","gt","gte","lt","lte","is","is_not","is_in","is_not_in","contains","does_not_contain","starts_with","ends_with","matches","does_not_match","is_in_cidr","is_not_in_cidr","is_empty","is_not_empty","before","after","within_last","not_within_last","contains_any_of","contains_all_of","exists","does_not_exist"],"type":"string"},"type":"array"},"platforms":{"description":"Platforms the field applies to. A leaf on this field is skipped for a device on any other platform.","example":["windows","macos","ios","android"],"items":{"enum":["windows","macos","linux","ios","android"],"type":"string"},"type":"array"},"provider":{"description":"Provider the field comes from","enum":["firezone","intune","iru","defender","santa","sentinelone","sophos"],"example":"intune","type":"string"},"rows_supported":{"description":"Whether a leaf on this field accepts `rows`. False for `firezone` fields, which describe exactly one connecting device.","example":true,"type":"boolean"},"type":{"description":"Type of the field, which decides the operators and the value","enum":["string","enum_string","boolean","integer","float","version","datetime","ip","ipv4","ipv6","string_array","json"],"example":"enum_string","type":"string"}},"required":["field","provider","type","operators","platforms","rows_supported"],"title":"PostureField","type":"object"},"DefenderPostureProvider":{"description":"Microsoft Defender for Endpoint posture provider","properties":{"account_id":{"format":"uuid","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"name":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"type":"string"},"type":{"enum":["defender"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","name","synced_at","tenant_id","type","updated_at"],"title":"DefenderPostureProvider","type":"object"},"GatewayCreateRequest":{"description":"Request body for provisioning a Gateway","properties":{"gateway":{"$ref":"#/components/schemas/GatewayCreate"}},"title":"GatewayCreateRequest","type":"object"},"ClientToken":{"description":"Client Token metadata","properties":{"actor_id":{"description":"Actor ID","example":"43a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"expires_at":{"description":"Expiration","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"},"id":{"description":"Client Token ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"}},"required":["actor_id","expires_at","id","inserted_at","updated_at"],"title":"ClientToken","type":"object"},"EntraAuthProvider":{"description":"Entra Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"email_claim":{"description":"OIDC claim to use as email","enum":["email","upn","preferred_username"],"example":"upn","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_default":{"description":"Whether provider is default","example":false,"type":"boolean"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"name":{"description":"Provider name","example":"Entra","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"sign_in_tenant_id":{"description":"Verified tenant ID whose sign-in endpoint users authenticate through, so that B2B guest users of that tenant can sign in. Null when users authenticate through their home tenant.","example":"12345678-1234-1234-1234-123456789012","format":"uuid","nullable":true,"readOnly":true,"type":"string"},"tenant_ids":{"description":"Verified Entra tenant IDs allowed to authenticate through this provider","example":["12345678-1234-1234-1234-123456789012"],"items":{"format":"uuid","type":"string"},"minItems":1,"readOnly":true,"type":"array","uniqueItems":true},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_session_lifetime_secs","context","email_claim","id","inserted_at","is_default","is_disabled","tenant_ids","name","portal_session_lifetime_secs","sign_in_tenant_id","updated_at"],"title":"EntraAuthProvider","type":"object"},"string_array list provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["contains_any_of","contains_all_of"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string_array list provider comparison","type":"object"},"string no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string no_value provider comparison","type":"object"},"EntraAuthProviderResponse":{"description":"Response schema for single Entra Auth Provider","properties":{"data":{"$ref":"#/components/schemas/EntraAuthProvider"}},"title":"EntraAuthProviderResponse","type":"object"},"ClientTokenRequest":{"description":"POST body for creating a Client Token","properties":{"client_token":{"$ref":"#/components/schemas/ClientTokenCreate"}},"required":["client_token"],"title":"ClientTokenRequest","type":"object"},"datetime no_value device comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"datetime no_value device comparison","type":"object"},"PolicyPostureLeaf":{"description":"One typed comparison. Each alternative enumerates valid fields, their\noperators, and the corresponding value type. All keys are explicit;\nunknown keys are rejected. Provider comparisons optionally accept `rows`;\nFirezone device comparisons do not.\n\nValue length limits are enforced in bytes by the policy parser, including\neach string in a list. The parser additionally checks regex syntax,\nversions, CIDR address families, positive durations, and the `@latest`\nmacro. See PolicyPostureNode for platform and missing-data semantics.\n","example":{"field":"intune.compliance_state","op":"is","rows":"all","value":"compliant"},"oneOf":[{"additionalProperties":false,"properties":{"field":{"description":"boolean field; see PolicyPostureNode for platform applicability","enum":["defender.enrolled","defender.entra_joined","defender.is_excluded","defender.is_potential_duplication","defender.os_up_to_date","intune.attestation_bit_locker_enabled","intune.attestation_boot_debugging","intune.attestation_code_integrity","intune.attestation_data_execution_policy_enabled","intune.attestation_early_launch_anti_malware_driver_protection","intune.attestation_operating_system_kernel_debugging","intune.attestation_safe_mode","intune.attestation_secure_boot","intune.attestation_supported","intune.attestation_test_signing","intune.attestation_virtual_secure_mode","intune.attestation_windows_pe","intune.config_manager_compliance_policy","intune.config_manager_device_configuration","intune.config_manager_inventory","intune.config_manager_modern_apps","intune.config_manager_resource_access","intune.config_manager_windows_update_for_business","intune.eas_activated","intune.enrolled","intune.entra_registered","intune.is_encrypted","intune.is_supervised","intune.jail_broken","intune.os_up_to_date","intune.require_user_enrollment_approval","iru.activation_lock_allowed_while_supervised","iru.activation_lock_bypass_code_failed","iru.activation_lock_supported","iru.agent_installed","iru.any_signed_os","iru.apple_silicon","iru.bootstrap_token_auth","iru.bootstrap_token_escrowed","iru.data_roaming","iru.device_activation_lock_enabled","iru.enrolled","iru.filevault_enabled","iru.filevault_key_escrowed","iru.filevault_regeneration_needed","iru.firewall_allow_signed_applications","iru.firewall_block_all_incoming","iru.firewall_enabled","iru.firewall_logging","iru.firewall_stealth_mode","iru.firewall_unloading","iru.gatekeeper_enabled","iru.gatekeeper_trusted_developers","iru.hotspot","iru.is_missing","iru.is_removed","iru.kext_requires_bootstrap_token","iru.mdm_enabled","iru.mdm_manages_kext","iru.os_up_to_date","iru.shared_ipad","iru.sip_enabled","iru.software_update_requires_bootstrap_token","iru.ssv_enabled","iru.user_activation_lock_enabled","iru.user_is_archived","iru.user_manages_kext","santa.enrolled","santa.os_up_to_date","sentinelone.allow_remote_shell","sentinelone.encrypted_applications","sentinelone.enrolled","sentinelone.firewall_enabled","sentinelone.has_containerized_workload","sentinelone.in_remote_shell_session","sentinelone.infected","sentinelone.is_active","sentinelone.is_ad_connector","sentinelone.is_decommissioned","sentinelone.is_hyper_automate","sentinelone.is_pending_uninstall","sentinelone.is_uninstalled","sentinelone.is_up_to_date","sentinelone.location_enabled","sentinelone.network_quarantine_enabled","sentinelone.os_up_to_date","sentinelone.proxy_console","sentinelone.proxy_deep_visibility","sentinelone.proxy_pac_file_usage","sentinelone.threat_reboot_required","sophos.cloned","sophos.enrolled","sophos.isolation_admin_isolated","sophos.isolation_self_isolated","sophos.online","sophos.os_is_server","sophos.os_up_to_date","sophos.tamper_protection_enabled","sophos.tamper_protection_supported"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"boolean no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"boolean field; see PolicyPostureNode for platform applicability","enum":["defender.enrolled","defender.entra_joined","defender.is_excluded","defender.is_potential_duplication","defender.os_up_to_date","intune.attestation_bit_locker_enabled","intune.attestation_boot_debugging","intune.attestation_code_integrity","intune.attestation_data_execution_policy_enabled","intune.attestation_early_launch_anti_malware_driver_protection","intune.attestation_operating_system_kernel_debugging","intune.attestation_safe_mode","intune.attestation_secure_boot","intune.attestation_supported","intune.attestation_test_signing","intune.attestation_virtual_secure_mode","intune.attestation_windows_pe","intune.config_manager_compliance_policy","intune.config_manager_device_configuration","intune.config_manager_inventory","intune.config_manager_modern_apps","intune.config_manager_resource_access","intune.config_manager_windows_update_for_business","intune.eas_activated","intune.enrolled","intune.entra_registered","intune.is_encrypted","intune.is_supervised","intune.jail_broken","intune.os_up_to_date","intune.require_user_enrollment_approval","iru.activation_lock_allowed_while_supervised","iru.activation_lock_bypass_code_failed","iru.activation_lock_supported","iru.agent_installed","iru.any_signed_os","iru.apple_silicon","iru.bootstrap_token_auth","iru.bootstrap_token_escrowed","iru.data_roaming","iru.device_activation_lock_enabled","iru.enrolled","iru.filevault_enabled","iru.filevault_key_escrowed","iru.filevault_regeneration_needed","iru.firewall_allow_signed_applications","iru.firewall_block_all_incoming","iru.firewall_enabled","iru.firewall_logging","iru.firewall_stealth_mode","iru.firewall_unloading","iru.gatekeeper_enabled","iru.gatekeeper_trusted_developers","iru.hotspot","iru.is_missing","iru.is_removed","iru.kext_requires_bootstrap_token","iru.mdm_enabled","iru.mdm_manages_kext","iru.os_up_to_date","iru.shared_ipad","iru.sip_enabled","iru.software_update_requires_bootstrap_token","iru.ssv_enabled","iru.user_activation_lock_enabled","iru.user_is_archived","iru.user_manages_kext","santa.enrolled","santa.os_up_to_date","sentinelone.allow_remote_shell","sentinelone.encrypted_applications","sentinelone.enrolled","sentinelone.firewall_enabled","sentinelone.has_containerized_workload","sentinelone.in_remote_shell_session","sentinelone.infected","sentinelone.is_active","sentinelone.is_ad_connector","sentinelone.is_decommissioned","sentinelone.is_hyper_automate","sentinelone.is_pending_uninstall","sentinelone.is_uninstalled","sentinelone.is_up_to_date","sentinelone.location_enabled","sentinelone.network_quarantine_enabled","sentinelone.os_up_to_date","sentinelone.proxy_console","sentinelone.proxy_deep_visibility","sentinelone.proxy_pac_file_usage","sentinelone.threat_reboot_required","sophos.cloned","sophos.enrolled","sophos.isolation_admin_isolated","sophos.isolation_self_isolated","sophos.online","sophos.os_is_server","sophos.os_up_to_date","sophos.tamper_protection_enabled","sophos.tamper_protection_supported"],"type":"string"},"op":{"enum":["is"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"boolean"}},"required":["field","op","value"],"title":"boolean scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["within_last","not_within_last"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Positive ISO 8601 duration, such as PT24H or P30D","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime duration provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"datetime no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["before","after"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"format":"date-time","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["within_last","not_within_last"],"type":"string"},"value":{"description":"Positive ISO 8601 duration, such as PT24H or P30D","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime duration device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"datetime no_value device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["before","after"],"type":"string"},"value":{"format":"date-time","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime scalar device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"enum_string list provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"enum_string no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"enum_string regex provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"enum_string scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"float field; see PolicyPostureNode for platform applicability","enum":["iru.device_capacity_gb"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"float no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"float field; see PolicyPostureNode for platform applicability","enum":["iru.device_capacity_gb"],"type":"string"},"op":{"enum":["eq","ne","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"number"}},"required":["field","op","value"],"title":"float scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"integer field; see PolicyPostureNode for platform applicability","enum":["defender.os_build","defender.rbac_group_id","intune.attestation_reset_count","intune.attestation_restart_count","intune.free_storage_space_bytes","intune.physical_memory_bytes","intune.total_storage_space_bytes","santa.sip_status","sentinelone.active_threats","sentinelone.core_count","sentinelone.cpu_count","sentinelone.protected_containers_count","sentinelone.protected_pods_count","sentinelone.protected_tasks_count","sentinelone.total_memory","sophos.os_build","sophos.os_major_version","sophos.os_minor_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"integer no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"integer field; see PolicyPostureNode for platform applicability","enum":["defender.os_build","defender.rbac_group_id","intune.attestation_reset_count","intune.attestation_restart_count","intune.free_storage_space_bytes","intune.physical_memory_bytes","intune.total_storage_space_bytes","santa.sip_status","sentinelone.active_threats","sentinelone.core_count","sentinelone.cpu_count","sentinelone.protected_containers_count","sentinelone.protected_pods_count","sentinelone.protected_tasks_count","sentinelone.total_memory","sophos.os_build","sophos.os_major_version","sophos.os_minor_version"],"type":"string"},"op":{"enum":["eq","ne","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"integer"}},"required":["field","op","value"],"title":"integer scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ip field; see PolicyPostureNode for platform applicability","enum":["defender.last_external_ip_address","defender.last_ip_address","santa.last_preflight_ip","sentinelone.external_ip","sentinelone.last_ip_to_management"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ip list provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ip field; see PolicyPostureNode for platform applicability","enum":["defender.last_external_ip_address","defender.last_ip_address","santa.last_preflight_ip","sentinelone.external_ip","sentinelone.last_ip_to_management"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ip no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ipv4 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv4"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ipv4 list device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ipv4 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv4"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ipv4 no_value device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ipv6 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv6"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ipv6 list device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"ipv6 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv6"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ipv6 no_value device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"json field; see PolicyPostureNode for platform applicability","enum":["defender.ip_addresses","sentinelone.cloud_providers","sentinelone.locations","sentinelone.network_interfaces","sentinelone.tags","sophos.assigned_products","sophos.device_software","sophos.encryption_volumes","sophos.group_hierarchy","sophos.health_service_details","sophos.packages","sophos.tags"],"type":"string"},"op":{"enum":["is_empty","is_not_empty","exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"json no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string list provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"string regex provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string list device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string no_value device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"string regex device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string scalar device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["contains_any_of","contains_all_of"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string_array list provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["is_empty","is_not_empty","exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string_array no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["contains","does_not_contain"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string_array scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["defender.agent_version","intune.attestation_boot_app_security_version","intune.attestation_boot_manager_security_version","intune.attestation_boot_manager_version","intune.attestation_code_integrity_check_version","intune.attestation_content_version","intune.attestation_tpm_version","intune.os_version","iru.agent_version","iru.display_os_version","iru.firewall_version","iru.gatekeeper_opaque_version","iru.gatekeeper_version","iru.malware_removal_tool_version","iru.os_version","iru.supplemental_os_version_extra","iru.xprotect_version","santa.os_version","santa.santa_version","santa.santanetd_version","sentinelone.agent_version","sentinelone.os_revision","sentinelone.ranger_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"version no_value provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["defender.agent_version","intune.attestation_boot_app_security_version","intune.attestation_boot_manager_security_version","intune.attestation_boot_manager_version","intune.attestation_code_integrity_check_version","intune.attestation_content_version","intune.attestation_tpm_version","intune.os_version","iru.agent_version","iru.display_os_version","iru.firewall_version","iru.gatekeeper_opaque_version","iru.gatekeeper_version","iru.malware_removal_tool_version","iru.os_version","iru.supplemental_os_version_extra","iru.xprotect_version","santa.os_version","santa.santa_version","santa.santanetd_version","sentinelone.agent_version","sentinelone.os_revision","sentinelone.ranger_version"],"type":"string"},"op":{"enum":["is","is_not","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Segment-wise version, or @latest for firezone.last_seen_version only","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"version scalar provider comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["firezone.last_seen_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"version no_value device comparison","type":"object"},{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["firezone.last_seen_version"],"type":"string"},"op":{"enum":["is","is_not","gt","gte","lt","lte"],"type":"string"},"value":{"description":"Segment-wise version, or @latest for firezone.last_seen_version only","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"version scalar device comparison","type":"object"}],"title":"PolicyPostureLeaf","type":"object"},"ExternalIdentity":{"description":"External Identity","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"actor_id":{"description":"Actor ID","example":"cdfa97e6-cca1-41db-8fc7-864daedb46df","format":"uuid","type":"string"},"directory_id":{"description":"Directory UUID reference","example":"9f8e7d6c-5b4a-3c2b-1a0e-9f8e7d6c5b4a","format":"uuid","nullable":true,"type":"string"},"email":{"description":"Email address, falling back to the IdP identifier when unset","example":"john.doe@example.com","type":"string"},"family_name":{"description":"Family name","example":"Doe","nullable":true,"type":"string"},"firezone_avatar_url":{"description":"Firezone-hosted avatar URL","example":"https://avatars.firezone.dev/u/2551705710219359.png","nullable":true,"type":"string"},"given_name":{"description":"Given name","example":"John","nullable":true,"type":"string"},"id":{"description":"External Identity ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"idp_id":{"description":"IDP-specific identifier for this identity","example":"2551705710219359","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"issuer":{"description":"Identity issuer URL (e.g., 'https://accounts.google.com', 'https://company.okta.com')","example":"https://accounts.google.com","type":"string"},"middle_name":{"description":"Middle name","nullable":true,"type":"string"},"name":{"description":"Full name","example":"John Doe","nullable":true,"type":"string"},"nickname":{"description":"Nickname","nullable":true,"type":"string"},"picture":{"description":"Profile picture URL","example":"https://example.com/avatar.jpg","nullable":true,"type":"string"},"preferred_username":{"description":"Preferred username","example":"jdoe","nullable":true,"type":"string"},"profile":{"description":"Profile URL","nullable":true,"type":"string"},"synced_at":{"description":"Last sync timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"}},"required":["account_id","actor_id","directory_id","email","family_name","firezone_avatar_url","given_name","id","idp_id","inserted_at","issuer","middle_name","name","nickname","picture","preferred_username","profile","synced_at"],"title":"ExternalIdentity","type":"object"},"IruDevice":{"description":"Device synced from Iru (formerly Kandji)","properties":{"host_name":{"nullable":true,"type":"string"},"gatekeeper_trusted_developers":{"nullable":true,"type":"boolean"},"secure_boot_level":{"nullable":true,"type":"string"},"os_name":{"nullable":true,"type":"string"},"filevault_key_rotation_scheduled_at":{"format":"date-time","nullable":true,"type":"string"},"firewall_enabled":{"nullable":true,"type":"boolean"},"model_name":{"nullable":true,"type":"string"},"firewall_logging_option":{"nullable":true,"type":"string"},"shared_ipad":{"nullable":true,"type":"boolean"},"local_hostname":{"nullable":true,"type":"string"},"activation_lock_allowed_while_supervised":{"nullable":true,"type":"boolean"},"updated_at":{"format":"date-time","nullable":true,"type":"string"},"device_activation_lock_enabled":{"nullable":true,"type":"boolean"},"gatekeeper_version":{"nullable":true,"type":"string"},"bootstrap_token_escrowed":{"nullable":true,"type":"boolean"},"iru_id":{"nullable":false,"type":"string"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"asset_tag":{"nullable":true,"type":"string"},"blueprint_name":{"nullable":true,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"data_roaming":{"nullable":true,"type":"boolean"},"is_removed":{"nullable":true,"type":"boolean"},"ssv_enabled":{"nullable":true,"type":"boolean"},"filevault_key_type":{"nullable":true,"type":"string"},"device_capacity_gb":{"format":"float","nullable":true,"type":"number"},"tags":{"items":{"type":"string"},"nullable":true,"type":"array"},"filevault_key_escrowed":{"nullable":true,"type":"boolean"},"apple_silicon":{"nullable":true,"type":"boolean"},"serial_number":{"nullable":true,"type":"string"},"cellular_technology":{"nullable":true,"type":"string"},"blueprint_id":{"nullable":true,"type":"string"},"user_manages_kext":{"nullable":true,"type":"boolean"},"hotspot":{"nullable":true,"type":"boolean"},"account_id":{"format":"uuid","nullable":false,"type":"string"},"mdm_enabled":{"nullable":true,"type":"boolean"},"user_email":{"nullable":true,"type":"string"},"gatekeeper_opaque_version":{"nullable":true,"type":"string"},"external_boot_level":{"nullable":true,"type":"string"},"firewall_collected_at":{"format":"date-time","nullable":true,"type":"string"},"software_update_requires_bootstrap_token":{"nullable":true,"type":"boolean"},"xprotect_version":{"nullable":true,"type":"string"},"agent_installed":{"nullable":true,"type":"boolean"},"mdm_manages_kext":{"nullable":true,"type":"boolean"},"display_os_version":{"nullable":true,"type":"string"},"filevault_regeneration_needed":{"nullable":true,"type":"boolean"},"is_missing":{"nullable":true,"type":"boolean"},"last_enrolled_at":{"format":"date-time","nullable":true,"type":"string"},"gatekeeper_enabled":{"nullable":true,"type":"boolean"},"firewall_version":{"nullable":true,"type":"string"},"first_enrolled_at":{"format":"date-time","nullable":true,"type":"string"},"firewall_logging":{"nullable":true,"type":"boolean"},"model_identifier":{"nullable":true,"type":"string"},"os_build":{"nullable":true,"type":"string"},"user_activation_lock_enabled":{"nullable":true,"type":"boolean"},"activation_lock_collected_at":{"format":"date-time","nullable":true,"type":"string"},"lost_mode_status":{"nullable":true,"type":"string"},"startup_settings_collected_at":{"format":"date-time","nullable":true,"type":"string"},"platform":{"nullable":true,"type":"string"},"filevault_enabled":{"nullable":true,"type":"boolean"},"user_is_archived":{"nullable":true,"type":"boolean"},"activation_lock_supported":{"nullable":true,"type":"boolean"},"supplemental_build_version":{"nullable":true,"type":"string"},"sip_enabled":{"nullable":true,"type":"boolean"},"firewall_allow_signed_applications":{"nullable":true,"type":"boolean"},"model":{"nullable":true,"type":"string"},"supplemental_os_version_extra":{"nullable":true,"type":"string"},"user_id":{"nullable":true,"type":"string"},"bootstrap_token_auth":{"nullable":true,"type":"boolean"},"firewall_block_all_incoming":{"nullable":true,"type":"boolean"},"last_check_in_at":{"format":"date-time","nullable":true,"type":"string"},"firewall_stealth_mode":{"nullable":true,"type":"boolean"},"kext_requires_bootstrap_token":{"nullable":true,"type":"boolean"},"agent_version":{"nullable":true,"type":"string"},"activation_lock_bypass_code_failed":{"nullable":true,"type":"boolean"},"inventory_collected_at":{"format":"date-time","nullable":true,"type":"string"},"any_signed_os":{"nullable":true,"type":"boolean"},"filevault_collected_at":{"format":"date-time","nullable":true,"type":"string"},"gatekeeper_collected_at":{"format":"date-time","nullable":true,"type":"string"},"firewall_unloading":{"nullable":true,"type":"boolean"},"os_version":{"nullable":true,"type":"string"},"malware_removal_tool_version":{"nullable":true,"type":"string"},"device_family":{"nullable":true,"type":"string"},"user_name":{"nullable":true,"type":"string"},"device_name":{"nullable":true,"type":"string"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"}},"required":["account_id","iru_id","posture_provider_id","device_name","model","serial_number","platform","os_version","supplemental_build_version","supplemental_os_version_extra","last_check_in_at","user_id","user_name","user_email","user_is_archived","asset_tag","blueprint_id","blueprint_name","mdm_enabled","agent_installed","agent_version","is_missing","is_removed","first_enrolled_at","last_enrolled_at","lost_mode_status","tags","device_family","device_capacity_gb","host_name","local_hostname","apple_silicon","model_name","model_identifier","shared_ipad","cellular_technology","data_roaming","hotspot","os_build","os_name","display_os_version","inventory_collected_at","filevault_enabled","filevault_key_type","filevault_key_escrowed","filevault_regeneration_needed","filevault_key_rotation_scheduled_at","filevault_collected_at","firewall_enabled","firewall_block_all_incoming","firewall_logging","firewall_logging_option","firewall_stealth_mode","firewall_version","firewall_allow_signed_applications","firewall_unloading","firewall_collected_at","gatekeeper_enabled","gatekeeper_trusted_developers","gatekeeper_version","gatekeeper_opaque_version","xprotect_version","malware_removal_tool_version","gatekeeper_collected_at","sip_enabled","ssv_enabled","bootstrap_token_auth","bootstrap_token_escrowed","kext_requires_bootstrap_token","software_update_requires_bootstrap_token","external_boot_level","secure_boot_level","any_signed_os","mdm_manages_kext","user_manages_kext","startup_settings_collected_at","activation_lock_supported","activation_lock_allowed_while_supervised","device_activation_lock_enabled","user_activation_lock_enabled","activation_lock_bypass_code_failed","activation_lock_collected_at","synced_at","inserted_at","updated_at"],"title":"IruDevice","type":"object"},"IntuneDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/IntuneDevice"}},"title":"IntuneDeviceResponse","type":"object"},"ClientPutRequest":{"description":"PUT body for updating a Client","properties":{"client":{"$ref":"#/components/schemas/ClientPut"}},"required":["client"],"title":"ClientPutRequest","type":"object"},"OktaDirectoryResponse":{"description":"Response schema for single Okta Directory","properties":{"data":{"$ref":"#/components/schemas/OktaDirectory"}},"title":"OktaDirectoryResponse","type":"object"},"GatewaySessionSubject":{"description":"Subject of a session created by a Gateway (`context: \"gateway\"`).\n\nA Gateway authenticates with a token rather than as an actor, so no actor\nfields are recorded.\n","properties":{"gateway_id":{"description":"Identifier of the Gateway the session was established from.","format":"uuid","nullable":true,"type":"string"},"ip":{"description":"IP address the session came from.","nullable":true,"type":"string"},"ip_city":{"description":"Geo-located city for `ip`, if known.","nullable":true,"type":"string"},"ip_lat":{"description":"Geo-located latitude for `ip`, if known.","nullable":true,"type":"number"},"ip_lon":{"description":"Geo-located longitude for `ip`, if known.","nullable":true,"type":"number"},"ip_region":{"description":"Geo-located region for `ip`, if known.","nullable":true,"type":"string"},"token_id":{"description":"Identifier of the Gateway token the session was established with.","format":"uuid","nullable":true,"type":"string"},"user_agent":{"description":"User agent reported by the Gateway.","nullable":true,"type":"string"}},"required":["gateway_id","token_id","ip","ip_region","ip_city","ip_lat","ip_lon","user_agent"],"title":"GatewaySessionSubject","type":"object"},"GatewayTokenResponse":{"description":"Response schema for a new Gateway Token","properties":{"data":{"$ref":"#/components/schemas/GatewayToken"}},"title":"GatewayTokenResponse","type":"object"},"GatewayUpdateRequest":{"description":"Request body for updating a Gateway","properties":{"gateway":{"$ref":"#/components/schemas/GatewayUpdate"}},"required":["gateway"],"title":"GatewayUpdateRequest","type":"object"},"SophosPostureProvider":{"description":"Sophos XDR posture provider","properties":{"account_id":{"format":"uuid","type":"string"},"client_id":{"type":"string"},"data_region_url":{"format":"uri","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"name":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"type":"string"},"type":{"enum":["sophos"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","client_id","data_region_url","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","name","synced_at","tenant_id","type","updated_at"],"title":"SophosPostureProvider","type":"object"},"GroupCreateRequest":{"description":"POST body for creating a Group","properties":{"group":{"properties":{"name":{"description":"Group Name","example":"Engineering","type":"string"}},"required":["name"],"type":"object"}},"required":["group"],"title":"GroupCreateRequest","type":"object"},"Log":{"description":"A single Log entry. The `type` field identifies the log stream the\nentry belongs to, which is also encoded in the first character of its\n`log_id` (`c` change, `5` session, `f` flow, `a` api_request).\n","oneOf":[{"$ref":"#/components/schemas/ChangeLog"},{"$ref":"#/components/schemas/SessionLog"},{"$ref":"#/components/schemas/FlowLog"},{"$ref":"#/components/schemas/APIRequestLog"}],"title":"Log"},"DeletedClientTokenResponse":{"description":"Response schema for a deleted Client Token","properties":{"data":{"properties":{"id":{"description":"Client Token ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"}},"required":["id"],"type":"object"}},"title":"DeletedClientTokenResponse","type":"object"},"ClientSessionSubject":{"description":"Subject of a session created by a Client (`context: \"client\"`).\n\nA `Subject` plus the Client and token the session was established with.\n","properties":{"actor_email":{"description":"Email address of the actor, if any.","example":"admin@example.com","nullable":true,"type":"string"},"actor_id":{"description":"Identifier of the actor that initiated the action.","example":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"actor_name":{"description":"Display name of the actor.","example":"Admin User","type":"string"},"actor_type":{"description":"Type of the actor.","enum":["account_user","account_admin_user","service_account","api_client"],"example":"account_admin_user","type":"string"},"attested_at":{"description":"When the device last attested, snapshotted for this subject. Does not imply the current connection attested. Omitted when absent.","format":"date-time","type":"string"},"attested_cert_fingerprint":{"description":"Certificate fingerprint from the device's last attestation. Omitted when absent.","type":"string"},"attested_cert_issuer":{"description":"Base64-encoded DER X.509 issuer Name from the device's last attestation. Omitted when absent.","format":"byte","type":"string"},"attested_cert_serial":{"description":"Certificate serial from the device's last attestation. Omitted when absent.","type":"string"},"attested_device_serial":{"description":"Device serial from the device's last attestation. Omitted when absent.","type":"string"},"attested_device_uuid":{"description":"Device UUID from the device's last attestation. Omitted when absent.","type":"string"},"attested_mdm_device_id":{"description":"MDM device ID from the device's last attestation. Omitted when absent.","type":"string"},"auth_provider_id":{"description":"Identifier of the authentication provider that authenticated the actor.","example":"98776234-1234-5678-9012-345678901234","format":"uuid","nullable":true,"type":"string"},"device_id":{"description":"Identifier of the Client the session was established from.","format":"uuid","nullable":true,"type":"string"},"ip":{"description":"IP address the action originated from.","example":"1.2.3.4","nullable":true,"type":"string"},"ip_city":{"description":"Geo-located city for `ip`, if known.","example":"San Francisco","nullable":true,"type":"string"},"ip_lat":{"description":"Geo-located latitude for `ip`, if known.","example":37.7749,"nullable":true,"type":"number"},"ip_lon":{"description":"Geo-located longitude for `ip`, if known.","example":-122.4194,"nullable":true,"type":"number"},"ip_region":{"description":"Geo-located region for `ip`, if known.","example":"California","nullable":true,"type":"string"},"token_id":{"description":"Identifier of the Client token the session was established with.","format":"uuid","nullable":true,"type":"string"},"user_agent":{"description":"User agent of the client that initiated the action.","example":"Mozilla/5.0","nullable":true,"type":"string"}},"required":["actor_id","actor_name","actor_email","actor_type","auth_provider_id","device_id","token_id","ip","ip_region","ip_city","ip_lat","ip_lon","user_agent"],"title":"ClientSessionSubject","type":"object"},"SessionLog":{"description":"A single Session Log entry, recording one Client, Gateway, or Portal\nsession that was created, along with the auth context it was created\nwith.\n","properties":{"context":{"description":"The kind of session that was created.","enum":["client","gateway","portal"],"example":"client","type":"string"},"log_id":{"description":"Opaque identifier for the Session Log entry. A 24-character\nlowercase hexadecimal string starting with `5`.\n","example":"500060db0c2c8eb400000000","type":"string"},"subject":{"description":"Who established the session and from where. The shape depends on\n`context`:\n\n- `client`: a `ClientSessionSubject`, the actor plus the Client and\n  token the session was established with.\n- `gateway`: a `GatewaySessionSubject`, the Gateway and its token. A\n  Gateway authenticates as itself, so no actor fields are recorded.\n- `portal`: a plain `Subject`.\n","example":{"actor_email":"admin@example.com","actor_id":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","actor_name":"Admin User","actor_type":"account_admin_user","auth_provider_id":"98776234-1234-5678-9012-345678901234","device_id":"11e7f82f-831a-4a9d-8f17-c66c2bb6e205","ip":"189.172.73.1","ip_city":"Mexico City","ip_lat":19.4326,"ip_lon":-99.1332,"ip_region":"MX","token_id":"22e7f82f-831a-4a9d-8f17-c66c2bb6e205","user_agent":"Linux/6.5.0 connlib/1.5.1"},"oneOf":[{"$ref":"#/components/schemas/ClientSessionSubject"},{"$ref":"#/components/schemas/GatewaySessionSubject"},{"$ref":"#/components/schemas/Subject"}]},"timestamp":{"description":"RFC 3339 timestamp identifying when the session was created.","example":"2026-05-26T12:34:56.789Z","format":"date-time","type":"string"},"type":{"enum":["session"],"example":"session","type":"string"}},"required":["context","log_id","subject","timestamp","type"],"title":"SessionLog","type":"object"},"enum_string scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"enum_string scalar provider comparison","type":"object"},"ChangeLog":{"description":"A single entry from the account audit log.\n\nEach entry records one create, update, or delete event against an\naccount-scoped object.\n","properties":{"after":{"additionalProperties":true,"description":"The state of the object after the change. `null` for `delete`\nevents. Sensitive fields such as tokens, secrets, and password\nhashes are replaced with the literal string `\"[redacted]\"`.\n","example":{"name":"Jane Smith"},"nullable":true,"type":"object"},"before":{"additionalProperties":true,"description":"The state of the object before the change. `null` for `insert`\nevents. Sensitive fields such as tokens, secrets, and password\nhashes are replaced with the literal string `\"[redacted]\"`.\n","example":{"name":"Jane Doe"},"nullable":true,"type":"object"},"log_id":{"description":"Opaque identifier for the audit log entry. A 24-character lowercase\nhexadecimal string starting with `c`, lexicographically sortable\nwithin an account and aligned with the order changes were committed.\n","example":"c00060db0c2c8eb400000000","type":"string"},"object":{"description":"The kind of object that was changed.","example":"actors","type":"string"},"operation":{"description":"The kind of change that was applied.","enum":["insert","update","delete"],"example":"update","type":"string"},"subject":{"$ref":"#/components/schemas/Subject"},"timestamp":{"description":"RFC 3339 timestamp identifying when the change was committed.","example":"2026-05-26T12:34:56.789Z","format":"date-time","type":"string"},"type":{"enum":["change"],"example":"change","type":"string"}},"required":["after","before","log_id","object","operation","subject","timestamp","type"],"title":"ChangeLog","type":"object"},"FlowLogIngestRecord":{"additionalProperties":false,"description":"One flow-log record reported by connlib. Attribution is supplied by the\nrequest's ingest token rather than by each record.\n","oneOf":[{"description":"An open report may include paths known so far, but omits its end time and counters.","not":{"anyOf":[{"required":["flow_end"]},{"required":["last_packet"]},{"required":["rx_packets"]},{"required":["tx_packets"]},{"required":["rx_bytes"]},{"required":["tx_bytes"]}]}},{"description":"A close report includes outer paths, its end time, and all counters.","required":["outers","flow_end","last_packet","rx_packets","tx_packets","rx_bytes","tx_bytes"]}],"properties":{"domain":{"description":"Domain name for flows to DNS Resources; absent otherwise.","type":"string"},"flow_end":{"description":"Absent on the open report.","format":"date-time","type":"string"},"flow_start":{"format":"date-time","type":"string"},"inner_dst_ip":{"description":"Tunnel IP of the responder, on both sides' reports.","type":"string"},"inner_dst_port":{"maximum":65535,"minimum":0,"type":"integer"},"inner_src_ip":{"description":"Tunnel IP of the initiator, on both sides' reports.","type":"string"},"inner_src_port":{"maximum":65535,"minimum":0,"type":"integer"},"last_packet":{"format":"date-time","type":"string"},"outers":{"description":"Ordered outer transport paths accumulated over the flow's lifetime.","items":{"additionalProperties":false,"oneOf":[{"required":["src_ip","src_port"]},{"not":{"anyOf":[{"required":["src_ip"]},{"required":["src_port"]}]}}],"properties":{"dst_ip":{"type":"string"},"dst_port":{"maximum":65535,"minimum":0,"type":"integer"},"path_activated_at":{"description":"Time of the packet that revealed the path.","format":"date-time","type":"string"},"src_ip":{"description":"Absent together with src_port when the source is unknown.","type":"string"},"src_port":{"maximum":65535,"minimum":0,"type":"integer"}},"required":["dst_ip","dst_port","path_activated_at"],"type":"object"},"minItems":1,"type":"array"},"protocol":{"enum":["tcp","udp"],"type":"string"},"rx_bytes":{"maximum":9223372036854775807,"minimum":0,"type":"integer"},"rx_packets":{"maximum":9223372036854775807,"minimum":0,"type":"integer"},"tx_bytes":{"maximum":9223372036854775807,"minimum":0,"type":"integer"},"tx_packets":{"maximum":9223372036854775807,"minimum":0,"type":"integer"}},"required":["protocol","inner_src_ip","inner_src_port","inner_dst_ip","inner_dst_port","flow_start"],"title":"FlowLogIngestRecord","type":"object"},"Site":{"description":"Site","properties":{"id":{"description":"Site ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"name":{"description":"Site Name","example":"vpc-us-east","type":"string"}},"required":["id","name"],"title":"Site","type":"object"},"SiteResponse":{"description":"Response schema for single Site","properties":{"data":{"$ref":"#/components/schemas/Site"}},"title":"SiteResponse","type":"object"},"ClientTokenListResponse":{"description":"Response schema for multiple Client Tokens","properties":{"data":{"description":"Client Token metadata","example":[{"actor_id":"43a7f82f-831a-4a9d-8f17-c66c2bb6e205","expires_at":"2025-01-15T12:34:56.789Z","id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","inserted_at":"2025-01-15T12:34:56.789Z","updated_at":"2025-01-15T12:34:56.789Z"}],"items":{"$ref":"#/components/schemas/ClientToken"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"ClientTokenListResponse","type":"object"},"IntunePostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating an Intune posture provider. All fields are optional; omitted fields keep their current value.","properties":{"intune_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"Microsoft Intune","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["intune_posture_provider"],"title":"IntunePostureProviderUpdateRequest","type":"object"},"IruPostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/IruPostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"IruPostureProviderListResponse","type":"object"},"enum_string list provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"enum_string list provider comparison","type":"object"},"GoogleDirectory":{"description":"Google Directory","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"disabled_reason":{"description":"Reason for disabling","nullable":true,"type":"string"},"domain":{"description":"Google Workspace domain","example":"example.com","type":"string"},"error_message":{"description":"Last error message","nullable":true,"type":"string"},"errored_at":{"description":"Last error timestamp","format":"date-time","nullable":true,"type":"string"},"group_sync_mode":{"description":"Group sync mode","enum":["all","filtered","disabled"],"example":"all","type":"string"},"id":{"description":"Directory ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"impersonation_email":{"description":"Impersonation email","example":"admin@example.com","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"description":"Whether directory is disabled","example":false,"type":"boolean"},"name":{"description":"Directory name","example":"Google","type":"string"},"orgunit_sync_enabled":{"description":"Whether org unit sync is enabled","example":true,"type":"boolean"},"synced_at":{"description":"Last sync timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","disabled_reason","domain","error_message","errored_at","group_sync_mode","id","impersonation_email","inserted_at","is_disabled","name","orgunit_sync_enabled","synced_at","updated_at"],"title":"GoogleDirectory","type":"object"},"IruPostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating an Iru posture provider. All fields are optional; omitted fields keep their current value.","properties":{"iru_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"Iru","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["iru_posture_provider"],"title":"IruPostureProviderUpdateRequest","type":"object"},"PolicyResponse":{"description":"Response schema for single Policy","properties":{"data":{"$ref":"#/components/schemas/Policy"}},"title":"PolicyResponse","type":"object"},"DeletedClientTokensResponse":{"description":"Response schema for deleted Client Tokens","properties":{"data":{"properties":{"deleted_count":{"description":"Number of tokens that were deleted","example":3,"type":"integer"}},"required":["deleted_count"],"type":"object"}},"title":"DeletedClientTokensResponse","type":"object"},"GroupListResponse":{"description":"Response schema for multiple Groups","properties":{"data":{"description":"Group details","items":{"$ref":"#/components/schemas/Group"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"GroupListResponse","type":"object"},"IntunePostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/IntunePostureProvider"}},"title":"IntunePostureProviderResponse","type":"object"},"OktaAuthProviderListResponse":{"description":"Response schema for multiple Okta Auth Providers","properties":{"data":{"description":"Okta Auth Provider details","items":{"$ref":"#/components/schemas/OktaAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"OktaAuthProviderListResponse","type":"object"},"DeletedGatewayTokenResponse":{"description":"Response schema for a deleted Gateway Token","properties":{"data":{"properties":{"id":{"description":"Gateway Token ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"}},"required":["id"],"type":"object"}},"title":"DeletedGatewayTokenResponse","type":"object"},"version no_value device comparison":{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["firezone.last_seen_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"version no_value device comparison","type":"object"},"EntraAuthProviderListResponse":{"description":"Response schema for multiple Entra Auth Providers","properties":{"data":{"description":"Entra Auth Provider details","items":{"$ref":"#/components/schemas/EntraAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"EntraAuthProviderListResponse","type":"object"},"Membership":{"description":"Membership","properties":{"email":{"description":"Actor Email","example":"john.doe@example.com","nullable":true,"type":"string"},"id":{"description":"Actor ID","example":"7cb89288-1fb3-433e-a522-2d087e45988d","format":"uuid","type":"string"},"name":{"description":"Actor Name","example":"John Doe","type":"string"},"type":{"description":"Actor Type","enum":["account_admin_user","account_user","api_client","service_account"],"example":"account_user","type":"string"}},"required":["email","id","name","type"],"title":"Membership","type":"object"},"PolicyPostureNode":{"description":"One node of a Policy's device posture expression. A node has exactly one\nof these shapes:\n\n* `and`: a non-empty list of nodes that must all hold.\n* `or`: a non-empty list of nodes of which at least one must hold.\n* `not`: a node that must not hold.\n* a leaf: a `field`, an `op`, and for most operators a `value`.\n\nA leaf's `field` is `<provider>.<attribute>`, such as\n`intune.compliance_state` or `firezone.last_seen_version`. The provider\nis one of `firezone` (the connecting device's own record), `intune`,\n`iru`, `defender`, `santa`, `sentinelone` or `sophos`. The attribute is\none of that provider's synced device attributes. Every synced provider also has a\nboolean `enrolled` that is true when the provider knows the device.\n\nThe attribute's type decides which operators apply and what `value`\nmust be:\n\n* strings: `is`, `is_not`, `is_in`, `is_not_in`, `contains`,\n  `does_not_contain`, `starts_with`, `ends_with`, `matches`,\n  `does_not_match`. Comparisons ignore case. `is_in` and `is_not_in`\n  take a list of strings. `matches` and `does_not_match` take a regular\n  expression.\n* booleans: `is` with `true` or `false`.\n* numbers: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`.\n* versions: `is`, `is_not`, `gt`, `gte`, `lt`, `lte`, compared segment\n  by segment, so `14.4` equals `14.4.0`.\n* timestamps: `before` and `after` with an ISO 8601 datetime such as\n  `2026-01-01T00:00:00Z`; `within_last` and `not_within_last` with an\n  ISO 8601 duration such as `PT24H` or `P30D`. A date-only attribute\n  counts as the start of that day in UTC.\n* IP addresses: `is_in_cidr` and `is_not_in_cidr` with a list of CIDRs.\n  `firezone.ipv4` takes IPv4 CIDRs only and `firezone.ipv6` IPv6 only.\n* lists of strings: `contains`, `does_not_contain`, `contains_any_of`,\n  `contains_all_of`, `is_empty`, `is_not_empty`.\n* JSON attributes: `is_empty`, `is_not_empty`.\n\nThe value `@latest` on `firezone.last_seen_version` stands for the newest\nClient release for the device's platform.\n\n`enum_string` uses the string operators; `integer` and `float` use the\nnumeric operators. `string_array` values use a single string for `contains`\nand `does_not_contain`, or a non-empty string list for `contains_any_of`\nand `contains_all_of`.\n\nEvery attribute also accepts `exists` and `does_not_exist`. These and\n`is_empty` / `is_not_empty` take no value: omit `value` or set it to null.\nMissing attributes fail every operator except `does_not_exist`, including\nnegative operators such as `is_not`. A missing provider is evaluated as\none empty row. Its synthetic `enrolled` field is false, so `enrolled is\nfalse` can explicitly match an unenrolled device. `not` negates the\nresult and can also match missing data; use a positive `enrolled is true`\ncheck when enrollment is required.\n\nLeaves that do not apply to the device's platform are removed before\nevaluation, including inside `or` and `not`. An expression with no\napplicable leaves passes. If the platform is unknown, no leaves are\nremoved. Each field lists the platforms it applies to.\nProvider `os_up_to_date` fields are computed from known OS releases;\nthey are not raw provider attributes.\n\nWhen a device matches more than one record of a provider, a leaf holds\nwhen any record satisfies it. Set `rows` to `all` to require every\nrecord. Different leaves may match different provider rows; `and` does\nnot require one row to satisfy all leaves. `rows` is not allowed for\n`firezone`, which always describes exactly one connecting device.\n\nExpressions allow at most 10 nested boolean levels and 100 leaves.\nList values contain 1–100 items; strings are at most 1024 bytes and\nregular expressions at most 256 bytes. Unknown fields, incompatible\noperators, invalid values, and exceeded limits return HTTP 422 with\na path in `validation_errors.postures`.\n\n`GET /posture_fields` lists the same fields as structured data.\n\nSupported fields (generated from the same registry used for validation):\n\n### defender fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `defender.agent_version` | version | windows, macos, linux |\n| `defender.computer_dns_name` | string | windows, macos, linux |\n| `defender.defender_id` | string | windows, macos, linux |\n| `defender.device_value` | enum_string | windows, macos, linux |\n| `defender.enrolled` | boolean | windows, macos, linux |\n| `defender.entra_device_id` | string | windows, macos, linux |\n| `defender.entra_joined` | boolean | windows, macos, linux |\n| `defender.exclusion_reason` | enum_string | windows, macos, linux |\n| `defender.exposure_level` | enum_string | windows, macos, linux |\n| `defender.first_seen_at` | datetime | windows, macos, linux |\n| `defender.health_status` | enum_string | windows, macos, linux |\n| `defender.ip_addresses` | json | windows, macos, linux |\n| `defender.is_excluded` | boolean | windows, macos, linux |\n| `defender.is_potential_duplication` | boolean | windows, macos, linux |\n| `defender.last_external_ip_address` | ip | windows, macos, linux |\n| `defender.last_ip_address` | ip | windows, macos, linux |\n| `defender.last_seen_at` | datetime | windows, macos, linux |\n| `defender.machine_tags` | string_array | windows, macos, linux |\n| `defender.managed_by` | enum_string | windows, macos, linux |\n| `defender.managed_by_status` | enum_string | windows, macos, linux |\n| `defender.onboarding_status` | enum_string | windows, macos, linux |\n| `defender.os_architecture` | enum_string | windows, macos, linux |\n| `defender.os_build` | integer | windows, macos, linux |\n| `defender.os_platform` | enum_string | windows, macos, linux |\n| `defender.os_processor` | string | windows, macos, linux |\n| `defender.os_up_to_date` | boolean | macos |\n| `defender.rbac_group_id` | integer | windows, macos, linux |\n| `defender.rbac_group_name` | string | windows, macos, linux |\n| `defender.risk_score` | enum_string | windows, macos, linux |\n| `defender.version` | string | windows, macos, linux |\n| `defender.vm_cloud_provider` | string | windows, macos, linux |\n| `defender.vm_id` | string | windows, macos, linux |\n| `defender.vm_resource_id` | string | windows, macos, linux |\n| `defender.vm_subscription_id` | string | windows, macos, linux |\n\n### firezone fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `firezone.device_serial` | string | windows, macos, linux, ios, android |\n| `firezone.device_uuid` | string | windows, macos, linux, ios, android |\n| `firezone.hostname` | string | windows, macos, linux, ios, android |\n| `firezone.identifier_for_vendor` | string | windows, macos, linux, ios, android |\n| `firezone.ipv4` | ipv4 | windows, macos, linux, ios, android |\n| `firezone.ipv6` | ipv6 | windows, macos, linux, ios, android |\n| `firezone.last_attested_at` | datetime | windows, macos, linux, ios, android |\n| `firezone.last_attested_cert_fingerprint` | string | windows, macos, linux, ios, android |\n| `firezone.last_attested_cert_serial` | string | windows, macos, linux, ios, android |\n| `firezone.last_attested_device_serial` | string | windows, macos, linux, ios, android |\n| `firezone.last_attested_device_uuid` | string | windows, macos, linux, ios, android |\n| `firezone.last_attested_mdm_device_id` | string | windows, macos, linux, ios, android |\n| `firezone.last_seen_remote_ip_location_city` | string | windows, macos, linux, ios, android |\n| `firezone.last_seen_user_agent` | string | windows, macos, linux, ios, android |\n| `firezone.last_seen_version` | version | windows, macos, linux, ios, android |\n| `firezone.name` | string | windows, macos, linux, ios, android |\n\n### intune fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `intune.android_security_patch_level` | datetime | windows, macos, ios, android |\n| `intune.attestation_bit_locker_enabled` | boolean | windows |\n| `intune.attestation_boot_app_security_version` | version | windows |\n| `intune.attestation_boot_debugging` | boolean | windows |\n| `intune.attestation_boot_manager_security_version` | version | windows |\n| `intune.attestation_boot_manager_version` | version | windows |\n| `intune.attestation_boot_revision_list_info` | string | windows |\n| `intune.attestation_code_integrity` | boolean | windows |\n| `intune.attestation_code_integrity_check_version` | version | windows |\n| `intune.attestation_code_integrity_policy` | string | windows |\n| `intune.attestation_content_version` | version | windows |\n| `intune.attestation_data_execution_policy_enabled` | boolean | windows |\n| `intune.attestation_early_launch_anti_malware_driver_protection` | boolean | windows |\n| `intune.attestation_health_status_mismatch_info` | string | windows |\n| `intune.attestation_identity_key` | string | windows |\n| `intune.attestation_issued_at` | datetime | windows |\n| `intune.attestation_operating_system_kernel_debugging` | boolean | windows |\n| `intune.attestation_operating_system_rev_list_info` | string | windows |\n| `intune.attestation_pcr0` | string | windows |\n| `intune.attestation_pcr_hash_algorithm` | string | windows |\n| `intune.attestation_reset_count` | integer | windows |\n| `intune.attestation_restart_count` | integer | windows |\n| `intune.attestation_safe_mode` | boolean | windows |\n| `intune.attestation_secure_boot` | boolean | windows |\n| `intune.attestation_secure_boot_config_policy_fingerprint` | string | windows |\n| `intune.attestation_status` | enum_string | windows |\n| `intune.attestation_supported` | boolean | windows |\n| `intune.attestation_test_signing` | boolean | windows |\n| `intune.attestation_tpm_version` | version | windows |\n| `intune.attestation_virtual_secure_mode` | boolean | windows |\n| `intune.attestation_windows_pe` | boolean | windows |\n| `intune.compliance_grace_period_expiration_at` | datetime | windows, macos, ios, android |\n| `intune.compliance_state` | enum_string | windows, macos, ios, android |\n| `intune.config_manager_compliance_policy` | boolean | windows, macos, ios, android |\n| `intune.config_manager_device_configuration` | boolean | windows, macos, ios, android |\n| `intune.config_manager_inventory` | boolean | windows, macos, ios, android |\n| `intune.config_manager_modern_apps` | boolean | windows, macos, ios, android |\n| `intune.config_manager_resource_access` | boolean | windows, macos, ios, android |\n| `intune.config_manager_windows_update_for_business` | boolean | windows, macos, ios, android |\n| `intune.device_category_display_name` | string | windows, macos, ios, android |\n| `intune.device_enrollment_type` | enum_string | windows, macos, ios, android |\n| `intune.device_name` | string | windows, macos, ios, android |\n| `intune.device_registration_state` | enum_string | windows, macos, ios, android |\n| `intune.eas_activated` | boolean | windows, macos, ios, android |\n| `intune.eas_activated_at` | datetime | windows, macos, ios, android |\n| `intune.eas_device_id` | string | windows, macos, ios, android |\n| `intune.email_address` | string | windows, macos, ios, android |\n| `intune.enrolled` | boolean | windows, macos, ios, android |\n| `intune.enrolled_at` | datetime | windows, macos, ios, android |\n| `intune.enrollment_profile_name` | string | windows, macos, ios, android |\n| `intune.entra_device_id` | string | windows, macos, ios, android |\n| `intune.entra_registered` | boolean | windows, macos, ios, android |\n| `intune.ethernet_mac_address` | string | windows, macos, ios, android |\n| `intune.exchange_access_state` | enum_string | windows, macos, ios, android |\n| `intune.exchange_access_state_reason` | enum_string | windows, macos, ios, android |\n| `intune.exchange_last_successful_sync_at` | datetime | windows, macos, ios, android |\n| `intune.free_storage_space_bytes` | integer | windows, macos, ios, android |\n| `intune.iccid` | string | windows, macos, ios, android |\n| `intune.imei` | string | windows, macos, ios, android |\n| `intune.intune_id` | string | windows, macos, ios, android |\n| `intune.is_encrypted` | boolean | windows, macos, ios, android |\n| `intune.is_supervised` | boolean | macos, ios |\n| `intune.jail_broken` | boolean | ios, android |\n| `intune.last_sync_at` | datetime | windows, macos, ios, android |\n| `intune.managed_device_name` | string | windows, macos, ios, android |\n| `intune.managed_device_owner_type` | enum_string | windows, macos, ios, android |\n| `intune.management_agent` | enum_string | windows, macos, ios, android |\n| `intune.management_certificate_expires_at` | datetime | windows, macos, ios, android |\n| `intune.management_state` | enum_string | windows, macos, ios, android |\n| `intune.manufacturer` | string | windows, macos, ios, android |\n| `intune.meid` | string | windows, macos, ios, android |\n| `intune.model` | string | windows, macos, ios, android |\n| `intune.notes` | string | windows, macos, ios, android |\n| `intune.operating_system` | string | windows, macos, ios, android |\n| `intune.os_up_to_date` | boolean | windows, macos, ios, android |\n| `intune.os_version` | version | windows, macos, ios, android |\n| `intune.partner_reported_threat_state` | enum_string | windows, macos, ios, android |\n| `intune.phone_number` | string | windows, macos, ios, android |\n| `intune.physical_memory_bytes` | integer | windows, macos, ios, android |\n| `intune.require_user_enrollment_approval` | boolean | windows, macos, ios, android |\n| `intune.serial_number` | string | windows, macos, ios, android |\n| `intune.subscriber_carrier` | string | windows, macos, ios, android |\n| `intune.total_storage_space_bytes` | integer | windows, macos, ios, android |\n| `intune.udid` | string | windows, macos, ios, android |\n| `intune.user_display_name` | string | windows, macos, ios, android |\n| `intune.user_id` | string | windows, macos, ios, android |\n| `intune.user_principal_name` | string | windows, macos, ios, android |\n| `intune.wifi_mac_address` | string | windows, macos, ios, android |\n\n### iru fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `iru.activation_lock_allowed_while_supervised` | boolean | macos, ios |\n| `iru.activation_lock_bypass_code_failed` | boolean | macos, ios |\n| `iru.activation_lock_collected_at` | datetime | macos, ios |\n| `iru.activation_lock_supported` | boolean | macos, ios |\n| `iru.agent_installed` | boolean | macos, ios |\n| `iru.agent_version` | version | macos, ios |\n| `iru.any_signed_os` | boolean | macos, ios |\n| `iru.apple_silicon` | boolean | macos, ios |\n| `iru.asset_tag` | string | macos, ios |\n| `iru.blueprint_id` | string | macos, ios |\n| `iru.blueprint_name` | string | macos, ios |\n| `iru.bootstrap_token_auth` | boolean | macos, ios |\n| `iru.bootstrap_token_escrowed` | boolean | macos, ios |\n| `iru.cellular_technology` | enum_string | macos, ios |\n| `iru.data_roaming` | boolean | macos, ios |\n| `iru.device_activation_lock_enabled` | boolean | macos, ios |\n| `iru.device_capacity_gb` | float | macos, ios |\n| `iru.device_family` | enum_string | macos, ios |\n| `iru.device_name` | string | macos, ios |\n| `iru.display_os_version` | version | macos, ios |\n| `iru.enrolled` | boolean | macos, ios |\n| `iru.external_boot_level` | enum_string | macos |\n| `iru.filevault_collected_at` | datetime | macos, ios |\n| `iru.filevault_enabled` | boolean | macos |\n| `iru.filevault_key_escrowed` | boolean | macos, ios |\n| `iru.filevault_key_rotation_scheduled_at` | datetime | macos, ios |\n| `iru.filevault_key_type` | enum_string | macos |\n| `iru.filevault_regeneration_needed` | boolean | macos, ios |\n| `iru.firewall_allow_signed_applications` | boolean | macos, ios |\n| `iru.firewall_block_all_incoming` | boolean | macos, ios |\n| `iru.firewall_collected_at` | datetime | macos, ios |\n| `iru.firewall_enabled` | boolean | macos |\n| `iru.firewall_logging` | boolean | macos, ios |\n| `iru.firewall_logging_option` | enum_string | macos |\n| `iru.firewall_stealth_mode` | boolean | macos, ios |\n| `iru.firewall_unloading` | boolean | macos, ios |\n| `iru.firewall_version` | version | macos |\n| `iru.first_enrolled_at` | datetime | macos, ios |\n| `iru.gatekeeper_collected_at` | datetime | macos, ios |\n| `iru.gatekeeper_enabled` | boolean | macos |\n| `iru.gatekeeper_opaque_version` | version | macos |\n| `iru.gatekeeper_trusted_developers` | boolean | macos, ios |\n| `iru.gatekeeper_version` | version | macos |\n| `iru.host_name` | string | macos, ios |\n| `iru.hotspot` | boolean | macos, ios |\n| `iru.inventory_collected_at` | datetime | macos, ios |\n| `iru.iru_id` | string | macos, ios |\n| `iru.is_missing` | boolean | macos, ios |\n| `iru.is_removed` | boolean | macos, ios |\n| `iru.kext_requires_bootstrap_token` | boolean | macos, ios |\n| `iru.last_check_in_at` | datetime | macos, ios |\n| `iru.last_enrolled_at` | datetime | macos, ios |\n| `iru.local_hostname` | string | macos, ios |\n| `iru.lost_mode_status` | enum_string | macos, ios |\n| `iru.malware_removal_tool_version` | version | macos |\n| `iru.mdm_enabled` | boolean | macos, ios |\n| `iru.mdm_manages_kext` | boolean | macos, ios |\n| `iru.model` | string | macos, ios |\n| `iru.model_identifier` | string | macos, ios |\n| `iru.model_name` | string | macos, ios |\n| `iru.os_build` | string | macos, ios |\n| `iru.os_name` | string | macos, ios |\n| `iru.os_up_to_date` | boolean | macos, ios |\n| `iru.os_version` | version | macos, ios |\n| `iru.platform` | enum_string | macos, ios |\n| `iru.secure_boot_level` | enum_string | macos |\n| `iru.serial_number` | string | macos, ios |\n| `iru.shared_ipad` | boolean | macos, ios |\n| `iru.sip_enabled` | boolean | macos |\n| `iru.software_update_requires_bootstrap_token` | boolean | macos, ios |\n| `iru.ssv_enabled` | boolean | macos |\n| `iru.startup_settings_collected_at` | datetime | macos, ios |\n| `iru.supplemental_build_version` | string | macos, ios |\n| `iru.supplemental_os_version_extra` | version | macos, ios |\n| `iru.tags` | string_array | macos, ios |\n| `iru.user_activation_lock_enabled` | boolean | macos, ios |\n| `iru.user_email` | string | macos, ios |\n| `iru.user_id` | string | macos, ios |\n| `iru.user_is_archived` | boolean | macos, ios |\n| `iru.user_manages_kext` | boolean | macos, ios |\n| `iru.user_name` | string | macos, ios |\n| `iru.xprotect_version` | version | macos |\n\n### santa fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `santa.configured_client_mode` | enum_string | macos |\n| `santa.enrolled` | boolean | macos |\n| `santa.first_seen_at` | datetime | macos |\n| `santa.hostname` | string | macos |\n| `santa.last_preflight_at` | datetime | macos |\n| `santa.last_preflight_ip` | ip | macos |\n| `santa.last_seen_client_mode` | enum_string | macos |\n| `santa.last_sync_at` | datetime | macos |\n| `santa.machine_model` | string | macos |\n| `santa.os_build` | string | macos |\n| `santa.os_type` | enum_string | macos |\n| `santa.os_up_to_date` | boolean | macos |\n| `santa.os_version` | version | macos |\n| `santa.primary_user` | string | macos |\n| `santa.primary_user_groups` | string_array | macos |\n| `santa.rule_sync_at` | datetime | macos |\n| `santa.santa_id` | string | macos |\n| `santa.santa_version` | version | macos |\n| `santa.santanetd_version` | version | macos |\n| `santa.serial_number` | string | macos |\n| `santa.sip_status` | integer | macos |\n| `santa.tags` | string_array | macos |\n| `santa.temporary_admin_mode_ends_at` | datetime | macos |\n| `santa.temporary_admin_mode_user` | string | macos |\n| `santa.temporary_monitor_mode_ends_at` | datetime | macos |\n\n### sentinelone fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `sentinelone.account_name` | string | windows, macos, linux |\n| `sentinelone.active_protection` | string_array | windows, macos, linux |\n| `sentinelone.active_threats` | integer | windows, macos, linux |\n| `sentinelone.ad_computer_distinguished_name` | string | windows, macos, linux |\n| `sentinelone.ad_computer_member_of` | string_array | windows, macos, linux |\n| `sentinelone.ad_last_user_distinguished_name` | string | windows, macos, linux |\n| `sentinelone.ad_last_user_member_of` | string_array | windows, macos, linux |\n| `sentinelone.ad_mail` | string | windows, macos, linux |\n| `sentinelone.ad_user_principal_name` | string | windows, macos, linux |\n| `sentinelone.agent_version` | version | windows, macos, linux |\n| `sentinelone.allow_remote_shell` | boolean | windows, macos, linux |\n| `sentinelone.apps_vulnerability_status` | enum_string | windows, macos, linux |\n| `sentinelone.cloud_providers` | json | windows, macos, linux |\n| `sentinelone.computer_name` | string | windows, macos, linux |\n| `sentinelone.console_migration_status` | enum_string | windows, macos, linux |\n| `sentinelone.core_count` | integer | windows, macos, linux |\n| `sentinelone.cpu_count` | integer | windows, macos, linux |\n| `sentinelone.cpu_id` | string | windows, macos, linux |\n| `sentinelone.detection_state` | enum_string | windows, macos, linux |\n| `sentinelone.domain` | string | windows, macos, linux |\n| `sentinelone.encrypted_applications` | boolean | windows, macos, linux |\n| `sentinelone.enrolled` | boolean | windows, macos, linux |\n| `sentinelone.external_id` | string | windows, macos, linux |\n| `sentinelone.external_ip` | ip | windows, macos, linux |\n| `sentinelone.firewall_enabled` | boolean | windows, macos, linux |\n| `sentinelone.first_full_mode_at` | datetime | windows, macos, linux |\n| `sentinelone.full_disk_scan_updated_at` | datetime | windows, macos, linux |\n| `sentinelone.group_id` | string | windows, macos, linux |\n| `sentinelone.group_ip` | string | windows, macos, linux |\n| `sentinelone.group_name` | string | windows, macos, linux |\n| `sentinelone.has_containerized_workload` | boolean | windows, macos, linux |\n| `sentinelone.in_remote_shell_session` | boolean | windows, macos, linux |\n| `sentinelone.infected` | boolean | windows, macos, linux |\n| `sentinelone.installer_type` | enum_string | windows, macos, linux |\n| `sentinelone.is_active` | boolean | windows, macos, linux |\n| `sentinelone.is_ad_connector` | boolean | windows, macos, linux |\n| `sentinelone.is_decommissioned` | boolean | windows, macos, linux |\n| `sentinelone.is_hyper_automate` | boolean | windows, macos, linux |\n| `sentinelone.is_pending_uninstall` | boolean | windows, macos, linux |\n| `sentinelone.is_uninstalled` | boolean | windows, macos, linux |\n| `sentinelone.is_up_to_date` | boolean | windows, macos, linux |\n| `sentinelone.last_active_at` | datetime | windows, macos, linux |\n| `sentinelone.last_ip_to_management` | ip | windows, macos, linux |\n| `sentinelone.last_logged_in_user_name` | string | windows, macos, linux |\n| `sentinelone.last_successful_scan_at` | datetime | windows, macos, linux |\n| `sentinelone.location_enabled` | boolean | windows, macos, linux |\n| `sentinelone.location_type` | enum_string | windows, macos, linux |\n| `sentinelone.locations` | json | windows, macos, linux |\n| `sentinelone.machine_sid` | string | windows, macos, linux |\n| `sentinelone.machine_type` | enum_string | windows, macos, linux |\n| `sentinelone.missing_permissions` | string_array | windows, macos, linux |\n| `sentinelone.mitigation_mode` | enum_string | windows, macos, linux |\n| `sentinelone.mitigation_mode_suspicious` | enum_string | windows, macos, linux |\n| `sentinelone.model_name` | string | windows, macos, linux |\n| `sentinelone.network_interfaces` | json | windows, macos, linux |\n| `sentinelone.network_quarantine_enabled` | boolean | windows, macos, linux |\n| `sentinelone.network_status` | enum_string | windows, macos, linux |\n| `sentinelone.operational_state` | enum_string | windows, macos, linux |\n| `sentinelone.operational_state_expires_at` | datetime | windows, macos, linux |\n| `sentinelone.os_arch` | enum_string | windows, macos, linux |\n| `sentinelone.os_name` | string | windows, macos, linux |\n| `sentinelone.os_revision` | version | windows, macos, linux |\n| `sentinelone.os_start_time` | datetime | windows, macos, linux |\n| `sentinelone.os_type` | enum_string | windows, macos, linux |\n| `sentinelone.os_up_to_date` | boolean | windows, macos |\n| `sentinelone.os_username` | string | windows, macos, linux |\n| `sentinelone.protected_containers_count` | integer | windows, macos, linux |\n| `sentinelone.protected_pods_count` | integer | windows, macos, linux |\n| `sentinelone.protected_tasks_count` | integer | windows, macos, linux |\n| `sentinelone.proxy_console` | boolean | windows, macos, linux |\n| `sentinelone.proxy_deep_visibility` | boolean | windows, macos, linux |\n| `sentinelone.proxy_method` | enum_string | windows, macos, linux |\n| `sentinelone.proxy_pac_file_usage` | boolean | windows, macos, linux |\n| `sentinelone.ranger_status` | enum_string | windows, macos, linux |\n| `sentinelone.ranger_version` | version | windows, macos, linux |\n| `sentinelone.registered_at` | datetime | windows, macos, linux |\n| `sentinelone.remote_profiling_state` | enum_string | windows, macos, linux |\n| `sentinelone.remote_profiling_state_expires_at` | datetime | windows, macos, linux |\n| `sentinelone.scan_aborted_at` | datetime | windows, macos, linux |\n| `sentinelone.scan_finished_at` | datetime | windows, macos, linux |\n| `sentinelone.scan_started_at` | datetime | windows, macos, linux |\n| `sentinelone.scan_status` | enum_string | windows, macos, linux |\n| `sentinelone.sentinelone_account_id` | string | windows, macos, linux |\n| `sentinelone.sentinelone_id` | string | windows, macos, linux |\n| `sentinelone.serial_number` | string | windows, macos, linux |\n| `sentinelone.site_id` | string | windows, macos, linux |\n| `sentinelone.site_name` | string | windows, macos, linux |\n| `sentinelone.storage_name` | string | windows, macos, linux |\n| `sentinelone.storage_type` | string | windows, macos, linux |\n| `sentinelone.tags` | json | windows, macos, linux |\n| `sentinelone.threat_reboot_required` | boolean | windows, macos, linux |\n| `sentinelone.total_memory` | integer | windows, macos, linux |\n| `sentinelone.user_actions_needed` | string_array | windows, macos, linux |\n| `sentinelone.uuid` | string | windows, macos, linux |\n\n### sophos fields\n\n| Field | Type | Platforms |\n| --- | --- | --- |\n| `sophos.assigned_products` | json | windows, macos, linux |\n| `sophos.associated_person_id` | string | windows, macos, linux |\n| `sophos.associated_person_name` | string | windows, macos, linux |\n| `sophos.associated_person_via_login` | string | windows, macos, linux |\n| `sophos.cloned` | boolean | windows, macos, linux |\n| `sophos.cloud_instance_id` | string | windows, macos, linux |\n| `sophos.cloud_provider` | enum_string | windows, macos, linux |\n| `sophos.device_software` | json | windows, macos, linux |\n| `sophos.encryption_overall_status` | enum_string | windows, macos, linux |\n| `sophos.encryption_volumes` | json | windows, macos, linux |\n| `sophos.enrolled` | boolean | windows, macos, linux |\n| `sophos.group_hierarchy` | json | windows, macos, linux |\n| `sophos.group_id` | string | windows, macos, linux |\n| `sophos.group_name` | string | windows, macos, linux |\n| `sophos.health_overall` | enum_string | windows, macos, linux |\n| `sophos.health_service_details` | json | windows, macos, linux |\n| `sophos.health_services_status` | enum_string | windows, macos, linux |\n| `sophos.health_threats_status` | enum_string | windows, macos, linux |\n| `sophos.hostname` | string | windows, macos, linux |\n| `sophos.ipv4_addresses` | string_array | windows, macos, linux |\n| `sophos.ipv6_addresses` | string_array | windows, macos, linux |\n| `sophos.isolation_admin_isolated` | boolean | windows, macos, linux |\n| `sophos.isolation_self_isolated` | boolean | windows, macos, linux |\n| `sophos.isolation_status` | enum_string | windows, macos, linux |\n| `sophos.last_agent_update_at` | datetime | windows, macos, linux |\n| `sophos.last_os_update_at` | datetime | windows, macos, linux |\n| `sophos.last_seen_at` | datetime | windows, macos, linux |\n| `sophos.lockdown_status` | enum_string | windows, macos, linux |\n| `sophos.mac_addresses` | string_array | windows, macos, linux |\n| `sophos.online` | boolean | windows, macos, linux |\n| `sophos.os_build` | integer | windows, macos, linux |\n| `sophos.os_is_server` | boolean | windows, macos, linux |\n| `sophos.os_major_version` | integer | windows, macos, linux |\n| `sophos.os_minor_version` | integer | windows, macos, linux |\n| `sophos.os_name` | string | windows, macos, linux |\n| `sophos.os_platform` | enum_string | windows, macos, linux |\n| `sophos.os_up_to_date` | boolean | macos |\n| `sophos.packages` | json | windows, macos, linux |\n| `sophos.serial_number` | string | windows, macos, linux |\n| `sophos.sophos_id` | string | windows, macos, linux |\n| `sophos.tags` | json | windows, macos, linux |\n| `sophos.tamper_protection_enabled` | boolean | windows, macos, linux |\n| `sophos.tamper_protection_supported` | boolean | windows, macos, linux |\n| `sophos.type` | enum_string | windows, macos, linux |","example":{"and":[{"field":"intune.enrolled","op":"is","value":true},{"field":"intune.compliance_state","op":"is","rows":"all","value":"compliant"},{"field":"intune.last_sync_at","op":"within_last","value":"PT24H"},{"or":[{"field":"firezone.last_seen_version","op":"gte","value":"@latest"},{"not":{"field":"firezone.hostname","op":"starts_with","value":"test-"}}]}]},"oneOf":[{"$ref":"#/components/schemas/PolicyPostureAnd"},{"$ref":"#/components/schemas/PolicyPostureOr"},{"$ref":"#/components/schemas/PolicyPostureNot"},{"$ref":"#/components/schemas/PolicyPostureLeaf"}],"title":"PolicyPostureNode","type":"object"},"OIDCAuthProvider":{"description":"OIDC Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_id":{"description":"Client ID","example":"my-client-id","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"discovery_document_uri":{"description":"Discovery document URI","example":"https://idp.example.com/.well-known/openid-configuration","type":"string"},"email_verification_method":{"description":"How sign-in verifies the email claim","enum":["none","claim","proof"],"example":"claim","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_default":{"description":"Whether provider is default","example":false,"type":"boolean"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"issuer":{"description":"Issuer","example":"https://idp.example.com","type":"string"},"name":{"description":"Provider name","example":"OIDC Provider","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_id","client_session_lifetime_secs","context","discovery_document_uri","email_verification_method","id","inserted_at","is_default","is_disabled","issuer","name","portal_session_lifetime_secs","updated_at"],"title":"OIDCAuthProvider","type":"object"},"DefenderDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/DefenderDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"DefenderDeviceListResponse","type":"object"},"ExternalIdentityListResponse":{"description":"Response schema for multiple External Identities","properties":{"data":{"description":"External Identity details","items":{"$ref":"#/components/schemas/ExternalIdentity"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"ExternalIdentityListResponse","type":"object"},"ClientPut":{"description":"Put schema for updating a single Client","properties":{"name":{"description":"Client Name","example":"John's Macbook Air","type":"string"},"slug":{"description":"DNS label the Client is reached at under `firezone.network`, unique within the Account. One to 63 lowercase letters, digits or hyphens, starting and ending with a letter or digit. Left as it is when omitted.","example":"johns-macbook-air","type":"string"}},"required":["name"],"title":"ClientPut","type":"object"},"ClientsResponse":{"description":"Response schema for multiple Clients","properties":{"data":{"description":"Clients details","items":{"$ref":"#/components/schemas/Client"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"ClientsResponse","type":"object"},"GoogleDirectoryListResponse":{"description":"Response schema for multiple Google Directories","properties":{"data":{"description":"Google Directory details","items":{"$ref":"#/components/schemas/GoogleDirectory"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"GoogleDirectoryListResponse","type":"object"},"GatewaysResponse":{"description":"Response schema for multiple Gateways","properties":{"data":{"description":"Gateways details","items":{"$ref":"#/components/schemas/Gateway"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"GatewaysResponse","type":"object"},"PolicyCreateRequest":{"description":"POST body for creating a Policy","properties":{"policy":{"$ref":"#/components/schemas/PolicyCreateParams"}},"required":["policy"],"title":"PolicyCreateRequest","type":"object"},"ResourceResponse":{"description":"Response schema for single Resource","properties":{"data":{"$ref":"#/components/schemas/Resource"}},"title":"ResourceResponse","type":"object"},"version no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["defender.agent_version","intune.attestation_boot_app_security_version","intune.attestation_boot_manager_security_version","intune.attestation_boot_manager_version","intune.attestation_code_integrity_check_version","intune.attestation_content_version","intune.attestation_tpm_version","intune.os_version","iru.agent_version","iru.display_os_version","iru.firewall_version","iru.gatekeeper_opaque_version","iru.gatekeeper_version","iru.malware_removal_tool_version","iru.os_version","iru.supplemental_os_version_extra","iru.xprotect_version","santa.os_version","santa.santa_version","santa.santanetd_version","sentinelone.agent_version","sentinelone.os_revision","sentinelone.ranger_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"version no_value provider comparison","type":"object"},"ExternalIdentityResponse":{"description":"Response schema for single External Identity","properties":{"data":{"$ref":"#/components/schemas/ExternalIdentity"}},"title":"ExternalIdentityResponse","type":"object"},"SantaDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/SantaDevice"}},"title":"SantaDeviceResponse","type":"object"},"OktaDirectory":{"description":"Okta Directory","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_id":{"description":"Client ID","example":"0oa1b2c3d4e5EXAMPLE","type":"string"},"disabled_reason":{"description":"Reason for disabling","nullable":true,"type":"string"},"error_message":{"description":"Last error message","nullable":true,"type":"string"},"errored_at":{"description":"Last error timestamp","format":"date-time","nullable":true,"type":"string"},"id":{"description":"Directory ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"description":"Whether directory is disabled","example":false,"type":"boolean"},"kid":{"description":"Key ID","example":"kid-2f8a1c9e","type":"string"},"name":{"description":"Directory name","example":"Okta","type":"string"},"okta_domain":{"description":"Okta domain","example":"example.okta.com","type":"string"},"synced_at":{"description":"Last sync timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_id","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","kid","name","okta_domain","synced_at","updated_at"],"title":"OktaDirectory","type":"object"},"SentinelOnePostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating a SentinelOne posture provider. All fields are optional; omitted fields keep their current value.","properties":{"sentinelone_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"SentinelOne","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["sentinelone_posture_provider"],"title":"SentinelOnePostureProviderUpdateRequest","type":"object"},"GatewayCreate":{"description":"Create schema for a single Gateway","properties":{"name":{"description":"Gateway Name. Randomly generated when omitted.","example":"vpc-us-east","type":"string"}},"title":"GatewayCreate","type":"object"},"OktaDirectoryListResponse":{"description":"Response schema for multiple Okta Directories","properties":{"data":{"description":"Okta Directory details","items":{"$ref":"#/components/schemas/OktaDirectory"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"OktaDirectoryListResponse","type":"object"},"SophosDevice":{"description":"Endpoint synced from Sophos Central","properties":{"mac_addresses":{"items":{"type":"string"},"nullable":true,"type":"array"},"os_name":{"nullable":true,"type":"string"},"last_seen_at":{"format":"date-time","nullable":true,"type":"string"},"tamper_protection_supported":{"nullable":true,"type":"boolean"},"last_agent_update_at":{"format":"date-time","nullable":true,"type":"string"},"os_minor_version":{"nullable":true,"type":"integer"},"associated_person_via_login":{"nullable":true,"type":"string"},"updated_at":{"format":"date-time","nullable":true,"type":"string"},"os_platform":{"nullable":true,"type":"string"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"ipv6_addresses":{"items":{"type":"string"},"nullable":true,"type":"array"},"sophos_tenant_id":{"nullable":true,"type":"string"},"group_id":{"nullable":true,"type":"string"},"group_name":{"nullable":true,"type":"string"},"tags":{"items":{"type":"object"},"nullable":true,"type":"array"},"serial_number":{"nullable":true,"type":"string"},"isolation_admin_isolated":{"nullable":true,"type":"boolean"},"group_hierarchy":{"items":{"type":"object"},"nullable":true,"type":"array"},"health_threats_status":{"nullable":true,"type":"string"},"account_id":{"format":"uuid","nullable":false,"type":"string"},"encryption_volumes":{"items":{"type":"object"},"nullable":true,"type":"array"},"type":{"nullable":true,"type":"string"},"cloud_instance_id":{"nullable":true,"type":"string"},"associated_person_id":{"nullable":true,"type":"string"},"last_os_update_at":{"format":"date-time","nullable":true,"type":"string"},"encryption_overall_status":{"nullable":true,"type":"string"},"associated_person_name":{"nullable":true,"type":"string"},"health_overall":{"nullable":true,"type":"string"},"assigned_products":{"items":{"type":"object"},"nullable":true,"type":"array"},"cloud_provider":{"nullable":true,"type":"string"},"packages":{"additionalProperties":true,"nullable":true,"type":"object"},"os_build":{"nullable":true,"type":"integer"},"os_is_server":{"nullable":true,"type":"boolean"},"health_services_status":{"nullable":true,"type":"string"},"isolation_status":{"nullable":true,"type":"string"},"device_software":{"additionalProperties":true,"nullable":true,"type":"object"},"cloned":{"nullable":true,"type":"boolean"},"lockdown_status":{"nullable":true,"type":"string"},"ipv4_addresses":{"items":{"type":"string"},"nullable":true,"type":"array"},"health_service_details":{"items":{"type":"object"},"nullable":true,"type":"array"},"tamper_protection_enabled":{"nullable":true,"type":"boolean"},"online":{"nullable":true,"type":"boolean"},"sophos_id":{"nullable":false,"type":"string"},"isolation_self_isolated":{"nullable":true,"type":"boolean"},"os_major_version":{"nullable":true,"type":"integer"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"},"hostname":{"nullable":true,"type":"string"}},"required":["account_id","sophos_id","posture_provider_id","type","sophos_tenant_id","hostname","health_overall","health_threats_status","health_services_status","health_service_details","os_is_server","os_platform","os_name","os_major_version","os_minor_version","os_build","ipv4_addresses","ipv6_addresses","mac_addresses","group_id","group_name","group_hierarchy","associated_person_id","associated_person_name","associated_person_via_login","tamper_protection_supported","tamper_protection_enabled","assigned_products","packages","device_software","last_seen_at","last_os_update_at","last_agent_update_at","serial_number","encryption_overall_status","encryption_volumes","lockdown_status","tags","online","cloud_provider","cloud_instance_id","isolation_status","isolation_admin_isolated","isolation_self_isolated","cloned","synced_at","inserted_at","updated_at"],"title":"SophosDevice","type":"object"},"DefenderPostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/DefenderPostureProvider"}},"title":"DefenderPostureProviderResponse","type":"object"},"SentinelOnePostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/SentinelOnePostureProvider"}},"title":"SentinelOnePostureProviderResponse","type":"object"},"PolicyPostureNot":{"additionalProperties":false,"description":"Negates one applicable expression. Contains no other keys.","properties":{"not":{"$ref":"#/components/schemas/PolicyPostureNode"}},"required":["not"],"title":"PolicyPostureNot","type":"object"},"PolicyPostureAnd":{"additionalProperties":false,"description":"Every applicable child expression must hold. Contains no other keys.","properties":{"and":{"items":{"$ref":"#/components/schemas/PolicyPostureNode"},"maxItems":100,"minItems":1,"type":"array"}},"required":["and"],"title":"PolicyPostureAnd","type":"object"},"PaginationMetadata":{"description":"Pagination metadata for paginated responses.","properties":{"count":{"description":"Total number of matching records","example":1,"type":"integer"},"limit":{"description":"Page size","example":10,"type":"integer"},"next_page":{"description":"Cursor to fetch the next page","nullable":true,"type":"string"},"prev_page":{"description":"Cursor to fetch the previous page","nullable":true,"type":"string"}},"required":["count","limit","next_page","prev_page"],"title":"PaginationMetadata","type":"object"},"OktaAuthProviderResponse":{"description":"Response schema for single Okta Auth Provider","properties":{"data":{"$ref":"#/components/schemas/OktaAuthProvider"}},"title":"OktaAuthProviderResponse","type":"object"},"SophosPostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/SophosPostureProvider"}},"title":"SophosPostureProviderResponse","type":"object"},"string_array no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string_array field; see PolicyPostureNode for platform applicability","enum":["defender.machine_tags","iru.tags","santa.primary_user_groups","santa.tags","sentinelone.active_protection","sentinelone.ad_computer_member_of","sentinelone.ad_last_user_member_of","sentinelone.missing_permissions","sentinelone.user_actions_needed","sophos.ipv4_addresses","sophos.ipv6_addresses","sophos.mac_addresses"],"type":"string"},"op":{"enum":["is_empty","is_not_empty","exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string_array no_value provider comparison","type":"object"},"Subject":{"description":"Identifies the actor and request context that initiated an action.\n\nUsed to describe the principal behind an audit log entry, an authorized\nflow, or any other event surfaced through the API. May be `null` when\nthe action originated outside the context of a Firezone session.\n","nullable":true,"properties":{"actor_email":{"description":"Email address of the actor, if any.","example":"admin@example.com","nullable":true,"type":"string"},"actor_id":{"description":"Identifier of the actor that initiated the action.","example":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"actor_name":{"description":"Display name of the actor.","example":"Admin User","type":"string"},"actor_type":{"description":"Type of the actor.","enum":["account_user","account_admin_user","service_account","api_client"],"example":"account_admin_user","type":"string"},"attested_at":{"description":"When the device last attested, snapshotted for this subject. Does not imply the current connection attested. Omitted when absent.","format":"date-time","type":"string"},"attested_cert_fingerprint":{"description":"Certificate fingerprint from the device's last attestation. Omitted when absent.","type":"string"},"attested_cert_issuer":{"description":"Base64-encoded DER X.509 issuer Name from the device's last attestation. Omitted when absent.","format":"byte","type":"string"},"attested_cert_serial":{"description":"Certificate serial from the device's last attestation. Omitted when absent.","type":"string"},"attested_device_serial":{"description":"Device serial from the device's last attestation. Omitted when absent.","type":"string"},"attested_device_uuid":{"description":"Device UUID from the device's last attestation. Omitted when absent.","type":"string"},"attested_mdm_device_id":{"description":"MDM device ID from the device's last attestation. Omitted when absent.","type":"string"},"auth_provider_id":{"description":"Identifier of the authentication provider that authenticated the actor.","example":"98776234-1234-5678-9012-345678901234","format":"uuid","nullable":true,"type":"string"},"ip":{"description":"IP address the action originated from.","example":"1.2.3.4","nullable":true,"type":"string"},"ip_city":{"description":"Geo-located city for `ip`, if known.","example":"San Francisco","nullable":true,"type":"string"},"ip_lat":{"description":"Geo-located latitude for `ip`, if known.","example":37.7749,"nullable":true,"type":"number"},"ip_lon":{"description":"Geo-located longitude for `ip`, if known.","example":-122.4194,"nullable":true,"type":"number"},"ip_region":{"description":"Geo-located region for `ip`, if known.","example":"California","nullable":true,"type":"string"},"user_agent":{"description":"User agent of the client that initiated the action.","example":"Mozilla/5.0","nullable":true,"type":"string"}},"title":"Subject","type":"object"},"IruPostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/IruPostureProvider"}},"title":"IruPostureProviderResponse","type":"object"},"GatewayProvisionResponse":{"description":"Response schema for a newly provisioned Gateway. Includes the one-time token secret - it is not shown again.\n","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/Gateway"},{"properties":{"token":{"description":"One-time Gateway token secret","type":"string"}},"required":["token"],"type":"object"}]}},"title":"GatewayProvisionResponse","type":"object"},"string scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string scalar provider comparison","type":"object"},"X509AuthProvider":{"description":"X.509 Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"context":{"description":"Context","enum":["clients_only"],"example":"clients_only","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"description":"Whether provider is disabled","example":true,"type":"boolean"},"name":{"description":"Provider name","example":"X.509","type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","context","id","inserted_at","is_disabled","name","updated_at"],"title":"X509AuthProvider","type":"object"},"ActorsResponse":{"description":"Response schema for multiple Actors","properties":{"data":{"description":"Actors details","items":{"$ref":"#/components/schemas/Actor"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"ActorsResponse","type":"object"},"GoogleAuthProviderResponse":{"description":"Response schema for single Google Auth Provider","properties":{"data":{"$ref":"#/components/schemas/GoogleAuthProvider"}},"title":"GoogleAuthProviderResponse","type":"object"},"ActorUpdateRequest":{"description":"PATCH/PUT body for updating an Actor. All fields are optional; omitted fields keep their current value.","properties":{"actor":{"properties":{"allow_email_otp_sign_in":{"default":false,"description":"Allow Email OTP Sign In","example":false,"type":"boolean"},"email":{"description":"Actor Email. Optional for service accounts.","example":"joe.user@example.com","nullable":true,"type":"string"},"is_disabled":{"default":false,"description":"Whether the Actor is disabled. Setting this to `true` immediately revokes the Actor's active Client tokens and portal sessions. An Actor cannot disable itself.","example":false,"type":"boolean"},"name":{"description":"Actor Name","example":"Joe User","type":"string"},"type":{"description":"Actor Type","enum":["account_user","account_admin_user","service_account"],"example":"account_admin_user","type":"string"}},"type":"object"}},"required":["actor"],"title":"ActorUpdateRequest","type":"object"},"float scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"float field; see PolicyPostureNode for platform applicability","enum":["iru.device_capacity_gb"],"type":"string"},"op":{"enum":["eq","ne","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"number"}},"required":["field","op","value"],"title":"float scalar provider comparison","type":"object"},"string scalar device comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["is","is_not","contains","does_not_contain","starts_with","ends_with"],"type":"string"},"value":{"maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"string scalar device comparison","type":"object"},"MembershipResponse":{"description":"Response schema for Membership Updates","properties":{"data":{"description":"Memberships","properties":{"actor_ids":{"description":"Actor IDs","example":["4ddfa557-7dfc-484f-894c-2024ec3fe9f7","89d22f71-939d-442d-b148-897b730adfb4"],"items":{"description":"Actor ID","format":"uuid","type":"string"},"type":"array"}},"type":"object"}},"title":"MembershipResponse","type":"object"},"ip no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"ip field; see PolicyPostureNode for platform applicability","enum":["defender.last_external_ip_address","defender.last_ip_address","santa.last_preflight_ip","sentinelone.external_ip","sentinelone.last_ip_to_management"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"ip no_value provider comparison","type":"object"},"datetime no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"datetime no_value provider comparison","type":"object"},"MembershipListResponse":{"description":"Response schema for Memberships","properties":{"data":{"description":"Membership details","items":{"$ref":"#/components/schemas/Membership"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"MembershipListResponse","type":"object"},"Actor":{"description":"Actor","properties":{"allow_email_otp_sign_in":{"default":false,"description":"Allow Email OTP Sign In","example":false,"type":"boolean"},"created_by_directory_id":{"description":"Directory ID that created this actor","format":"uuid","nullable":true,"type":"string"},"disabled_by_directory_id":{"description":"Directory ID that disabled this actor because its user is inactive at the identity provider. The directory re-enables the actor when the user is active again. Null when the actor is enabled or was disabled by an admin.","format":"uuid","nullable":true,"readOnly":true,"type":"string"},"email":{"description":"Actor Email","example":"john.doe@example.com","nullable":true,"type":"string"},"id":{"description":"Actor ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"When the actor was created","example":"2024-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"default":false,"description":"Whether the actor is disabled","example":false,"type":"boolean"},"last_seen_at":{"description":"Latest time the Actor was active: a Client of theirs connected, they signed in to the admin portal, or one of their API or OAuth tokens was used. Null when none of these was recorded, and always null in a delete response.","example":"2024-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"},"name":{"description":"Actor Name","example":"John Doe","type":"string"},"type":{"description":"Actor Type","enum":["account_admin_user","account_user","api_client","service_account"],"example":"account_admin_user","type":"string"},"updated_at":{"description":"When the actor was last updated","example":"2024-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["allow_email_otp_sign_in","created_by_directory_id","disabled_by_directory_id","email","id","inserted_at","is_disabled","last_seen_at","name","type","updated_at"],"title":"Actor","type":"object"},"DeletedGatewayTokensResponse":{"description":"Response schema for deleted Gateway Tokens","properties":{"data":{"properties":{"deleted_count":{"description":"Number of tokens that were deleted","example":5,"type":"integer"}},"required":["deleted_count"],"type":"object"}},"title":"DeletedGatewayTokensResponse","type":"object"},"PolicyUpdateParams":{"description":"Policy attributes accepted when updating a Policy. All fields are optional; omitted fields keep their current value.","properties":{"conditions":{"description":"Conditions that must be satisfied for the Policy to grant access","example":[{"operator":"is_in_cidr","property":"remote_ip","values":["10.0.0.0/8"]}],"items":{"$ref":"#/components/schemas/PolicyCondition"},"type":"array"},"description":{"description":"Policy Description","example":"Updated description","nullable":true,"type":"string"},"flow_log_uploads_enabled":{"description":"Whether flow logs are reported for connections authorized by this Policy. Always false for Internet Resource policies.","type":"boolean"},"group_id":{"description":"Group ID","format":"uuid","type":"string"},"is_disabled":{"default":false,"description":"Whether the Policy is disabled. A disabled Policy grants no access but is otherwise retained.","example":false,"type":"boolean"},"postures":{"anyOf":[{"$ref":"#/components/schemas/PolicyPostureNode"},{"enum":[null],"nullable":true,"type":"object"}],"description":"Replaces the entire device posture expression; it is not merged. Omit to preserve existing postures, or set to null to remove them. A non-null expression requires the account's device_posture entitlement (Enterprise); otherwise returns HTTP 403. Clearing postures remains allowed after downgrade. Conditions and postures must both hold. Changing postures revokes this policy's active authorizations and interrupts affected connections until they are reauthorized. See PolicyPostureNode for fields, operators, platform behavior, and limits.","example":{"and":[{"field":"intune.enrolled","op":"is","value":true},{"field":"intune.compliance_state","op":"is","rows":"all","value":"compliant"},{"field":"intune.last_sync_at","op":"within_last","value":"PT24H"},{"or":[{"field":"firezone.last_seen_version","op":"gte","value":"@latest"},{"not":{"field":"firezone.hostname","op":"starts_with","value":"test-"}}]}]},"nullable":true},"require_attestation":{"description":"Whether the Client must present a valid X.509 certificate from one of the account's trust anchors on its current connection. Setting it to true returns 422 when the account has no trust anchors.","type":"boolean"},"resource_id":{"description":"Resource ID","format":"uuid","type":"string"}},"title":"PolicyUpdateParams","type":"object"},"ClientTokenShowResponse":{"description":"Response schema for Client Token metadata","properties":{"data":{"$ref":"#/components/schemas/ClientToken"}},"title":"ClientTokenShowResponse","type":"object"},"DefenderDevice":{"description":"Device synced from Microsoft Defender for Endpoint","properties":{"last_seen_at":{"format":"date-time","nullable":true,"type":"string"},"machine_tags":{"items":{"type":"string"},"nullable":true,"type":"array"},"managed_by":{"nullable":true,"type":"string"},"vm_resource_id":{"nullable":true,"type":"string"},"updated_at":{"format":"date-time","nullable":true,"type":"string"},"os_platform":{"nullable":true,"type":"string"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"last_ip_address":{"nullable":true,"type":"string"},"device_value":{"nullable":true,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"os_architecture":{"nullable":true,"type":"string"},"rbac_group_name":{"nullable":true,"type":"string"},"exposure_level":{"nullable":true,"type":"string"},"defender_id":{"nullable":false,"type":"string"},"entra_joined":{"nullable":true,"type":"boolean"},"exclusion_reason":{"nullable":true,"type":"string"},"vm_id":{"nullable":true,"type":"string"},"vm_cloud_provider":{"nullable":true,"type":"string"},"os_processor":{"nullable":true,"type":"string"},"account_id":{"format":"uuid","nullable":false,"type":"string"},"entra_device_id":{"nullable":true,"type":"string"},"os_build":{"nullable":true,"type":"integer"},"managed_by_status":{"nullable":true,"type":"string"},"is_excluded":{"nullable":true,"type":"boolean"},"vm_subscription_id":{"nullable":true,"type":"string"},"last_external_ip_address":{"nullable":true,"type":"string"},"health_status":{"nullable":true,"type":"string"},"risk_score":{"nullable":true,"type":"string"},"is_potential_duplication":{"nullable":true,"type":"boolean"},"agent_version":{"nullable":true,"type":"string"},"rbac_group_id":{"nullable":true,"type":"integer"},"version":{"nullable":true,"type":"string"},"ip_addresses":{"items":{"type":"object"},"nullable":true,"type":"array"},"onboarding_status":{"nullable":true,"type":"string"},"computer_dns_name":{"nullable":true,"type":"string"},"first_seen_at":{"format":"date-time","nullable":true,"type":"string"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"}},"required":["account_id","defender_id","posture_provider_id","computer_dns_name","entra_device_id","entra_joined","machine_tags","os_platform","version","os_build","os_processor","os_architecture","last_ip_address","last_external_ip_address","agent_version","health_status","onboarding_status","managed_by","managed_by_status","risk_score","exposure_level","device_value","rbac_group_id","rbac_group_name","is_potential_duplication","is_excluded","exclusion_reason","vm_id","vm_cloud_provider","vm_resource_id","vm_subscription_id","ip_addresses","first_seen_at","last_seen_at","synced_at","inserted_at","updated_at"],"title":"DefenderDevice","type":"object"},"ClientTokenWithSecret":{"description":"Client Token as returned when it is created, including the encoded secret. The secret is shown once and cannot be retrieved later.","properties":{"actor_id":{"description":"Actor ID","example":"43a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"expires_at":{"description":"Expiration","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"},"id":{"description":"Client Token ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"},"token":{"description":"Encoded token secret","example":"secret-token-here","type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"}},"required":["actor_id","expires_at","id","inserted_at","token","updated_at"],"title":"ClientTokenWithSecret","type":"object"},"SentinelOneDevice":{"description":"Endpoint agent synced from SentinelOne","properties":{"last_logged_in_user_name":{"nullable":true,"type":"string"},"sentinelone_id":{"nullable":true,"type":"string"},"user_actions_needed":{"items":{"type":"string"},"nullable":true,"type":"array"},"operational_state":{"nullable":true,"type":"string"},"os_name":{"nullable":true,"type":"string"},"os_arch":{"nullable":true,"type":"string"},"remote_profiling_state":{"nullable":true,"type":"string"},"has_containerized_workload":{"nullable":true,"type":"boolean"},"firewall_enabled":{"nullable":true,"type":"boolean"},"proxy_console":{"nullable":true,"type":"boolean"},"model_name":{"nullable":true,"type":"string"},"infected":{"nullable":true,"type":"boolean"},"proxy_deep_visibility":{"nullable":true,"type":"boolean"},"console_migration_status":{"nullable":true,"type":"string"},"is_hyper_automate":{"nullable":true,"type":"boolean"},"network_quarantine_enabled":{"nullable":true,"type":"boolean"},"scan_finished_at":{"format":"date-time","nullable":true,"type":"string"},"is_active":{"nullable":true,"type":"boolean"},"external_id":{"nullable":true,"type":"string"},"last_successful_scan_at":{"format":"date-time","nullable":true,"type":"string"},"updated_at":{"format":"date-time","nullable":true,"type":"string"},"os_username":{"nullable":true,"type":"string"},"active_protection":{"items":{"type":"string"},"nullable":true,"type":"array"},"threat_reboot_required":{"nullable":true,"type":"boolean"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"location_enabled":{"nullable":true,"type":"boolean"},"group_id":{"nullable":true,"type":"string"},"site_id":{"nullable":true,"type":"string"},"storage_name":{"nullable":true,"type":"string"},"machine_sid":{"nullable":true,"type":"string"},"remote_profiling_state_expires_at":{"format":"date-time","nullable":true,"type":"string"},"group_name":{"nullable":true,"type":"string"},"allow_remote_shell":{"nullable":true,"type":"boolean"},"tags":{"items":{"type":"object"},"nullable":true,"type":"array"},"protected_pods_count":{"nullable":true,"type":"integer"},"os_type":{"nullable":true,"type":"string"},"proxy_pac_file_usage":{"nullable":true,"type":"boolean"},"serial_number":{"nullable":true,"type":"string"},"ad_computer_member_of":{"items":{"type":"string"},"nullable":true,"type":"array"},"locations":{"items":{"type":"object"},"nullable":true,"type":"array"},"installer_type":{"nullable":true,"type":"string"},"last_active_at":{"format":"date-time","nullable":true,"type":"string"},"is_ad_connector":{"nullable":true,"type":"boolean"},"ad_user_principal_name":{"nullable":true,"type":"string"},"core_count":{"nullable":true,"type":"integer"},"detection_state":{"nullable":true,"type":"string"},"active_threats":{"nullable":true,"type":"integer"},"is_decommissioned":{"nullable":true,"type":"boolean"},"account_id":{"format":"uuid","nullable":false,"type":"string"},"cpu_count":{"nullable":true,"type":"integer"},"group_ip":{"nullable":true,"type":"string"},"protected_tasks_count":{"nullable":true,"type":"integer"},"storage_type":{"nullable":true,"type":"string"},"account_name":{"nullable":true,"type":"string"},"ranger_status":{"nullable":true,"type":"string"},"scan_status":{"nullable":true,"type":"string"},"total_memory":{"nullable":true,"type":"integer"},"encrypted_applications":{"nullable":true,"type":"boolean"},"ad_last_user_distinguished_name":{"nullable":true,"type":"string"},"missing_permissions":{"items":{"type":"string"},"nullable":true,"type":"array"},"is_uninstalled":{"nullable":true,"type":"boolean"},"computer_name":{"nullable":true,"type":"string"},"scan_aborted_at":{"format":"date-time","nullable":true,"type":"string"},"in_remote_shell_session":{"nullable":true,"type":"boolean"},"first_full_mode_at":{"format":"date-time","nullable":true,"type":"string"},"ad_last_user_member_of":{"items":{"type":"string"},"nullable":true,"type":"array"},"ad_mail":{"nullable":true,"type":"string"},"external_ip":{"nullable":true,"type":"string"},"is_pending_uninstall":{"nullable":true,"type":"boolean"},"sentinelone_account_id":{"nullable":true,"type":"string"},"last_ip_to_management":{"nullable":true,"type":"string"},"proxy_method":{"nullable":true,"type":"string"},"network_status":{"nullable":true,"type":"string"},"os_revision":{"nullable":true,"type":"string"},"agent_version":{"nullable":true,"type":"string"},"registered_at":{"format":"date-time","nullable":true,"type":"string"},"is_up_to_date":{"nullable":true,"type":"boolean"},"site_name":{"nullable":true,"type":"string"},"apps_vulnerability_status":{"nullable":true,"type":"string"},"domain":{"nullable":true,"type":"string"},"ad_computer_distinguished_name":{"nullable":true,"type":"string"},"os_start_time":{"format":"date-time","nullable":true,"type":"string"},"mitigation_mode_suspicious":{"nullable":true,"type":"string"},"machine_type":{"nullable":true,"type":"string"},"uuid":{"nullable":false,"type":"string"},"ranger_version":{"nullable":true,"type":"string"},"mitigation_mode":{"nullable":true,"type":"string"},"operational_state_expires_at":{"format":"date-time","nullable":true,"type":"string"},"network_interfaces":{"items":{"type":"object"},"nullable":true,"type":"array"},"full_disk_scan_updated_at":{"format":"date-time","nullable":true,"type":"string"},"cloud_providers":{"additionalProperties":true,"nullable":true,"type":"object"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"},"scan_started_at":{"format":"date-time","nullable":true,"type":"string"},"protected_containers_count":{"nullable":true,"type":"integer"},"cpu_id":{"nullable":true,"type":"string"},"location_type":{"nullable":true,"type":"string"}},"required":["account_id","uuid","posture_provider_id","sentinelone_account_id","account_name","site_id","site_name","group_id","group_name","sentinelone_id","agent_version","network_interfaces","domain","computer_name","os_name","os_revision","os_arch","os_username","os_start_time","os_type","total_memory","model_name","machine_type","cpu_id","cpu_count","core_count","external_ip","group_ip","active_threats","infected","threat_reboot_required","last_active_at","is_active","is_up_to_date","network_status","registered_at","is_pending_uninstall","is_uninstalled","is_decommissioned","encrypted_applications","last_logged_in_user_name","ad_last_user_distinguished_name","ad_last_user_member_of","ad_computer_distinguished_name","ad_computer_member_of","ad_user_principal_name","ad_mail","scan_status","scan_started_at","scan_finished_at","scan_aborted_at","full_disk_scan_updated_at","mitigation_mode","mitigation_mode_suspicious","user_actions_needed","missing_permissions","console_migration_status","apps_vulnerability_status","in_remote_shell_session","allow_remote_shell","locations","location_type","external_id","serial_number","machine_sid","installer_type","ranger_version","ranger_status","last_ip_to_management","operational_state","operational_state_expires_at","remote_profiling_state","remote_profiling_state_expires_at","network_quarantine_enabled","firewall_enabled","location_enabled","cloud_providers","storage_type","storage_name","detection_state","first_full_mode_at","tags","last_successful_scan_at","proxy_console","proxy_deep_visibility","proxy_pac_file_usage","proxy_method","protected_pods_count","protected_containers_count","protected_tasks_count","has_containerized_workload","is_ad_connector","is_hyper_automate","active_protection","synced_at","inserted_at","updated_at"],"title":"SentinelOneDevice","type":"object"},"Resource":{"description":"Resource","properties":{"address":{"description":"Resource address. Null for `device_pool` Resources.","example":"10.0.0.10","nullable":true,"type":"string"},"address_description":{"description":"Resource address description","example":"Production Database","nullable":true,"type":"string"},"device_membership_criteria":{"$ref":"#/components/schemas/DeviceMembershipCriteria"},"filters":{"description":"Traffic filters restricting the protocols and ports the Resource exposes","example":[{"ports":["5432"],"protocol":"tcp"}],"items":{"$ref":"#/components/schemas/ResourceFilter"},"type":"array"},"id":{"description":"Resource ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"ip_stack":{"description":"IP stack type. Only supported for DNS resources.","enum":["ipv4_only","ipv6_only","dual"],"type":"string"},"name":{"description":"Resource name","example":"Prod DB","type":"string"},"site_id":{"description":"Site to connect the Resource to. Required for all types except device pools.","example":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","format":"uuid","title":"SiteID","type":"string"},"type":{"description":"Resource type. A `device_pool` has no `address` and no `site_id`; who it holds is `device_membership_criteria`.","enum":["cidr","ip","dns","internet","device_pool"],"example":"ip","type":"string"}},"required":["address","address_description","filters","id","name","type"],"title":"Resource","type":"object"},"datetime scalar device comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["before","after"],"type":"string"},"value":{"format":"date-time","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime scalar device comparison","type":"object"},"X509AuthProviderResponse":{"description":"Response schema for a single X.509 Auth Provider","properties":{"data":{"$ref":"#/components/schemas/X509AuthProvider"}},"title":"X509AuthProviderResponse","type":"object"},"ClientTokenCreate":{"description":"Client Token attributes","properties":{"expires_at":{"description":"Expiration","example":"2025-01-15T12:34:56.789Z","format":"date-time","type":"string"}},"required":["expires_at"],"title":"ClientTokenCreate","type":"object"},"DefenderPostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/DefenderPostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"DefenderPostureProviderListResponse","type":"object"},"DeviceMembershipListedDevices":{"additionalProperties":false,"description":"Exactly the Clients named","example":{"device":{"field":"id","op":"in","value":["7cb89288-1fb3-433e-a522-2d087e45988d","cc9f561a-444d-4083-ab38-0abc6cf2314c"]}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["id"],"type":"string"},"op":{"enum":["in"],"type":"string"},"value":{"description":"Client IDs","items":{"format":"uuid","type":"string"},"type":"array"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipListedDevices","type":"object"},"EntraDirectory":{"description":"Entra Directory","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"disabled_reason":{"description":"Reason for disabling","nullable":true,"type":"string"},"email_field":{"description":"Graph API user field to use as email","enum":["mail","userPrincipalName"],"example":"userPrincipalName","type":"string"},"error_message":{"description":"Last error message","nullable":true,"type":"string"},"errored_at":{"description":"Last error timestamp","format":"date-time","nullable":true,"type":"string"},"id":{"description":"Directory ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"description":"Whether directory is disabled","example":false,"type":"boolean"},"name":{"description":"Directory name","example":"Entra","type":"string"},"sync_all_groups":{"description":"Sync all groups","example":false,"type":"boolean"},"synced_at":{"description":"Last sync timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"},"tenant_id":{"description":"Microsoft Entra tenant ID","example":"12345678-1234-1234-1234-123456789012","type":"string"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","disabled_reason","email_field","error_message","errored_at","id","inserted_at","is_disabled","name","sync_all_groups","synced_at","tenant_id","updated_at"],"title":"EntraDirectory","type":"object"},"LogsResponse":{"description":"Response schema for a page of Log entries.\n\nEntries are returned most recent first. Each page contains at most 100\nentries (50 by default); use the `metadata.next_page` cursor to fetch\nthe following page.\n","properties":{"data":{"description":"Log entries for the requested window.","example":[{"after":{"name":"Jane Smith"},"before":{"name":"Jane Doe"},"log_id":"c00060db0c2c8eb400000000","object":"actors","operation":"update","subject":null,"timestamp":"2026-05-26T12:34:56.789Z","type":"change"}],"items":{"$ref":"#/components/schemas/Log"},"type":"array"},"metadata":{"description":"Pagination metadata","example":{"count":1,"limit":50,"next_page":null,"prev_page":null},"type":"object"}},"title":"LogsResponse","type":"object"},"enum_string no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"enum_string no_value provider comparison","type":"object"},"SentinelOnePostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SentinelOnePostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SentinelOnePostureProviderListResponse","type":"object"},"PoolMemberResponse":{"description":"Response schema for Pool Member updates","properties":{"data":{"description":"Pool members","properties":{"device_ids":{"description":"Client IDs currently in the pool","example":["4ddfa557-7dfc-484f-894c-2024ec3fe9f7","89d22f71-939d-442d-b148-897b730adfb4"],"items":{"description":"Client ID","format":"uuid","type":"string"},"type":"array"}},"type":"object"}},"title":"PoolMemberResponse","type":"object"},"Client":{"description":"Client","properties":{"actor_id":{"description":"Actor ID","example":"6ecc106b-75c1-48a5-846c-14782180c1ff","format":"uuid","type":"string"},"created_at":{"description":"Client creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"device_serial":{"description":"Device manufacturer serial number (unavailable for mobile devices)","example":"GCCFX0DBQ6L5","nullable":true,"type":"string"},"device_uuid":{"description":"Device manufacturer UUID (unavailable for mobile devices)","example":"7A461FF9-0BE2-64A9-A418-539D9A21827B","nullable":true,"type":"string"},"firebase_installation_id":{"description":"Firebase installation ID (Android only)","nullable":true,"type":"string"},"firezone_id":{"description":"Identifier the Client reports for itself. Null for a Client whose identity comes from an MDM-issued certificate, since a self-reported value could otherwise be used to claim another Client's record.","example":"b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c","nullable":true,"type":"string"},"hostname":{"description":"Client hostname","example":"johns-macbook.example.com","nullable":true,"type":"string"},"id":{"description":"Client ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"identifier_for_vendor":{"description":"App installation ID (iOS only)","nullable":true,"type":"string"},"ipv4":{"description":"Tunnel IPv4 Address of Client","example":"100.64.0.1","type":"string"},"ipv6":{"description":"Tunnel IPv6 Address of Client","example":"fd00:2021:1111::1","type":"string"},"last_attested_at":{"description":"When the device last proved possession of an MDM-provisioned client certificate","example":"2025-01-01T00:00:00Z","format":"date-time","nullable":true,"readOnly":true,"type":"string"},"last_attested_cert_fingerprint":{"description":"SHA-256 fingerprint of the client certificate used for device verification","example":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","nullable":true,"readOnly":true,"type":"string"},"last_attested_cert_serial":{"description":"Serial number of the client certificate used for device verification","example":"4A:2F:00:8C:11:03:9E:5B","nullable":true,"readOnly":true,"type":"string"},"last_attested_device_serial":{"description":"Device serial number attested by an MDM-provisioned client certificate","example":"GCCFX0DBQ6L5","nullable":true,"readOnly":true,"type":"string"},"last_attested_device_uuid":{"description":"Device UUID attested by an MDM-provisioned client certificate","example":"7A461FF9-0BE2-64A9-A418-539D9A21827B","nullable":true,"readOnly":true,"type":"string"},"last_attested_mdm_device_id":{"description":"MDM device ID attested by an MDM-provisioned client certificate","example":"5f2e7b7a-9d54-4bd2-9d4f-8f6c2a01f9d3","nullable":true,"readOnly":true,"type":"string"},"last_seen_at":{"description":"When the latest connection started. It is not updated while the Client stays connected, so check `online` too. Every Client has connected at least once, when it was created. Null when the Client has not connected since this field started to be recorded in February 2026.","example":"2025-01-01T00:00:00Z","format":"date-time","nullable":true,"type":"string"},"last_seen_remote_ip":{"description":"Remote IP from the latest session","example":"203.0.113.10","nullable":true,"type":"string"},"last_seen_remote_ip_location_city":{"description":"Remote IP city from the latest session","example":"New York","nullable":true,"type":"string"},"last_seen_remote_ip_location_lat":{"description":"Remote IP latitude from the latest session","example":40.7128,"nullable":true,"type":"number"},"last_seen_remote_ip_location_lon":{"description":"Remote IP longitude from the latest session","example":-74.006,"nullable":true,"type":"number"},"last_seen_remote_ip_location_region":{"description":"Remote IP region from the latest session","example":"US","nullable":true,"type":"string"},"last_seen_user_agent":{"description":"User agent from the latest session","example":"macOS/14.0 apple-client/1.5.0","nullable":true,"type":"string"},"last_seen_version":{"description":"Client version from the latest session","example":"1.5.0","nullable":true,"type":"string"},"name":{"description":"Client Name","example":"John's Macbook Air","type":"string"},"online":{"description":"Online status of Client","example":true,"type":"boolean"},"public_key":{"description":"WireGuard public key from the latest session","example":"WdKAyoA45xJllRUYnFhI5+Y4EjSTs50MzYYHfrIhVAc=","nullable":true,"type":"string"},"slug":{"description":"DNS label the Client is reached at under `firezone.network`, unique within the Account. Null until the Client connects once.","example":"johns-macbook-air","nullable":true,"type":"string"},"updated_at":{"description":"Client update timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"verified_at":{"description":"Client verification timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","nullable":true,"type":"string"}},"required":["actor_id","created_at","device_serial","device_uuid","firebase_installation_id","firezone_id","hostname","id","identifier_for_vendor","slug","ipv4","ipv6","last_attested_at","last_attested_cert_fingerprint","last_attested_cert_serial","last_attested_device_serial","last_attested_device_uuid","last_attested_mdm_device_id","last_seen_at","last_seen_remote_ip","last_seen_remote_ip_location_city","last_seen_remote_ip_location_lat","last_seen_remote_ip_location_lon","last_seen_remote_ip_location_region","last_seen_user_agent","last_seen_version","name","online","public_key","updated_at","verified_at"],"title":"Client","type":"object"},"SantaDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SantaDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SantaDeviceListResponse","type":"object"},"PolicyPostureOr":{"additionalProperties":false,"description":"At least one applicable child expression must hold. Contains no other keys.","properties":{"or":{"items":{"$ref":"#/components/schemas/PolicyPostureNode"},"maxItems":100,"minItems":1,"type":"array"}},"required":["or"],"title":"PolicyPostureOr","type":"object"},"SophosDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/SophosDevice"}},"title":"SophosDeviceResponse","type":"object"},"SophosPostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SophosPostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SophosPostureProviderListResponse","type":"object"},"string regex device comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"string regex device comparison","type":"object"},"DefenderDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/DefenderDevice"}},"title":"DefenderDeviceResponse","type":"object"},"EmailOTPAuthProviderResponse":{"description":"Response schema for single Email OTP Auth Provider","properties":{"data":{"$ref":"#/components/schemas/EmailOTPAuthProvider"}},"title":"EmailOTPAuthProviderResponse","type":"object"},"EntraDirectoryListResponse":{"description":"Response schema for multiple Entra Directories","properties":{"data":{"description":"Entra Directory details","items":{"$ref":"#/components/schemas/EntraDirectory"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"EntraDirectoryListResponse","type":"object"},"IntunePostureProvider":{"description":"Microsoft Intune posture provider","properties":{"account_id":{"format":"uuid","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"name":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"type":"string"},"type":{"enum":["intune"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","name","synced_at","tenant_id","type","updated_at"],"title":"IntunePostureProvider","type":"object"},"PolicyUpdateRequest":{"description":"PUT/PATCH body for updating a Policy","properties":{"policy":{"$ref":"#/components/schemas/PolicyUpdateParams"}},"required":["policy"],"title":"PolicyUpdateRequest","type":"object"},"ValidationErrors":{"additionalProperties":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"items":{"$ref":"#/components/schemas/ValidationErrors"},"type":"array"},{"$ref":"#/components/schemas/ValidationErrors"}]},"description":"Map of field name to its errors: a list of messages, or the errors of a nested object or list of objects under the same shape.","example":{"name":["can't be blank"]},"title":"ValidationErrors","type":"object"},"OIDCAuthProviderListResponse":{"description":"Response schema for multiple OIDC Auth Providers","properties":{"data":{"description":"OIDC Auth Provider details","items":{"$ref":"#/components/schemas/OIDCAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"OIDCAuthProviderListResponse","type":"object"},"Gateway":{"description":"Gateway","properties":{"gateway_token_id":{"description":"ID of the token this Gateway last connected with. Null until the Gateway connects for the first time.","example":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","format":"uuid","nullable":true,"type":"string"},"id":{"description":"Gateway ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"ipv4":{"description":"Tunnel IPv4 address (see last_seen_remote_ip for the public IP)","example":"100.64.0.1","type":"string"},"ipv6":{"description":"Tunnel IPv6 address (see last_seen_remote_ip for the public IP)","example":"fd00:2021:1111::1","type":"string"},"last_seen_at":{"description":"Timestamp of the latest connection","example":"2025-01-01T00:00:00Z","format":"date-time","nullable":true,"type":"string"},"last_seen_remote_ip":{"description":"Remote IP from the latest session","example":"198.51.100.10","nullable":true,"type":"string"},"last_seen_remote_ip_location_city":{"description":"Remote IP city from the latest session","example":"San Francisco","nullable":true,"type":"string"},"last_seen_remote_ip_location_lat":{"description":"Remote IP latitude from the latest session","example":37.7749,"nullable":true,"type":"number"},"last_seen_remote_ip_location_lon":{"description":"Remote IP longitude from the latest session","example":-122.4194,"nullable":true,"type":"number"},"last_seen_remote_ip_location_region":{"description":"Remote IP region from the latest session","example":"US-CA","nullable":true,"type":"string"},"last_seen_user_agent":{"description":"User agent from the latest session","example":"Linux/6.1.0 connlib/1.5.0","nullable":true,"type":"string"},"last_seen_version":{"description":"Gateway version from the latest session","example":"1.5.0","nullable":true,"type":"string"},"name":{"description":"Gateway Name","example":"vpc-us-east","type":"string"},"online":{"description":"Online status of Gateway","example":true,"type":"boolean"},"public_key":{"description":"WireGuard public key from the latest session","example":"WdKAyoA45xJllRUYnFhI5+Y4EjSTs50MzYYHfrIhVAc=","nullable":true,"type":"string"},"rotated_at":{"description":"When the token identified by `gateway_token_id` was rotated out. Null in the normal case. When set, a replacement token has been minted and this one stays valid only until the Gateway connects with the replacement or 4 hours elapse from this timestamp, whichever comes first - so a non-null value means a rotation is pending and the Gateway has not picked it up yet.","format":"date-time","nullable":true,"type":"string"}},"required":["gateway_token_id","id","ipv4","ipv6","last_seen_at","last_seen_remote_ip","last_seen_remote_ip_location_city","last_seen_remote_ip_location_lat","last_seen_remote_ip_location_lon","last_seen_remote_ip_location_region","last_seen_user_agent","last_seen_version","name","online","public_key","rotated_at"],"title":"Gateway","type":"object"},"PoolMemberPutRequest":{"deprecated":true,"description":"PUT body replacing the pool's entire membership. Any Client not named\nhere is removed from the pool.\n","properties":{"pool_members":{"example":[{"device_id":"7cb89288-1fb3-433e-a522-2d087e45988d"},{"device_id":"cc9f561a-444d-4083-ab38-0abc6cf2314c"}],"items":{"properties":{"device_id":{"description":"Client ID","format":"uuid","type":"string"}},"required":["device_id"],"type":"object"},"type":"array"}},"required":["pool_members"],"title":"PoolMemberPutRequest","type":"object"},"GatewayToken":{"description":"Gateway Token","properties":{"id":{"description":"Gateway Token ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"token":{"description":"Gateway Token","example":"secret-token-here","type":"string"}},"required":["id","token"],"title":"GatewayToken","type":"object"},"SiteID":{"description":"Site to connect the Resource to. Required for all types except `device_pool`, which takes none. The Internet Site is reserved for the Internet Resource and cannot be used.","example":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","format":"uuid","nullable":true,"title":"SiteID","type":"string"},"string no_value device comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"string no_value device comparison","type":"object"},"Group":{"description":"Group","properties":{"directory_id":{"description":"Directory ID this group belongs to","format":"uuid","nullable":true,"type":"string"},"email":{"description":"Group email address for synced groups","nullable":true,"type":"string"},"entity_type":{"description":"Entity type","enum":["group","org_unit"],"example":"group","type":"string"},"id":{"description":"Group ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"idp_id":{"description":"Identity provider ID for synced groups","nullable":true,"type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2024-01-15T10:30:00Z","format":"date-time","type":"string"},"name":{"description":"Group Name","example":"Engineering","type":"string"},"synced_at":{"description":"Last sync timestamp for synced groups","format":"date-time","nullable":true,"type":"string"},"type":{"description":"`managed` for the built-in Everyone Group, which includes every user and admin Actor implicitly, has no explicit memberships, and cannot be updated or deleted. `static` for every other Group.","enum":["managed","static"],"example":"static","readOnly":true,"type":"string"},"updated_at":{"description":"Last update timestamp","example":"2024-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["directory_id","email","entity_type","id","idp_id","inserted_at","name","synced_at","type","updated_at"],"title":"Group","type":"object"},"json no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"json field; see PolicyPostureNode for platform applicability","enum":["defender.ip_addresses","sentinelone.cloud_providers","sentinelone.locations","sentinelone.network_interfaces","sentinelone.tags","sophos.assigned_products","sophos.device_software","sophos.encryption_volumes","sophos.group_hierarchy","sophos.health_service_details","sophos.packages","sophos.tags"],"type":"string"},"op":{"enum":["is_empty","is_not_empty","exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"json no_value provider comparison","type":"object"},"ProblemDetails":{"description":"RFC 9457 (Problem Details for HTTP APIs) error response.","properties":{"detail":{"description":"Human-readable explanation specific to this occurrence of the problem.","example":"The requested resource could not be found.","type":"string"},"status":{"description":"HTTP status code.","example":404,"type":"integer"},"title":{"description":"Short, human-readable summary of the problem type (the HTTP status phrase).","example":"Not Found","type":"string"},"type":{"description":"URI identifying the problem type. Always \"about:blank\" for now.","example":"about:blank","type":"string"}},"required":["type","title","status"],"title":"ProblemDetails","type":"object"},"datetime duration device comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["firezone.last_attested_at"],"type":"string"},"op":{"enum":["within_last","not_within_last"],"type":"string"},"value":{"description":"Positive ISO 8601 duration, such as PT24H or P30D","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime duration device comparison","type":"object"},"SantaPostureProviderListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SantaPostureProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SantaPostureProviderListResponse","type":"object"},"ResourceUpdateRequest":{"description":"PATCH/PUT body for updating a Resource. All fields are optional; omitted fields keep their current value.","properties":{"resource":{"properties":{"address":{"description":"Resource address. Required for `cidr`, `ip` and `dns`. `device_pool` and `internet` Resources ignore it.","example":"10.0.0.10","nullable":true,"type":"string"},"address_description":{"description":"Resource address description","example":"Production Database","nullable":true,"type":"string"},"device_membership_criteria":{"$ref":"#/components/schemas/DeviceMembershipCriteria"},"filters":{"description":"Traffic filters restricting the protocols and ports the Resource exposes","example":[{"ports":["5432"],"protocol":"tcp"}],"items":{"$ref":"#/components/schemas/ResourceFilter"},"type":"array"},"ip_stack":{"description":"IP stack type. Only supported for DNS resources.","enum":["ipv4_only","ipv6_only","dual"],"nullable":true,"type":"string"},"name":{"description":"Resource name","example":"Prod DB","type":"string"},"site_id":{"description":"Site to connect the Resource to. Required for all types except `device_pool`, which takes none. The Internet Site is reserved for the Internet Resource and cannot be used.","example":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","format":"uuid","nullable":true,"title":"SiteID","type":"string"},"type":{"description":"Resource type. `internet` is accepted only in the Internet Site. `device_pool` takes no `site_id` and no `address`.","enum":["cidr","ip","dns","internet","device_pool"],"example":"ip","type":"string"}},"type":"object"}},"required":["resource"],"title":"ResourceUpdateRequest","type":"object"},"ResourceFilter":{"description":"Traffic filter restricting the protocols and ports the Resource exposes","properties":{"ports":{"description":"Port numbers or ranges (e.g. `80` or `8000 - 9000`) the filter allows. Not applicable to `icmp`.","example":["80","443","8000 - 9000"],"items":{"type":"string"},"type":"array"},"protocol":{"description":"Transport protocol the filter applies to","enum":["tcp","udp","icmp"],"example":"tcp","type":"string"}},"required":["protocol"],"title":"ResourceFilter","type":"object"},"ActorCreateRequest":{"description":"POST body for creating an Actor","properties":{"actor":{"properties":{"allow_email_otp_sign_in":{"default":false,"description":"Allow Email OTP Sign In","example":false,"type":"boolean"},"email":{"description":"Actor Email. Optional for service accounts.","example":"joe.user@example.com","nullable":true,"type":"string"},"name":{"description":"Actor Name","example":"Joe User","type":"string"},"type":{"description":"Actor Type","enum":["account_user","account_admin_user","service_account"],"example":"account_admin_user","type":"string"}},"required":["name","type"],"type":"object"}},"required":["actor"],"title":"ActorCreateRequest","type":"object"},"ipv4 list device comparison":{"additionalProperties":false,"properties":{"field":{"description":"ipv4 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv4"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ipv4 list device comparison","type":"object"},"SantaPostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating a Santa posture provider. All fields are optional; omitted fields keep their current value.","properties":{"santa_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"Santa","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["santa_posture_provider"],"title":"SantaPostureProviderUpdateRequest","type":"object"},"GatewayUpdate":{"description":"Update schema for a single Gateway","properties":{"name":{"description":"Gateway Name","example":"vpc-us-east","type":"string"}},"required":["name"],"title":"GatewayUpdate","type":"object"},"MembershipPatchRequest":{"description":"PATCH body for updating Memberships","properties":{"memberships":{"properties":{"add":{"description":"Array of Actor IDs","example":["4ddfa557-7dfc-484f-894c-2024ec3fe9f7"],"items":{"description":"Actor ID","format":"uuid","type":"string"},"type":"array"},"remove":{"description":"Array of Actor IDs","example":["89d22f71-939d-442d-b148-897b730adfb4"],"items":{"description":"Actor ID","format":"uuid","type":"string"},"type":"array"}},"type":"object"}},"required":["memberships"],"title":"MembershipPatchRequest","type":"object"},"LogResponse":{"description":"Response schema for a single Log entry.","properties":{"data":{"$ref":"#/components/schemas/Log"}},"title":"LogResponse","type":"object"},"SantaPostureProviderResponse":{"properties":{"data":{"$ref":"#/components/schemas/SantaPostureProvider"}},"title":"SantaPostureProviderResponse","type":"object"},"enum_string regex provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"enum_string field; see PolicyPostureNode for platform applicability","enum":["defender.device_value","defender.exclusion_reason","defender.exposure_level","defender.health_status","defender.managed_by","defender.managed_by_status","defender.onboarding_status","defender.os_architecture","defender.os_platform","defender.risk_score","intune.attestation_status","intune.compliance_state","intune.device_enrollment_type","intune.device_registration_state","intune.exchange_access_state","intune.exchange_access_state_reason","intune.managed_device_owner_type","intune.management_agent","intune.management_state","intune.partner_reported_threat_state","iru.cellular_technology","iru.device_family","iru.external_boot_level","iru.filevault_key_type","iru.firewall_logging_option","iru.lost_mode_status","iru.platform","iru.secure_boot_level","santa.configured_client_mode","santa.last_seen_client_mode","santa.os_type","sentinelone.apps_vulnerability_status","sentinelone.console_migration_status","sentinelone.detection_state","sentinelone.installer_type","sentinelone.location_type","sentinelone.machine_type","sentinelone.mitigation_mode","sentinelone.mitigation_mode_suspicious","sentinelone.network_status","sentinelone.operational_state","sentinelone.os_arch","sentinelone.os_type","sentinelone.proxy_method","sentinelone.ranger_status","sentinelone.remote_profiling_state","sentinelone.scan_status","sophos.cloud_provider","sophos.encryption_overall_status","sophos.health_overall","sophos.health_services_status","sophos.health_threats_status","sophos.isolation_status","sophos.lockdown_status","sophos.os_platform","sophos.type"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"enum_string regex provider comparison","type":"object"},"ClientResponse":{"description":"Response schema for single Client","properties":{"data":{"$ref":"#/components/schemas/Client"}},"title":"ClientResponse","type":"object"},"DefenderPostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating a Defender posture provider. All fields are optional; omitted fields keep their current value.","properties":{"defender_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"Microsoft Defender for Endpoint","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["defender_posture_provider"],"title":"DefenderPostureProviderUpdateRequest","type":"object"},"datetime duration provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"datetime field; see PolicyPostureNode for platform applicability","enum":["defender.first_seen_at","defender.last_seen_at","intune.android_security_patch_level","intune.attestation_issued_at","intune.compliance_grace_period_expiration_at","intune.eas_activated_at","intune.enrolled_at","intune.exchange_last_successful_sync_at","intune.last_sync_at","intune.management_certificate_expires_at","iru.activation_lock_collected_at","iru.filevault_collected_at","iru.filevault_key_rotation_scheduled_at","iru.firewall_collected_at","iru.first_enrolled_at","iru.gatekeeper_collected_at","iru.inventory_collected_at","iru.last_check_in_at","iru.last_enrolled_at","iru.startup_settings_collected_at","santa.first_seen_at","santa.last_preflight_at","santa.last_sync_at","santa.rule_sync_at","santa.temporary_admin_mode_ends_at","santa.temporary_monitor_mode_ends_at","sentinelone.first_full_mode_at","sentinelone.full_disk_scan_updated_at","sentinelone.last_active_at","sentinelone.last_successful_scan_at","sentinelone.operational_state_expires_at","sentinelone.os_start_time","sentinelone.registered_at","sentinelone.remote_profiling_state_expires_at","sentinelone.scan_aborted_at","sentinelone.scan_finished_at","sentinelone.scan_started_at","sophos.last_agent_update_at","sophos.last_os_update_at","sophos.last_seen_at"],"type":"string"},"op":{"enum":["within_last","not_within_last"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Positive ISO 8601 duration, such as PT24H or P30D","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"datetime duration provider comparison","type":"object"},"PoolMember":{"deprecated":true,"description":"A Client a device pool Resource names as a member","properties":{"id":{"description":"Client ID","example":"7cb89288-1fb3-433e-a522-2d087e45988d","format":"uuid","type":"string"},"last_seen_at":{"description":"Last time the Client was seen","example":"2024-01-15T10:30:00Z","format":"date-time","nullable":true,"type":"string"},"name":{"description":"Client Name","example":"jane-laptop","type":"string"}},"required":["id","last_seen_at","name"],"title":"PoolMember","type":"object"},"integer scalar provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"integer field; see PolicyPostureNode for platform applicability","enum":["defender.os_build","defender.rbac_group_id","intune.attestation_reset_count","intune.attestation_restart_count","intune.free_storage_space_bytes","intune.physical_memory_bytes","intune.total_storage_space_bytes","santa.sip_status","sentinelone.active_threats","sentinelone.core_count","sentinelone.cpu_count","sentinelone.protected_containers_count","sentinelone.protected_pods_count","sentinelone.protected_tasks_count","sentinelone.total_memory","sophos.os_build","sophos.os_major_version","sophos.os_minor_version"],"type":"string"},"op":{"enum":["eq","ne","gt","gte","lt","lte"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"type":"integer"}},"required":["field","op","value"],"title":"integer scalar provider comparison","type":"object"},"Policy":{"description":"Policy","properties":{"conditions":{"description":"Conditions that must be satisfied for the Policy to grant access","example":[{"operator":"is_in","property":"remote_ip_location_region","values":["US","CA"]}],"items":{"$ref":"#/components/schemas/PolicyCondition"},"type":"array"},"description":{"description":"Policy Description","example":"Policy to allow something","nullable":true,"type":"string"},"flow_log_uploads_enabled":{"description":"Whether flow logs are reported for connections authorized by this Policy","example":true,"type":"boolean"},"group_id":{"description":"Group ID. Null if the Group was deleted during directory sync; it is relinked automatically if the Group reappears on a subsequent sync.","example":"88eae9ce-9179-48c6-8430-770e38dd4775","format":"uuid","nullable":true,"type":"string"},"id":{"description":"Policy ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"is_disabled":{"description":"Whether the Policy is disabled. A disabled Policy grants no access but is otherwise retained.","example":false,"type":"boolean"},"postures":{"anyOf":[{"$ref":"#/components/schemas/PolicyPostureNode"},{"enum":[null],"nullable":true,"type":"object"}],"description":"The stored device posture expression, or null when none is required. The connecting device must satisfy this expression and every entry in conditions. Returned on create, update, show, and list, including after an account downgrade.","example":{"and":[{"field":"intune.enrolled","op":"is","value":true},{"field":"intune.compliance_state","op":"is","rows":"all","value":"compliant"},{"field":"intune.last_sync_at","op":"within_last","value":"PT24H"},{"or":[{"field":"firezone.last_seen_version","op":"gte","value":"@latest"},{"not":{"field":"firezone.hostname","op":"starts_with","value":"test-"}}]}]},"nullable":true},"require_attestation":{"description":"Whether the Client must present a valid X.509 certificate from one of the account's trust anchors","example":false,"type":"boolean"},"resource_id":{"description":"Resource ID","example":"a9f60587-793c-46ae-8525-597f43ab2fb1","format":"uuid","type":"string"}},"required":["conditions","description","flow_log_uploads_enabled","group_id","id","is_disabled","postures","require_attestation","resource_id"],"title":"Policy","type":"object"},"AccountResponse":{"description":"Response schema for Account","properties":{"data":{"$ref":"#/components/schemas/Account"}},"required":["data"],"title":"AccountResponse","type":"object"},"integer no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"integer field; see PolicyPostureNode for platform applicability","enum":["defender.os_build","defender.rbac_group_id","intune.attestation_reset_count","intune.attestation_restart_count","intune.free_storage_space_bytes","intune.physical_memory_bytes","intune.total_storage_space_bytes","santa.sip_status","sentinelone.active_threats","sentinelone.core_count","sentinelone.cpu_count","sentinelone.protected_containers_count","sentinelone.protected_pods_count","sentinelone.protected_tasks_count","sentinelone.total_memory","sophos.os_build","sophos.os_major_version","sophos.os_minor_version"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"integer no_value provider comparison","type":"object"},"EmailOTPAuthProvider":{"description":"Email OTP Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"issuer":{"description":"Issuer","example":"firezone","type":"string"},"name":{"description":"Provider name","example":"Email OTP","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_session_lifetime_secs","context","id","inserted_at","is_disabled","issuer","name","portal_session_lifetime_secs","updated_at"],"title":"EmailOTPAuthProvider","type":"object"},"PolicyCondition":{"description":"A condition that must be satisfied for the Policy to grant access.\n\nAll conditions on a Policy must evaluate to true for access to be\ngranted. A condition is made up of a `property`, an `operator`, and a\nlist of `values`. The valid operators and the meaning of `values`\ndepend on the `property`:\n\n* `remote_ip_location_region` with `is_in` / `is_not_in`: `values` are\n  ISO 3166-1 alpha-2 country codes, e.g. `[\"US\", \"CA\"]`.\n* `remote_ip` with `is_in_cidr` / `is_not_in_cidr`: `values` are CIDR\n  ranges (IPv4 or IPv6), e.g. `[\"10.0.0.0/8\", \"2607:f8b0::/32\"]`.\n* `auth_provider_id` with `is_in` / `is_not_in`: `values` are\n  authentication provider IDs (UUIDs).\n* `current_utc_datetime` with `is_in_day_of_week_time_ranges`: each\n  value is a `DAY/TIME_RANGES/TIMEZONE` string where `DAY` is one of\n  `M T W R F S U` (Monday through Sunday), `TIME_RANGES` is a\n  comma-separated list of `HH:MM-HH:MM` ranges, and `TIMEZONE` is an\n  IANA timezone name, e.g. `\"M/09:00-17:00/America/New_York\"`.\n* `client_verified` with `is`: `values` is a single-element list\n  containing `\"true\"` or `\"false\"`.\n","properties":{"operator":{"description":"How the values are compared against the property","enum":["is_in","is_not_in","is_in_cidr","is_not_in_cidr","is_in_day_of_week_time_ranges","is"],"example":"is_in","type":"string"},"property":{"description":"The attribute of the connection being matched against","enum":["remote_ip_location_region","remote_ip","auth_provider_id","current_utc_datetime","client_verified"],"example":"remote_ip_location_region","type":"string"},"values":{"description":"The values to compare against, interpreted per the property","example":["US","CA"],"items":{"type":"string"},"type":"array"}},"required":["property","operator","values"],"title":"PolicyCondition","type":"object"},"DeviceMembershipOwnDevices":{"additionalProperties":false,"description":"The Clients of the Actor asking for access","example":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["actor_id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"additionalProperties":false,"properties":{"subject":{"enum":["actor_id"],"type":"string"}},"required":["subject"],"type":"object"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipOwnDevices","type":"object"},"ValidationProblemDetails":{"description":"RFC 9457 error response for request validation failures. The `validation_errors` member maps each invalid field to a list of human-readable messages. Errors on nested objects and on the items of a list are reported under the same shape, keyed by field name or list index. It is omitted when the failure is not attributable to individual fields.","properties":{"detail":{"example":"The request body failed validation.","type":"string"},"status":{"example":422,"type":"integer"},"title":{"example":"Unprocessable Content","type":"string"},"type":{"example":"about:blank","type":"string"},"validation_errors":{"$ref":"#/components/schemas/ValidationErrors"}},"required":["type","title","status"],"title":"ValidationProblemDetails","type":"object"},"Account":{"description":"Account schema","properties":{"id":{"description":"Account ID","format":"uuid","type":"string"},"key":{"description":"6-character account key","maxLength":6,"minLength":6,"type":"string"},"legal_name":{"description":"Account legal name","type":"string"},"limits":{"$ref":"#/components/schemas/AccountLimits"},"name":{"description":"Account name","type":"string"},"slug":{"description":"Account slug","type":"string"}},"required":["id","key","legal_name","limits","name","slug"],"title":"Account","type":"object"},"SophosPostureProviderUpdateRequest":{"description":"PUT/PATCH body for updating a Sophos posture provider. All fields are optional; omitted fields keep their current value.","properties":{"sophos_posture_provider":{"additionalProperties":false,"properties":{"is_disabled":{"description":"Whether the provider is disabled. A provider can be enabled only while it is verified.","example":false,"type":"boolean"},"name":{"description":"Name shown to admins, unique across the account's posture providers","example":"Sophos XDR","maxLength":255,"minLength":1,"type":"string"}},"type":"object"}},"required":["sophos_posture_provider"],"title":"SophosPostureProviderUpdateRequest","type":"object"},"DeviceMembershipCriteria":{"description":"Who a `device_pool` Resource holds. Required for a device pool, absent for every\nother Resource type.\n\nThe object has exactly one key, naming where the field lives: `device` is the\nClient row itself, and `actor_group` is a group the Client's owner belongs to.\nThe value is one rule comparing a field against either a literal or an attribute\nof the Actor asking for access. More sources can be added later without changing\nthe rules already stored.\n\nThe four rules the API accepts, and who each one holds:\n\n    {\"device\": {\"field\": \"id\", \"op\": \"in\", \"value\": [\"<client id>\", ...]}}\n    {\"device\": {\"field\": \"actor_id\", \"op\": \"eq\", \"value\": {\"subject\": \"actor_id\"}}}\n    {\"device\": {\"field\": \"account_id\", \"op\": \"eq\", \"value\": {\"subject\": \"account_id\"}}}\n    {\"actor_group\": {\"field\": \"id\", \"op\": \"eq\", \"value\": \"<group id>\"}}\n\nIn order: exactly the Clients named, the asking Actor's own Clients, every Client\nin the Account, and the Clients of every Actor in one Group.\n\nEditing the list of Clients the first rule names drops the connections to the\nClients removed and leaves every other connection through the pool alone.\n\nEvery other change to this field is a breaking update, because any Client can move\nin or out of the pool: every active connection through the pool is dropped, and\nClients reconnect to the members they may still reach.\n\nClients older than the device-pool protocol only understand a pool that names its\nmembers, so they are sent the first rule and never the other three.\n","example":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"oneOf":[{"additionalProperties":false,"description":"Exactly the Clients named","example":{"device":{"field":"id","op":"in","value":["7cb89288-1fb3-433e-a522-2d087e45988d","cc9f561a-444d-4083-ab38-0abc6cf2314c"]}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["id"],"type":"string"},"op":{"enum":["in"],"type":"string"},"value":{"description":"Client IDs","items":{"format":"uuid","type":"string"},"type":"array"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipListedDevices","type":"object"},{"additionalProperties":false,"description":"The Clients of the Actor asking for access","example":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["actor_id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"additionalProperties":false,"properties":{"subject":{"enum":["actor_id"],"type":"string"}},"required":["subject"],"type":"object"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipOwnDevices","type":"object"},{"additionalProperties":false,"description":"Every Client in the Account","example":{"device":{"field":"account_id","op":"eq","value":{"subject":"account_id"}}},"properties":{"device":{"additionalProperties":false,"properties":{"field":{"enum":["account_id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"additionalProperties":false,"properties":{"subject":{"enum":["account_id"],"type":"string"}},"required":["subject"],"type":"object"}},"required":["field","op","value"],"type":"object"}},"required":["device"],"title":"DeviceMembershipAllDevices","type":"object"},{"additionalProperties":false,"description":"The Clients of every Actor in one Group","example":{"actor_group":{"field":"id","op":"eq","value":"b3a1c6e2-5f4d-4e7a-9c8b-1d2e3f4a5b6c"}},"properties":{"actor_group":{"additionalProperties":false,"properties":{"field":{"enum":["id"],"type":"string"},"op":{"enum":["eq"],"type":"string"},"value":{"description":"Group ID","format":"uuid","type":"string"}},"required":["field","op","value"],"type":"object"}},"required":["actor_group"],"title":"DeviceMembershipActorGroup","type":"object"}],"title":"DeviceMembershipCriteria","type":"object"},"SentinelOneDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SentinelOneDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SentinelOneDeviceListResponse","type":"object"},"AccountLimits":{"description":"Account limits and usage information","properties":{"account_admin_users":{"$ref":"#/components/schemas/AccountLimit"},"adhoc_service_accounts":{"$ref":"#/components/schemas/AccountLimit"},"monthly_active_users":{"$ref":"#/components/schemas/AccountLimit"},"service_accounts":{"$ref":"#/components/schemas/AccountLimit"},"sites":{"$ref":"#/components/schemas/AccountLimit"},"users":{"$ref":"#/components/schemas/AccountLimit"}},"title":"AccountLimits","type":"object"},"GoogleAuthProvider":{"description":"Google Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_default":{"description":"Whether provider is default","example":true,"type":"boolean"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"issuer":{"description":"Issuer","example":"https://accounts.google.com","type":"string"},"name":{"description":"Provider name","example":"Google","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"},"workspace_domains":{"description":"Verified Google Workspace domains allowed to sign in. Empty for personal-only providers and existing unrestricted providers.","items":{"type":"string"},"readOnly":true,"type":"array","uniqueItems":true}},"required":["account_id","client_session_lifetime_secs","context","id","inserted_at","is_default","is_disabled","issuer","name","portal_session_lifetime_secs","updated_at","workspace_domains"],"title":"GoogleAuthProvider","type":"object"},"GroupUpdateRequest":{"description":"PATCH/PUT body for updating a Group. All fields are optional; omitted fields keep their current value.","properties":{"group":{"properties":{"name":{"description":"Group Name","example":"Engineering","type":"string"}},"type":"object"}},"required":["group"],"title":"GroupUpdateRequest","type":"object"},"GitHubAuthProviderResponse":{"description":"Response schema for single GitHub Auth Provider","properties":{"data":{"$ref":"#/components/schemas/GitHubAuthProvider"}},"title":"GitHubAuthProviderResponse","type":"object"},"APIRequestLog":{"description":"A single API Request Log entry, recording one authenticated REST API\nrequest.\n","properties":{"actor_id":{"description":"ID of the actor making the API or MCP request.","example":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"api_token_id":{"description":"ID of the API token or MCP OAuth access token used.","example":"44e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"content_length":{"description":"Value of the Content-Length request header, when present.","nullable":true,"type":"integer"},"ip":{"example":"189.172.73.1","type":"string"},"ip_city":{"example":"Mexico City","nullable":true,"type":"string"},"ip_lat":{"example":19.4326,"nullable":true,"type":"number"},"ip_lon":{"example":-99.1332,"nullable":true,"type":"number"},"ip_region":{"example":"MX","nullable":true,"type":"string"},"log_id":{"description":"Opaque identifier for the API Request Log entry. A 24-character\nlowercase hexadecimal string starting with `a`.\n","example":"a00060db0c2c8eb400000000","type":"string"},"mcp":{"additionalProperties":true,"description":"MCP execution metadata, null for REST requests. tool_name is the\nrequested tool, not proof of execution. outcome is received, rejected,\nignored, protocol_response, dispatched, succeeded, or failed. A\ndispatched outcome without completion has an unknown result. method\nand path identify the dispatched REST operation; rest_status is its\nstatus and http_status is the outer response status. No arguments or\nresponse bodies are logged. A succeeded result means the REST handler\nreturned 2xx, not necessarily that it changed data.\n","nullable":true,"type":"object"},"method":{"description":"HTTP request method.","example":"GET","type":"string"},"path":{"description":"HTTP request path.","example":"/clients","type":"string"},"request_id":{"description":"Request ID assigned by the server, for correlating with server logs.","example":"GBKkV1jUWuW2sJoAACkB","type":"string"},"timestamp":{"description":"RFC 3339 timestamp identifying when the request was received.","example":"2026-05-26T12:34:56.789Z","format":"date-time","type":"string"},"type":{"enum":["api_request"],"example":"api_request","type":"string"},"user_agent":{"example":"curl/8.7.1","nullable":true,"type":"string"}},"required":["actor_id","api_token_id","content_length","ip","ip_city","ip_lat","ip_lon","ip_region","log_id","method","mcp","path","request_id","timestamp","type","user_agent"],"title":"APIRequestLog","type":"object"},"PoolMemberListResponse":{"description":"Response schema for Pool Members","properties":{"data":{"description":"Pool member details","items":{"$ref":"#/components/schemas/PoolMember"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"PoolMemberListResponse","type":"object"},"SophosDeviceListResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/SophosDevice"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SophosDeviceListResponse","type":"object"},"version scalar device comparison":{"additionalProperties":false,"properties":{"field":{"description":"version field; see PolicyPostureNode for platform applicability","enum":["firezone.last_seen_version"],"type":"string"},"op":{"enum":["is","is_not","gt","gte","lt","lte"],"type":"string"},"value":{"description":"Segment-wise version, or @latest for firezone.last_seen_version only","maxLength":1024,"type":"string"}},"required":["field","op","value"],"title":"version scalar device comparison","type":"object"},"SiteUpdateRequest":{"description":"PATCH/PUT body for updating a Site. All fields are optional; omitted fields keep their current value.","properties":{"site":{"properties":{"name":{"description":"Site Name","example":"vpc-us-east","type":"string"}},"type":"object"}},"required":["site"],"title":"SiteUpdateRequest","type":"object"},"SentinelOnePostureProvider":{"description":"SentinelOne posture provider","properties":{"account_id":{"format":"uuid","type":"string"},"disabled_reason":{"nullable":true,"type":"string"},"error_message":{"nullable":true,"type":"string"},"errored_at":{"format":"date-time","nullable":true,"type":"string"},"id":{"format":"uuid","type":"string"},"inserted_at":{"format":"date-time","type":"string"},"is_disabled":{"type":"boolean"},"is_verified":{"type":"boolean"},"management_url":{"format":"uri","type":"string"},"name":{"type":"string"},"synced_at":{"format":"date-time","nullable":true,"type":"string"},"type":{"enum":["sentinelone"],"type":"string"},"updated_at":{"format":"date-time","type":"string"}},"required":["account_id","disabled_reason","error_message","errored_at","id","inserted_at","is_disabled","is_verified","management_url","name","synced_at","type","updated_at"],"title":"SentinelOnePostureProvider","type":"object"},"PoolMemberPatchRequest":{"deprecated":true,"description":"PATCH body for adding and removing individual pool members. Both\noperations are idempotent, and `remove` is applied before `add`, so a\nClient named in both ends up in the pool.\n","properties":{"pool_members":{"properties":{"add":{"description":"Client IDs to add to the pool","example":["7cb89288-1fb3-433e-a522-2d087e45988d"],"items":{"description":"Client ID","format":"uuid","type":"string"},"type":"array"},"remove":{"description":"Client IDs to remove from the pool","example":["cc9f561a-444d-4083-ab38-0abc6cf2314c"],"items":{"description":"Client ID","format":"uuid","type":"string"},"type":"array"}},"type":"object"}},"required":["pool_members"],"title":"PoolMemberPatchRequest","type":"object"},"FlowLog":{"description":"A single Flow Log entry, recording one network flow as accounted by one\nof its two endpoints.\n\nBoth endpoints of a flow report it independently, so a flow yields up to\ntwo entries that differ only in `role` and in the counters each side\nobserved. Every other field is oriented from the initiator regardless of\nwhich side reported the entry: `inner_src_*` is always the initiator,\n`inner_dst_*` always the responder, and `tx_*` always counts\ninitiator-to-responder traffic. `outers` records each outer network path\nin the order it was observed. Comparing the two entries of a flow is how\nreported traffic is cross-checked.\n","properties":{"log_id":{"description":"Opaque identifier for the Flow Log entry. A 24-character lowercase\nhexadecimal string starting with `f`.\n","example":"f00060db0c2c8eb400000000","type":"string"},"initiator_device_id":{"description":"ID of the Client that opened the flow. Always a Client.","example":"11e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"last_packet":{"description":"When the last packet was seen. Null while the flow is open.","example":"2026-05-26T12:33:58.000Z","format":"date-time","nullable":true,"type":"string"},"inner_dst_ip":{"description":"Tunnel IP of the responder, on both entries of the flow.","example":"10.0.0.5","type":"string"},"initiator_auth_provider_id":{"description":"ID of the Auth Provider the initiating Client authenticated with.\n","example":"7b2c1e40-9f3a-4d21-8c5e-1a2b3c4d5e6f","format":"uuid","nullable":true,"type":"string"},"initiator_device_uuid":{"description":"Device UUID reported by the initiating Client.","example":"0C4A8D24-FA9F-4E56-9B57-40D0D46A245E","nullable":true,"type":"string"},"flow_end":{"description":"RFC 3339 timestamp of when the flow ended. Null while the flow is open.","example":"2026-05-26T12:34:00.000Z","format":"date-time","nullable":true,"type":"string"},"initiator_device_identifier_for_vendor":{"description":"Vendor identifier reported by the initiating Client.","nullable":true,"type":"string"},"policy_authorization_id":{"description":"ID of the Policy Authorization that permitted the flow.","example":"6fa1d58f-0289-42e6-a3ba-7edfa46ee2d5","format":"uuid","type":"string"},"tx_bytes":{"description":"Bytes sent initiator-to-responder, as counted by the reporting side. Null while the flow is open.","example":20480,"nullable":true,"type":"integer"},"initiator_client_version":{"description":"Firezone Client version reported by the initiating Client.","example":"1.5.1","nullable":true,"type":"string"},"type":{"enum":["flow"],"example":"flow","type":"string"},"rx_packets":{"description":"Packets sent responder-to-initiator, as counted by the reporting side. Null while the flow is open.","example":100,"nullable":true,"type":"integer"},"initiator_device_os_name":{"description":"Operating system reported by the initiating Client.","example":"macOS","nullable":true,"type":"string"},"timestamp":{"description":"RFC 3339 timestamp identifying when the flow was ingested.","example":"2026-05-26T12:34:56.789Z","format":"date-time","type":"string"},"role":{"description":"Which of the two endpoints reported this entry: `initiator` means\n`initiator_device_id` wrote it, `responder` means\n`responder_device_id` did. Gateways always report `responder`;\n  Clients report either role.\n","enum":["initiator","responder"],"example":"responder","type":"string"},"tx_packets":{"description":"Packets sent initiator-to-responder, as counted by the reporting side. Null while the flow is open.","example":80,"nullable":true,"type":"integer"},"inner_dst_port":{"example":443,"type":"integer"},"initiator_device_firebase_installation_id":{"description":"Firebase installation ID reported by the initiating Client.","nullable":true,"type":"string"},"inner_src_ip":{"description":"Tunnel IP of the initiator, on both entries of the flow.","example":"100.64.0.1","type":"string"},"responder_device_id":{"description":"ID of the device the flow was opened to: the Gateway serving the\nResource, or the receiving Client for device-to-device flows.\n","example":"9d3a1c40-5f2b-4c8e-9a71-0b6d4e2f8c13","format":"uuid","type":"string"},"initiator_actor_email":{"example":"user@example.com","nullable":true,"type":"string"},"protocol":{"description":"Transport protocol of the flow.","enum":["tcp","udp"],"example":"tcp","type":"string"},"authorization_expires_at":{"description":"When the Policy Authorization expires.","example":"2026-05-26T20:29:00.000Z","format":"date-time","type":"string"},"outers":{"description":"Outer network paths in observation order. Null while the flow is open;\nthe close report replaces it with the complete array. Source IP and\nport must either both be populated or both be absent/null. The two\nentries of a flow can disagree whenever NAT or a relay sits between\nthe peers.\n","example":[{"dst_ip":"198.51.100.5","dst_port":51820,"src_ip":"203.0.113.10","src_port":51820}],"items":{"properties":{"dst_ip":{"type":"string"},"dst_port":{"type":"integer"},"path_activated_at":{"description":"RFC 3339 timestamp of when the path was selected.","format":"date-time","nullable":true,"type":"string"},"src_ip":{"nullable":true,"type":"string"},"src_port":{"nullable":true,"type":"integer"}},"required":["dst_ip","dst_port"],"type":"object"},"minItems":1,"nullable":true,"type":"array"},"resource_id":{"description":"ID of the Resource accessed.","example":"44e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inner_src_port":{"example":54321,"type":"integer"},"rx_bytes":{"description":"Bytes sent responder-to-initiator, as counted by the reporting side. Null while the flow is open.","example":102400,"nullable":true,"type":"integer"},"authorized_at":{"description":"When access to the Resource was authorized.","example":"2026-05-26T12:29:00.000Z","format":"date-time","type":"string"},"flow_start":{"description":"RFC 3339 timestamp of when the flow began. The `begin`/`end`\nwindow matches flows whose [`flow_start`, `flow_end`) range\noverlaps it.\n","example":"2026-05-26T12:30:00.000Z","format":"date-time","type":"string"},"initiator_device_os_version":{"description":"Operating system version reported by the initiating Client.","example":"15.5","nullable":true,"type":"string"},"inner_domain":{"description":"Domain name for flows to DNS Resources.","example":"gitlab.company.com","nullable":true,"type":"string"},"initiator_actor_id":{"description":"ID of the Actor who opened the flow. This is always the initiating\nClient's Actor. A Gateway has no Actor, and for device-to-device\nflows the receiving Client's own Actor is not recorded here.\n","example":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","nullable":true,"type":"string"},"initiator_actor_name":{"example":"John Doe","nullable":true,"type":"string"},"resource_address":{"description":"Resource address, when the Resource type has one.","example":"gitlab.company.com","nullable":true,"type":"string"},"initiator_device_serial":{"description":"Device serial number reported by the initiating Client.","example":"C02ABC123","nullable":true,"type":"string"},"resource_name":{"example":"GitLab","type":"string"},"policy_id":{"description":"ID of the Policy that permitted the flow.","example":"46f997d1-77c8-4936-8655-8f050dffbfa4","format":"uuid","type":"string"}},"required":["authorization_expires_at","authorized_at","flow_end","flow_start","initiator_actor_email","initiator_actor_id","initiator_actor_name","initiator_auth_provider_id","initiator_client_version","initiator_device_firebase_installation_id","initiator_device_id","initiator_device_identifier_for_vendor","initiator_device_os_name","initiator_device_os_version","initiator_device_serial","initiator_device_uuid","inner_domain","inner_dst_ip","inner_dst_port","inner_src_ip","inner_src_port","last_packet","log_id","outers","policy_authorization_id","policy_id","protocol","resource_address","resource_id","resource_name","responder_device_id","role","rx_bytes","rx_packets","timestamp","tx_bytes","tx_packets","type"],"title":"FlowLog","type":"object"},"SiteListResponse":{"description":"Response schema for multiple Sites","properties":{"data":{"description":"Site details","items":{"$ref":"#/components/schemas/Site"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"SiteListResponse","type":"object"},"PolicyListResponse":{"description":"Response schema for multiple Policies","properties":{"data":{"description":"Policy details","items":{"$ref":"#/components/schemas/Policy"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"PolicyListResponse","type":"object"},"EmailOTPAuthProviderListResponse":{"description":"Response schema for multiple Email OTP Auth Providers","properties":{"data":{"description":"Email OTP Auth Provider details","items":{"$ref":"#/components/schemas/EmailOTPAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"EmailOTPAuthProviderListResponse","type":"object"},"float no_value provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"float field; see PolicyPostureNode for platform applicability","enum":["iru.device_capacity_gb"],"type":"string"},"op":{"enum":["exists","does_not_exist"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Omit value or use null for this operator","enum":[null],"nullable":true,"type":"object"}},"required":["field","op"],"title":"float no_value provider comparison","type":"object"},"SiteCreateRequest":{"description":"POST body for creating a Site","properties":{"site":{"properties":{"name":{"description":"Site Name","example":"vpc-us-east","type":"string"}},"required":["name"],"type":"object"}},"required":["site"],"title":"SiteCreateRequest","type":"object"},"ResourceListResponse":{"description":"Response schema for multiple Resources","properties":{"data":{"description":"Resource details","items":{"$ref":"#/components/schemas/Resource"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"ResourceListResponse","type":"object"},"string list device comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["firezone.device_serial","firezone.device_uuid","firezone.hostname","firezone.identifier_for_vendor","firezone.last_attested_cert_fingerprint","firezone.last_attested_cert_serial","firezone.last_attested_device_serial","firezone.last_attested_device_uuid","firezone.last_attested_mdm_device_id","firezone.last_seen_remote_ip_location_city","firezone.last_seen_user_agent","firezone.name"],"type":"string"},"op":{"enum":["is_in","is_not_in"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"string list device comparison","type":"object"},"GitHubAuthProvider":{"description":"GitHub Auth Provider","properties":{"account_id":{"description":"Account ID","example":"5e6f7d8c-9b0a-1c2d-3e4f-5a6b7c8d9e0f","format":"uuid","type":"string"},"client_session_lifetime_secs":{"description":"Client session lifetime in seconds. Null when the account default applies.","example":604800,"nullable":true,"type":"integer"},"context":{"description":"Context","enum":["clients_and_portal","clients_only","portal_only"],"example":"clients_and_portal","type":"string"},"email_verification_method":{"description":"How a GitHub identity is first linked to an existing user by email: proof emails a one-time code first, none links on a GitHub-verified email","enum":["none","proof"],"example":"proof","type":"string"},"id":{"description":"Provider ID","example":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","format":"uuid","type":"string"},"inserted_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","format":"date-time","type":"string"},"is_default":{"description":"Whether provider is default","example":true,"type":"boolean"},"is_disabled":{"description":"Whether provider is disabled","example":false,"type":"boolean"},"issuer":{"description":"Issuer","example":"https://github.com/login/oauth","type":"string"},"name":{"description":"Provider name","example":"GitHub","type":"string"},"portal_session_lifetime_secs":{"description":"Portal session lifetime in seconds. Null when the account default applies.","example":28800,"nullable":true,"type":"integer"},"updated_at":{"description":"Update timestamp","example":"2025-01-15T10:30:00Z","format":"date-time","type":"string"}},"required":["account_id","client_session_lifetime_secs","context","email_verification_method","id","inserted_at","is_default","is_disabled","issuer","name","portal_session_lifetime_secs","updated_at"],"title":"GitHubAuthProvider","type":"object"},"string regex provider comparison":{"additionalProperties":false,"properties":{"field":{"description":"string field; see PolicyPostureNode for platform applicability","enum":["defender.computer_dns_name","defender.defender_id","defender.entra_device_id","defender.os_processor","defender.rbac_group_name","defender.version","defender.vm_cloud_provider","defender.vm_id","defender.vm_resource_id","defender.vm_subscription_id","intune.attestation_boot_revision_list_info","intune.attestation_code_integrity_policy","intune.attestation_health_status_mismatch_info","intune.attestation_identity_key","intune.attestation_operating_system_rev_list_info","intune.attestation_pcr0","intune.attestation_pcr_hash_algorithm","intune.attestation_secure_boot_config_policy_fingerprint","intune.device_category_display_name","intune.device_name","intune.eas_device_id","intune.email_address","intune.enrollment_profile_name","intune.entra_device_id","intune.ethernet_mac_address","intune.iccid","intune.imei","intune.intune_id","intune.managed_device_name","intune.manufacturer","intune.meid","intune.model","intune.notes","intune.operating_system","intune.phone_number","intune.serial_number","intune.subscriber_carrier","intune.udid","intune.user_display_name","intune.user_id","intune.user_principal_name","intune.wifi_mac_address","iru.asset_tag","iru.blueprint_id","iru.blueprint_name","iru.device_name","iru.host_name","iru.iru_id","iru.local_hostname","iru.model","iru.model_identifier","iru.model_name","iru.os_build","iru.os_name","iru.serial_number","iru.supplemental_build_version","iru.user_email","iru.user_id","iru.user_name","santa.hostname","santa.machine_model","santa.os_build","santa.primary_user","santa.santa_id","santa.serial_number","santa.temporary_admin_mode_user","sentinelone.account_name","sentinelone.ad_computer_distinguished_name","sentinelone.ad_last_user_distinguished_name","sentinelone.ad_mail","sentinelone.ad_user_principal_name","sentinelone.computer_name","sentinelone.cpu_id","sentinelone.domain","sentinelone.external_id","sentinelone.group_id","sentinelone.group_ip","sentinelone.group_name","sentinelone.last_logged_in_user_name","sentinelone.machine_sid","sentinelone.model_name","sentinelone.os_name","sentinelone.os_username","sentinelone.sentinelone_account_id","sentinelone.sentinelone_id","sentinelone.serial_number","sentinelone.site_id","sentinelone.site_name","sentinelone.storage_name","sentinelone.storage_type","sentinelone.uuid","sophos.associated_person_id","sophos.associated_person_name","sophos.associated_person_via_login","sophos.cloud_instance_id","sophos.group_id","sophos.group_name","sophos.hostname","sophos.os_name","sophos.serial_number","sophos.sophos_id"],"type":"string"},"op":{"enum":["matches","does_not_match"],"type":"string"},"rows":{"default":"any","description":"Match any or every provider row; applies to this leaf independently","enum":["any","all"],"type":"string"},"value":{"description":"Regular expression; at most 256 bytes","maxLength":256,"type":"string"}},"required":["field","op","value"],"title":"string regex provider comparison","type":"object"},"IntuneDevice":{"description":"Device synced from Microsoft Intune","properties":{"device_registration_state":{"nullable":true,"type":"string"},"attestation_operating_system_rev_list_info":{"nullable":true,"type":"string"},"entra_registered":{"nullable":true,"type":"boolean"},"attestation_boot_app_security_version":{"nullable":true,"type":"string"},"operating_system":{"nullable":true,"type":"string"},"is_supervised":{"nullable":true,"type":"boolean"},"notes":{"nullable":true,"type":"string"},"free_storage_space_bytes":{"nullable":true,"type":"integer"},"attestation_issued_at":{"format":"date-time","nullable":true,"type":"string"},"config_manager_compliance_policy":{"nullable":true,"type":"boolean"},"user_display_name":{"nullable":true,"type":"string"},"config_manager_device_configuration":{"nullable":true,"type":"boolean"},"config_manager_inventory":{"nullable":true,"type":"boolean"},"updated_at":{"format":"date-time","nullable":true,"type":"string"},"enrolled_at":{"format":"date-time","nullable":true,"type":"string"},"total_storage_space_bytes":{"nullable":true,"type":"integer"},"attestation_operating_system_kernel_debugging":{"nullable":true,"type":"boolean"},"attestation_data_execution_policy_enabled":{"nullable":true,"type":"boolean"},"ethernet_mac_address":{"nullable":true,"type":"string"},"synced_at":{"format":"date-time","nullable":false,"type":"string"},"inserted_at":{"format":"date-time","nullable":true,"type":"string"},"attestation_health_status_mismatch_info":{"nullable":true,"type":"string"},"intune_id":{"nullable":false,"type":"string"},"management_certificate_expires_at":{"format":"date-time","nullable":true,"type":"string"},"compliance_state":{"nullable":true,"type":"string"},"require_user_enrollment_approval":{"nullable":true,"type":"boolean"},"attestation_code_integrity_check_version":{"nullable":true,"type":"string"},"attestation_pcr0":{"nullable":true,"type":"string"},"attestation_boot_revision_list_info":{"nullable":true,"type":"string"},"attestation_reset_count":{"nullable":true,"type":"integer"},"attestation_safe_mode":{"nullable":true,"type":"boolean"},"managed_device_owner_type":{"nullable":true,"type":"string"},"serial_number":{"nullable":true,"type":"string"},"attestation_secure_boot":{"nullable":true,"type":"boolean"},"device_category_display_name":{"nullable":true,"type":"string"},"attestation_code_integrity_policy":{"nullable":true,"type":"string"},"attestation_virtual_secure_mode":{"nullable":true,"type":"boolean"},"last_sync_at":{"format":"date-time","nullable":true,"type":"string"},"is_encrypted":{"nullable":true,"type":"boolean"},"eas_activated":{"nullable":true,"type":"boolean"},"manufacturer":{"nullable":true,"type":"string"},"eas_activated_at":{"format":"date-time","nullable":true,"type":"string"},"account_id":{"format":"uuid","nullable":false,"type":"string"},"attestation_early_launch_anti_malware_driver_protection":{"nullable":true,"type":"boolean"},"management_agent":{"nullable":true,"type":"string"},"attestation_tpm_version":{"nullable":true,"type":"string"},"management_state":{"nullable":true,"type":"string"},"wifi_mac_address":{"nullable":true,"type":"string"},"attestation_code_integrity":{"nullable":true,"type":"boolean"},"user_principal_name":{"nullable":true,"type":"string"},"entra_device_id":{"nullable":true,"type":"string"},"android_security_patch_level":{"format":"date","nullable":true,"type":"string"},"attestation_pcr_hash_algorithm":{"nullable":true,"type":"string"},"device_enrollment_type":{"nullable":true,"type":"string"},"subscriber_carrier":{"nullable":true,"type":"string"},"enrollment_profile_name":{"nullable":true,"type":"string"},"model":{"nullable":true,"type":"string"},"attestation_boot_manager_version":{"nullable":true,"type":"string"},"partner_reported_threat_state":{"nullable":true,"type":"string"},"config_manager_modern_apps":{"nullable":true,"type":"boolean"},"user_id":{"nullable":true,"type":"string"},"jail_broken":{"nullable":true,"type":"boolean"},"eas_device_id":{"nullable":true,"type":"string"},"exchange_last_successful_sync_at":{"format":"date-time","nullable":true,"type":"string"},"attestation_bit_locker_enabled":{"nullable":true,"type":"boolean"},"attestation_content_version":{"nullable":true,"type":"string"},"exchange_access_state":{"nullable":true,"type":"string"},"managed_device_name":{"nullable":true,"type":"string"},"udid":{"nullable":true,"type":"string"},"attestation_secure_boot_config_policy_fingerprint":{"nullable":true,"type":"string"},"attestation_identity_key":{"nullable":true,"type":"string"},"attestation_boot_manager_security_version":{"nullable":true,"type":"string"},"compliance_grace_period_expiration_at":{"format":"date-time","nullable":true,"type":"string"},"exchange_access_state_reason":{"nullable":true,"type":"string"},"attestation_windows_pe":{"nullable":true,"type":"boolean"},"attestation_status":{"nullable":true,"type":"string"},"iccid":{"nullable":true,"type":"string"},"meid":{"nullable":true,"type":"string"},"attestation_supported":{"nullable":true,"type":"boolean"},"attestation_test_signing":{"nullable":true,"type":"boolean"},"attestation_boot_debugging":{"nullable":true,"type":"boolean"},"phone_number":{"nullable":true,"type":"string"},"attestation_restart_count":{"nullable":true,"type":"integer"},"imei":{"nullable":true,"type":"string"},"os_version":{"nullable":true,"type":"string"},"physical_memory_bytes":{"nullable":true,"type":"integer"},"config_manager_windows_update_for_business":{"nullable":true,"type":"boolean"},"email_address":{"nullable":true,"type":"string"},"device_name":{"nullable":true,"type":"string"},"posture_provider_id":{"format":"uuid","nullable":false,"type":"string"},"config_manager_resource_access":{"nullable":true,"type":"boolean"}},"required":["account_id","intune_id","posture_provider_id","device_name","managed_device_name","serial_number","entra_device_id","enrollment_profile_name","device_category_display_name","user_id","user_principal_name","user_display_name","email_address","operating_system","os_version","model","manufacturer","imei","meid","iccid","udid","phone_number","subscriber_carrier","wifi_mac_address","ethernet_mac_address","android_security_patch_level","total_storage_space_bytes","free_storage_space_bytes","physical_memory_bytes","compliance_state","management_state","management_agent","managed_device_owner_type","device_enrollment_type","device_registration_state","partner_reported_threat_state","jail_broken","is_encrypted","is_supervised","entra_registered","require_user_enrollment_approval","notes","eas_activated","eas_device_id","eas_activated_at","exchange_access_state","exchange_access_state_reason","exchange_last_successful_sync_at","config_manager_inventory","config_manager_modern_apps","config_manager_resource_access","config_manager_device_configuration","config_manager_compliance_policy","config_manager_windows_update_for_business","attestation_status","attestation_content_version","attestation_issued_at","attestation_identity_key","attestation_reset_count","attestation_restart_count","attestation_data_execution_policy_enabled","attestation_bit_locker_enabled","attestation_boot_manager_version","attestation_code_integrity_check_version","attestation_secure_boot","attestation_boot_debugging","attestation_operating_system_kernel_debugging","attestation_code_integrity","attestation_test_signing","attestation_safe_mode","attestation_windows_pe","attestation_early_launch_anti_malware_driver_protection","attestation_virtual_secure_mode","attestation_pcr_hash_algorithm","attestation_boot_app_security_version","attestation_boot_manager_security_version","attestation_tpm_version","attestation_pcr0","attestation_secure_boot_config_policy_fingerprint","attestation_code_integrity_policy","attestation_boot_revision_list_info","attestation_operating_system_rev_list_info","attestation_health_status_mismatch_info","attestation_supported","enrolled_at","last_sync_at","compliance_grace_period_expiration_at","management_certificate_expires_at","synced_at","inserted_at","updated_at"],"title":"IntuneDevice","type":"object"},"ipv6 list device comparison":{"additionalProperties":false,"properties":{"field":{"description":"ipv6 field; see PolicyPostureNode for platform applicability","enum":["firezone.ipv6"],"type":"string"},"op":{"enum":["is_in_cidr","is_not_in_cidr"],"type":"string"},"value":{"items":{"maxLength":1024,"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["field","op","value"],"title":"ipv6 list device comparison","type":"object"},"PostureFieldListResponse":{"description":"Response schema for every Posture Field","properties":{"data":{"description":"Posture Fields","items":{"$ref":"#/components/schemas/PostureField"},"type":"array"}},"required":["data"],"title":"PostureFieldListResponse","type":"object"},"FlowLogIngestRequest":{"additionalProperties":false,"description":"A batch of flow-log records for one policy authorization.","properties":{"flow_logs":{"items":{"$ref":"#/components/schemas/FlowLogIngestRecord"},"maxItems":10000,"type":"array"}},"required":["flow_logs"],"title":"FlowLogIngestRequest","type":"object"},"AccountLimit":{"description":"Account limit with usage information","properties":{"available":{"description":"Remaining available count","type":"integer"},"total":{"description":"Total allowed count","type":"integer"},"used":{"description":"Current usage count","type":"integer"}},"required":["used","available","total"],"title":"AccountLimit","type":"object"},"IruDeviceResponse":{"properties":{"data":{"$ref":"#/components/schemas/IruDevice"}},"title":"IruDeviceResponse","type":"object"},"OIDCAuthProviderResponse":{"description":"Response schema for single OIDC Auth Provider","properties":{"data":{"$ref":"#/components/schemas/OIDCAuthProvider"}},"title":"OIDCAuthProviderResponse","type":"object"},"GitHubAuthProviderListResponse":{"description":"Response schema for multiple GitHub Auth Providers","properties":{"data":{"description":"GitHub Auth Provider details","items":{"$ref":"#/components/schemas/GitHubAuthProvider"},"type":"array"},"metadata":{"$ref":"#/components/schemas/PaginationMetadata"}},"title":"GitHubAuthProviderListResponse","type":"object"}},"securitySchemes":{"authorization":{"scheme":"bearer","type":"http"}}},"info":{"description":"A REST API for configuring your Firezone account.\n","title":"Firezone API","version":"1.0.0"},"openapi":"3.0.0","paths":{"/groups":{"get":{"callbacks":{},"operationId":"PortalAPI.GroupController.index","parameters":[{"description":"Limit Groups returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Groups with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}},{"description":"Filter to Groups synced from this Directory. Pass an empty string to filter to unsynced (native) Groups only.","in":"query","name":"directory_id","required":false,"schema":{"type":"string"}},{"description":"Filter to Groups of this entity type","example":"group","in":"query","name":"entity_type","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupListResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Groups","tags":["Groups"]},"post":{"callbacks":{},"operationId":"PortalAPI.GroupController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupCreateRequest"}}},"description":"Group Attributes","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create Group","tags":["Groups"]}},"/actors/{actor_id}/external_identities":{"get":{"callbacks":{},"operationId":"PortalAPI.ExternalIdentityController.index","parameters":[{"description":"Actor ID","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"Limit External Identities returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalIdentityListResponse"}}},"description":"ExternalIdentity List Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List External Identities for an Actor","tags":["External Identities"]}},"/clients/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.ClientController.delete","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Client","tags":["Clients"]},"get":{"callbacks":{},"operationId":"PortalAPI.ClientController.show","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Client","tags":["Clients"]},"patch":{"callbacks":{},"operationId":"PortalAPI.ClientController.update (2)","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientPutRequest"}}},"description":"Client Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update Client","tags":["Clients"]},"put":{"callbacks":{},"operationId":"PortalAPI.ClientController.update","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientPutRequest"}}},"description":"Client Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update Client","tags":["Clients"]}},"/sites/{site_id}/gateways/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.GatewayController.delete","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}},"description":"Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Gateway","tags":["Gateways"]},"get":{"callbacks":{},"operationId":"PortalAPI.GatewayController.show","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}},"description":"Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Gateway","tags":["Gateways"]},"patch":{"callbacks":{},"description":"Renames a Gateway. Gateways otherwise self-register their configuration (name, IP addresses) on first connect and can only be renamed, not fully edited, via this endpoint.\n","operationId":"PortalAPI.GatewayController.update (2)","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayUpdateRequest"}}},"description":"Gateway attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}},"description":"Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Gateway (rename)","tags":["Gateways"]},"put":{"callbacks":{},"description":"Renames a Gateway. Gateways otherwise self-register their configuration (name, IP addresses) on first connect and can only be renamed, not fully edited, via this endpoint.\n","operationId":"PortalAPI.GatewayController.update","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayUpdateRequest"}}},"description":"Gateway attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayResponse"}}},"description":"Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Gateway (rename)","tags":["Gateways"]}},"/santa_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.SantaPostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderListResponse"}}},"description":"Santa posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Santa posture providers","tags":["Santa Posture Providers"]}},"/github_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.GitHubAuthProviderController.show","parameters":[{"description":"GitHub Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubAuthProviderResponse"}}},"description":"GitHub Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show GitHub Auth Provider","tags":["GitHub Auth Providers"]}},"/posture_fields":{"get":{"callbacks":{},"description":"Lists every field a Policy's `postures` expression can test, with its type, operators, and platforms. Filter by `provider` to keep the response small.\n\nOne node of a Policy's device posture expression. A node has exactly one\nof these shapes:\n\n* `and`: a non-empty list of nodes that must all hold.\n* `or`: a non-empty list of nodes of which at least one must hold.\n* `not`: a node that must not hold.\n* a leaf: a `field`, an `op`, and for most operators a `value`.\n\nA leaf's `field` is `<provider>.<attribute>`, such as\n`intune.compliance_state` or `firezone.last_seen_version`. The provider\nis one of `firezone` (the connecting device's own record), `intune`,\n`iru`, `defender`, `santa`, `sentinelone` or `sophos`. The attribute is\none of that provider's synced device attributes. Every synced provider also has a\nboolean `enrolled` that is true when the provider knows the device.\n\nThe attribute's type decides which operators apply and what `value`\nmust be:\n\n* strings: `is`, `is_not`, `is_in`, `is_not_in`, `contains`,\n  `does_not_contain`, `starts_with`, `ends_with`, `matches`,\n  `does_not_match`. Comparisons ignore case. `is_in` and `is_not_in`\n  take a list of strings. `matches` and `does_not_match` take a regular\n  expression.\n* booleans: `is` with `true` or `false`.\n* numbers: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`.\n* versions: `is`, `is_not`, `gt`, `gte`, `lt`, `lte`, compared segment\n  by segment, so `14.4` equals `14.4.0`.\n* timestamps: `before` and `after` with an ISO 8601 datetime such as\n  `2026-01-01T00:00:00Z`; `within_last` and `not_within_last` with an\n  ISO 8601 duration such as `PT24H` or `P30D`. A date-only attribute\n  counts as the start of that day in UTC.\n* IP addresses: `is_in_cidr` and `is_not_in_cidr` with a list of CIDRs.\n  `firezone.ipv4` takes IPv4 CIDRs only and `firezone.ipv6` IPv6 only.\n* lists of strings: `contains`, `does_not_contain`, `contains_any_of`,\n  `contains_all_of`, `is_empty`, `is_not_empty`.\n* JSON attributes: `is_empty`, `is_not_empty`.\n\nThe value `@latest` on `firezone.last_seen_version` stands for the newest\nClient release for the device's platform.\n\n`enum_string` uses the string operators; `integer` and `float` use the\nnumeric operators. `string_array` values use a single string for `contains`\nand `does_not_contain`, or a non-empty string list for `contains_any_of`\nand `contains_all_of`.\n\nEvery attribute also accepts `exists` and `does_not_exist`. These and\n`is_empty` / `is_not_empty` take no value: omit `value` or set it to null.\nMissing attributes fail every operator except `does_not_exist`, including\nnegative operators such as `is_not`. A missing provider is evaluated as\none empty row. Its synthetic `enrolled` field is false, so `enrolled is\nfalse` can explicitly match an unenrolled device. `not` negates the\nresult and can also match missing data; use a positive `enrolled is true`\ncheck when enrollment is required.\n\nLeaves that do not apply to the device's platform are removed before\nevaluation, including inside `or` and `not`. An expression with no\napplicable leaves passes. If the platform is unknown, no leaves are\nremoved. Each field lists the platforms it applies to.\nProvider `os_up_to_date` fields are computed from known OS releases;\nthey are not raw provider attributes.\n\nWhen a device matches more than one record of a provider, a leaf holds\nwhen any record satisfies it. Set `rows` to `all` to require every\nrecord. Different leaves may match different provider rows; `and` does\nnot require one row to satisfy all leaves. `rows` is not allowed for\n`firezone`, which always describes exactly one connecting device.\n\nExpressions allow at most 10 nested boolean levels and 100 leaves.\nList values contain 1–100 items; strings are at most 1024 bytes and\nregular expressions at most 256 bytes. Unknown fields, incompatible\noperators, invalid values, and exceeded limits return HTTP 422 with\na path in `validation_errors.postures`.\n","operationId":"PortalAPI.PostureFieldController.index","parameters":[{"description":"Filter to the fields of this provider","in":"query","name":"provider","required":false,"schema":{"enum":["firezone","intune","iru","defender","santa","sentinelone","sophos"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PostureFieldListResponse"}}},"description":"Posture Field Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Posture Fields","tags":["Policies"]}},"/oidc_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.OIDCAuthProviderController.index","parameters":[{"description":"Limit OIDC Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to OIDC Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OIDCAuthProviderListResponse"}}},"description":"OIDC Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List OIDC Auth Providers","tags":["OIDC Auth Providers"]}},"/sites/{site_id}/gateway_tokens/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.GatewayTokenController.delete","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Token ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletedGatewayTokenResponse"}}},"description":"Deleted Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Gateway Token","tags":["Gateway Tokens"]}},"/sentinelone_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.SentinelOnePostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderListResponse"}}},"description":"SentinelOne posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List SentinelOne posture providers","tags":["SentinelOne Posture Providers"]}},"/actors/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.ActorController.delete","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorResponse"}}},"description":"ActorResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete an Actor","tags":["Actors"]},"get":{"callbacks":{},"operationId":"PortalAPI.ActorController.show","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorResponse"}}},"description":"ActorResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Actor","tags":["Actors"]},"patch":{"callbacks":{},"description":"Updates an Actor.\n\n**Warning: changing an Actor's email signs them out and unlinks their identity providers.**\n\nIf the `email` field is changed to a different address, Firezone will:\n\n- Unlink every identity provider (Google, Okta, Entra, etc.) connected to this Actor.\n- End all active sessions for this Actor, both in the admin portal and on\n  connected Client devices. The user will be signed out immediately.\n\nThe Actor will need to sign in again through their identity provider, which\nre-links it under the new email.\n\nEmail comparison ignores case and surrounding whitespace, so changes like\n`User@Example.com` → `user@example.com` are not treated as a real change\nand will not unlink identities.\n\n**Setting `is_disabled` to `true` immediately revokes all of the Actor's\nactive Client tokens and portal sessions.** An Actor cannot disable itself.\n","operationId":"PortalAPI.ActorController.update (2)","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorUpdateRequest"}}},"description":"Actor attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorResponse"}}},"description":"ActorResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Actor","tags":["Actors"]},"put":{"callbacks":{},"description":"Updates an Actor.\n\n**Warning: changing an Actor's email signs them out and unlinks their identity providers.**\n\nIf the `email` field is changed to a different address, Firezone will:\n\n- Unlink every identity provider (Google, Okta, Entra, etc.) connected to this Actor.\n- End all active sessions for this Actor, both in the admin portal and on\n  connected Client devices. The user will be signed out immediately.\n\nThe Actor will need to sign in again through their identity provider, which\nre-links it under the new email.\n\nEmail comparison ignores case and surrounding whitespace, so changes like\n`User@Example.com` → `user@example.com` are not treated as a real change\nand will not unlink identities.\n\n**Setting `is_disabled` to `true` immediately revokes all of the Actor's\nactive Client tokens and portal sessions.** An Actor cannot disable itself.\n","operationId":"PortalAPI.ActorController.update","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorUpdateRequest"}}},"description":"Actor attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorResponse"}}},"description":"ActorResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Actor","tags":["Actors"]}},"/clients/{id}/verify":{"put":{"callbacks":{},"operationId":"PortalAPI.ClientController.verify","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Verify Client","tags":["Clients"]}},"/actors/{actor_id}/client_tokens":{"delete":{"callbacks":{},"operationId":"PortalAPI.ClientTokenController.delete_all","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletedClientTokensResponse"}}},"description":"Deleted Client Tokens Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete all Client Tokens for service_account, account_user, or account_admin_user actors","tags":["Client Tokens"]},"get":{"callbacks":{},"operationId":"PortalAPI.ClientTokenController.index","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"Limit Client Tokens returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientTokenListResponse"}}},"description":"Client Token List Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Client Tokens for service_account, account_user, or account_admin_user actors","tags":["Client Tokens"]},"post":{"callbacks":{},"operationId":"PortalAPI.ClientTokenController.create","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientTokenRequest"}}},"description":"Client Token Attributes","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientTokenCreateResponse"}}},"description":"Client Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create a Client Token for a Service Account","tags":["Client Tokens"]}},"/actors/{actor_id}/client_tokens/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.ClientTokenController.delete","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"Client Token ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletedClientTokenResponse"}}},"description":"Deleted Client Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Client Token","tags":["Client Tokens"]},"get":{"callbacks":{},"operationId":"PortalAPI.ClientTokenController.show","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"Client Token ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientTokenShowResponse"}}},"description":"Client Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a Client Token for service_account, account_user, or account_admin_user actors","tags":["Client Tokens"]}},"/email_otp_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.EmailOTPAuthProviderController.index","parameters":[{"description":"Limit Email OTP Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Email OTP Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailOTPAuthProviderListResponse"}}},"description":"Email OTP Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Email OTP Auth Providers","tags":["Email OTP Auth Providers"]}},"/entra_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.EntraAuthProviderController.index","parameters":[{"description":"Limit Entra Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Entra Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntraAuthProviderListResponse"}}},"description":"Entra Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Entra Auth Providers","tags":["Entra Auth Providers"]}},"/iru_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes an Iru posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled Iru\nprovider is left, `iru.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.IruPostureProviderController.delete","parameters":[{"description":"Iru posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderResponse"}}},"description":"Iru posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete an Iru posture provider","tags":["Iru Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.IruPostureProviderController.show","parameters":[{"description":"Iru posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderResponse"}}},"description":"Iru posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show an Iru posture provider","tags":["Iru Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables an Iru posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Iru provider is left, `iru.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.IruPostureProviderController.update (2)","parameters":[{"description":"Iru posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderUpdateRequest"}}},"description":"Iru posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderResponse"}}},"description":"Iru posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Iru posture provider","tags":["Iru Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables an Iru posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Iru provider is left, `iru.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.IruPostureProviderController.update","parameters":[{"description":"Iru posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderUpdateRequest"}}},"description":"Iru posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderResponse"}}},"description":"Iru posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Iru posture provider","tags":["Iru Posture Providers"]}},"/sites":{"get":{"callbacks":{},"operationId":"PortalAPI.SiteController.index","parameters":[{"description":"Limit Sites returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to the Site with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteListResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Sites","tags":["Sites"]},"post":{"callbacks":{},"operationId":"PortalAPI.SiteController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteCreateRequest"}}},"description":"Site Attributes","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create Site","tags":["Sites"]}},"/sites/{id}":{"delete":{"callbacks":{},"description":"Deletes a Site. Deleting is not blocked when the Site still has Gateways or Resources.\n\nThe Site's Gateways, Gateway tokens, and Resources are deleted with it. Every Policy for those Resources is deleted too, and Clients lose access to them right away. The system-managed Internet Site cannot be deleted.\n","operationId":"PortalAPI.SiteController.delete","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Site","tags":["Sites"]},"get":{"callbacks":{},"operationId":"PortalAPI.SiteController.show","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Site","tags":["Sites"]},"patch":{"callbacks":{},"operationId":"PortalAPI.SiteController.update (2)","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteUpdateRequest"}}},"description":"Site Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Site","tags":["Sites"]},"put":{"callbacks":{},"operationId":"PortalAPI.SiteController.update","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteUpdateRequest"}}},"description":"Site Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SiteResponse"}}},"description":"Site Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Site","tags":["Sites"]}},"/google_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.GoogleAuthProviderController.index","parameters":[{"description":"Limit Google Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Google Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GoogleAuthProviderListResponse"}}},"description":"Google Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Google Auth Providers","tags":["Google Auth Providers"]}},"/policies/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.PolicyController.delete","parameters":[{"description":"Policy ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Policy","tags":["Policies"]},"get":{"callbacks":{},"operationId":"PortalAPI.PolicyController.show","parameters":[{"description":"Policy ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Policy","tags":["Policies"]},"patch":{"callbacks":{},"description":"Updates a Policy.\n\nA Policy is enabled or disabled through the `is_disabled` field. Disabling a Policy stops it granting access without deleting it.\n\nSet `policy.postures` to replace the entire device posture expression.\nOmit it to preserve existing postures. Send `{\"policy\":{\"postures\":null}}`\nto remove the posture requirement; clearing is allowed even after an\naccount downgrade. Other policy attributes, including `conditions`, are\nunchanged when omitted. Conditions and postures must both hold.\n\nNon-empty `conditions` require the `policy_conditions` entitlement or\nreturn 403. Sending an empty list to remove them is allowed even after\nan account downgrade.\n\nNon-null postures require the `device_posture` entitlement (Enterprise)\nor return 403. Invalid expressions return 422 with a path in\n`validation_errors.postures`. See `PolicyPostureNode` for the expression\ngrammar, complete field catalog, operator types, platform behavior, and\nlimits. `GET /posture_fields` lists the same fields as structured data.\nChanging postures revokes this policy's active authorizations,\ninterrupting affected connections until they are reauthorized.\n","operationId":"PortalAPI.PolicyController.update (2)","parameters":[{"description":"Policy ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyUpdateRequest"}}},"description":"Policy Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Policy","tags":["Policies"]},"put":{"callbacks":{},"description":"Updates a Policy.\n\nA Policy is enabled or disabled through the `is_disabled` field. Disabling a Policy stops it granting access without deleting it.\n\nSet `policy.postures` to replace the entire device posture expression.\nOmit it to preserve existing postures. Send `{\"policy\":{\"postures\":null}}`\nto remove the posture requirement; clearing is allowed even after an\naccount downgrade. Other policy attributes, including `conditions`, are\nunchanged when omitted. Conditions and postures must both hold.\n\nNon-empty `conditions` require the `policy_conditions` entitlement or\nreturn 403. Sending an empty list to remove them is allowed even after\nan account downgrade.\n\nNon-null postures require the `device_posture` entitlement (Enterprise)\nor return 403. Invalid expressions return 422 with a path in\n`validation_errors.postures`. See `PolicyPostureNode` for the expression\ngrammar, complete field catalog, operator types, platform behavior, and\nlimits. `GET /posture_fields` lists the same fields as structured data.\nChanging postures revokes this policy's active authorizations,\ninterrupting affected connections until they are reauthorized.\n","operationId":"PortalAPI.PolicyController.update","parameters":[{"description":"Policy ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyUpdateRequest"}}},"description":"Policy Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Policy","tags":["Policies"]}},"/intune_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes an Intune posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled Intune\nprovider is left, `intune.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.IntunePostureProviderController.delete","parameters":[{"description":"Intune posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderResponse"}}},"description":"Intune posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete an Intune posture provider","tags":["Intune Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.IntunePostureProviderController.show","parameters":[{"description":"Intune posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderResponse"}}},"description":"Intune posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show an Intune posture provider","tags":["Intune Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables an Intune posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Intune provider is left, `intune.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.IntunePostureProviderController.update (2)","parameters":[{"description":"Intune posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderUpdateRequest"}}},"description":"Intune posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderResponse"}}},"description":"Intune posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Intune posture provider","tags":["Intune Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables an Intune posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Intune provider is left, `intune.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.IntunePostureProviderController.update","parameters":[{"description":"Intune posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderUpdateRequest"}}},"description":"Intune posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderResponse"}}},"description":"Intune posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Intune posture provider","tags":["Intune Posture Providers"]}},"/x509_auth_provider":{"get":{"callbacks":{},"operationId":"PortalAPI.X509AuthProviderController.show","parameters":[],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/X509AuthProviderResponse"}}},"description":"X.509 Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show X.509 Auth Provider","tags":["X.509 Auth Providers"]}},"/resources":{"get":{"callbacks":{},"operationId":"PortalAPI.ResourceController.index","parameters":[{"description":"Limit Resources returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Resources with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}},{"description":"Filter to Resources of this type: cidr, ip, dns, or device_pool.","example":"dns","in":"query","name":"type","required":false,"schema":{"type":"string"}},{"description":"Filter to Resources connected to this Site","in":"query","name":"site_id","required":false,"schema":{"type":"string"}},{"description":"Filter to Resources with this exact address","in":"query","name":"address","required":false,"schema":{"type":"string"}},{"description":"Filter to Resources with this exact ip_stack","example":"dual","in":"query","name":"ip_stack","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"examples":{"resources":{"summary":"An IP Resource and a device pool","value":{"data":[{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"},{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}],"metadata":{"count":2,"limit":10,"next_page":null,"prev_page":null}}}},"schema":{"$ref":"#/components/schemas/ResourceListResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Resources","tags":["Resources"]},"post":{"callbacks":{},"operationId":"PortalAPI.ResourceController.create","parameters":[],"requestBody":{"content":{"application/json":{"examples":{"actor_group":{"summary":"Device pool of the Clients of every Actor in one Group","value":{"resource":{"device_membership_criteria":{"actor_group":{"field":"id","op":"eq","value":"b3a1c6e2-5f4d-4e7a-9c8b-1d2e3f4a5b6c"}},"name":"Engineering Devices","type":"device_pool"}}},"all_devices":{"summary":"Device pool of every Client in the Account","value":{"resource":{"device_membership_criteria":{"device":{"field":"account_id","op":"eq","value":{"subject":"account_id"}}},"name":"All Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"resource":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}},"listed_devices":{"summary":"Device pool of the Clients named","value":{"resource":{"device_membership_criteria":{"device":{"field":"id","op":"in","value":["7cb89288-1fb3-433e-a522-2d087e45988d","cc9f561a-444d-4083-ab38-0abc6cf2314c"]}},"name":"Build Machines","type":"device_pool"}}},"own_devices":{"summary":"Device pool of the asking Actor's own Clients","value":{"resource":{"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"name":"My Devices","type":"device_pool"}}}},"schema":{"$ref":"#/components/schemas/ResourceCreateRequest"}}},"description":"Resource Attributes","required":true},"responses":{"201":{"content":{"application/json":{"examples":{"device_pool":{"summary":"Device pool","value":{"data":{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"data":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}}},"schema":{"$ref":"#/components/schemas/ResourceResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create Resource","tags":["Resources"]}},"/actors/{actor_id}/external_identities/{id}":{"delete":{"callbacks":{},"operationId":"PortalAPI.ExternalIdentityController.delete","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"External Identity ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalIdentityResponse"}}},"description":"ExternalIdentity Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete an External Identity","tags":["External Identities"]},"get":{"callbacks":{},"operationId":"PortalAPI.ExternalIdentityController.show","parameters":[{"description":"Actor ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"actor_id","required":true,"schema":{"type":"string"}},{"description":"External Identity ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalIdentityResponse"}}},"description":"ExternalIdentity Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show External Identity","tags":["External Identities"]}},"/sentinelone_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.SentinelOneDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOneDeviceListResponse"}}},"description":"SentinelOne device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced SentinelOne devices","tags":["SentinelOne Devices"]}},"/okta_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.OktaAuthProviderController.index","parameters":[{"description":"Limit Okta Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Okta Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OktaAuthProviderListResponse"}}},"description":"Okta Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Okta Auth Providers","tags":["Okta Auth Providers"]}},"/defender_devices/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.DefenderDeviceController.show","parameters":[{"description":"Synced Defender device ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderDeviceResponse"}}},"description":"Defender device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced Defender device","tags":["Defender Devices"]}},"/intune_devices/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.IntuneDeviceController.show","parameters":[{"description":"Synced Intune device ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntuneDeviceResponse"}}},"description":"Intune device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced Intune device","tags":["Intune Devices"]}},"/sophos_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.SophosPostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderListResponse"}}},"description":"Sophos posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Sophos posture providers","tags":["Sophos Posture Providers"]}},"/defender_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes a Defender posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled Defender\nprovider is left, `defender.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.DefenderPostureProviderController.delete","parameters":[{"description":"Defender posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderResponse"}}},"description":"Defender posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Defender posture provider","tags":["Defender Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.DefenderPostureProviderController.show","parameters":[{"description":"Defender posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderResponse"}}},"description":"Defender posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a Defender posture provider","tags":["Defender Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables a Defender posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Defender provider is left, `defender.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.DefenderPostureProviderController.update (2)","parameters":[{"description":"Defender posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderUpdateRequest"}}},"description":"Defender posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderResponse"}}},"description":"Defender posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Defender posture provider","tags":["Defender Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables a Defender posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Defender provider is left, `defender.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.DefenderPostureProviderController.update","parameters":[{"description":"Defender posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderUpdateRequest"}}},"description":"Defender posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderResponse"}}},"description":"Defender posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Defender posture provider","tags":["Defender Posture Providers"]}},"/intune_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.IntunePostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntunePostureProviderListResponse"}}},"description":"Intune posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Intune posture providers","tags":["Intune Posture Providers"]}},"/groups/{group_id}/memberships":{"get":{"callbacks":{},"description":"Lists the Actors in a Group.\n\nThe built-in Everyone Group has no explicit memberships. For it, this lists every user and admin Actor in the account, which is who the Group grants access to. Service accounts and API clients are never members of the Everyone Group.\n","operationId":"PortalAPI.MembershipController.index","parameters":[{"description":"ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"group_id","required":true,"schema":{"type":"string"}},{"description":"Limit Memberships returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipListResponse"}}},"description":"Membership Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Memberships","tags":["Memberships"]},"patch":{"callbacks":{},"description":"Adds and/or removes individual Actors, leaving every other member of the\nGroup untouched.\n\nBoth operations are idempotent: adding an Actor already in the Group and\nremoving one that isn't are both no-ops. `remove` is applied before `add`,\nso an Actor named in both ends up in the Group. Retrying a request that may\nalready have been applied is therefore safe.\n\nRepeating an Actor within `add` or `remove` is not an error; both lists are\ndeduplicated. `actor_ids` in the response is sorted.\n","operationId":"PortalAPI.MembershipController.update_patch","parameters":[{"description":"ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"group_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipPatchRequest"}}},"description":"Membership Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipResponse"}}},"description":"Membership Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update an Membership","tags":["Memberships"]},"put":{"callbacks":{},"description":"Replaces the Group's entire membership list with the given Actors.\n\nAny Actor not named in the request is removed from the Group. To add or\nremove individual Actors without disturbing the rest, use `PATCH`.\n\nMembers that are not changing keep their membership rows, so a replace that\nleaves the list untouched is a no-op rather than a full rewrite.\n\nRepeating an Actor in the request body is not an error; the list is\ndeduplicated. `actor_ids` in the response is sorted, not returned in\nrequest order.\n","operationId":"PortalAPI.MembershipController.update_put","parameters":[{"description":"ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"group_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipPutRequest"}}},"description":"Membership Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipResponse"}}},"description":"Membership Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update Memberships","tags":["Memberships"]}},"/google_directories":{"get":{"callbacks":{},"operationId":"PortalAPI.GoogleDirectoryController.index","parameters":[{"description":"Limit Google Directories returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Google Directories with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GoogleDirectoryListResponse"}}},"description":"Google Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Google Directories","tags":["Google Directories"]}},"/sentinelone_devices/{sentinelone_agent}":{"get":{"callbacks":{},"operationId":"PortalAPI.SentinelOneDeviceController.show","parameters":[{"description":"Synced SentinelOne agent UUID","in":"path","name":"sentinelone_agent","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOneDeviceResponse"}}},"description":"SentinelOne device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced SentinelOne device","tags":["SentinelOne Devices"]}},"/santa_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes a Santa posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled Santa\nprovider is left, `santa.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.SantaPostureProviderController.delete","parameters":[{"description":"Santa posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderResponse"}}},"description":"Santa posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Santa posture provider","tags":["Santa Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.SantaPostureProviderController.show","parameters":[{"description":"Santa posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderResponse"}}},"description":"Santa posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a Santa posture provider","tags":["Santa Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables a Santa posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Santa provider is left, `santa.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SantaPostureProviderController.update (2)","parameters":[{"description":"Santa posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderUpdateRequest"}}},"description":"Santa posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderResponse"}}},"description":"Santa posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Santa posture provider","tags":["Santa Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables a Santa posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Santa provider is left, `santa.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SantaPostureProviderController.update","parameters":[{"description":"Santa posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderUpdateRequest"}}},"description":"Santa posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaPostureProviderResponse"}}},"description":"Santa posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Santa posture provider","tags":["Santa Posture Providers"]}},"/google_directories/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.GoogleDirectoryController.show","parameters":[{"description":"Google Directory ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GoogleDirectoryResponse"}}},"description":"Google Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Google Directory","tags":["Google Directories"]}},"/santa_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.SantaDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaDeviceListResponse"}}},"description":"Santa device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced Santa devices","tags":["Santa Devices"]}},"/clients/{id}/unverify":{"put":{"callbacks":{},"operationId":"PortalAPI.ClientController.unverify","parameters":[{"description":"Client ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Unverify Client","tags":["Clients"]}},"/resources/{id}":{"delete":{"callbacks":{},"description":"Deletes a Resource. Deleting is not blocked when Policies still use the Resource.\n\nEvery Policy for the Resource is deleted with it, and Clients lose access to the Resource right away. Use `GET /policies?resource_id=...` first to see which Policies will be deleted. The Internet Resource cannot be deleted.\n","operationId":"PortalAPI.ResourceController.delete","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"examples":{"device_pool":{"summary":"Device pool","value":{"data":{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"data":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}}},"schema":{"$ref":"#/components/schemas/ResourceResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete Resource","tags":["Resources"]},"get":{"callbacks":{},"operationId":"PortalAPI.ResourceController.show","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"examples":{"device_pool":{"summary":"Device pool","value":{"data":{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"data":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}}},"schema":{"$ref":"#/components/schemas/ResourceResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Resource","tags":["Resources"]},"patch":{"callbacks":{},"operationId":"PortalAPI.ResourceController.update (2)","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"convert_to_device_pool":{"summary":"Convert a Resource to a device pool","value":{"resource":{"device_membership_criteria":{"actor_group":{"field":"id","op":"eq","value":"b3a1c6e2-5f4d-4e7a-9c8b-1d2e3f4a5b6c"}},"type":"device_pool"}}},"rename":{"summary":"Rename a Resource","value":{"resource":{"name":"Prod DB (primary)"}}},"set_pool_members":{"summary":"Replace the Clients a device pool names","value":{"resource":{"device_membership_criteria":{"device":{"field":"id","op":"in","value":["7cb89288-1fb3-433e-a522-2d087e45988d","cc9f561a-444d-4083-ab38-0abc6cf2314c"]}}}}}},"schema":{"$ref":"#/components/schemas/ResourceUpdateRequest"}}},"description":"Resource Attributes","required":true},"responses":{"200":{"content":{"application/json":{"examples":{"device_pool":{"summary":"Device pool","value":{"data":{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"data":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}}},"schema":{"$ref":"#/components/schemas/ResourceResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update Resource","tags":["Resources"]},"put":{"callbacks":{},"operationId":"PortalAPI.ResourceController.update","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"examples":{"convert_to_device_pool":{"summary":"Convert a Resource to a device pool","value":{"resource":{"device_membership_criteria":{"actor_group":{"field":"id","op":"eq","value":"b3a1c6e2-5f4d-4e7a-9c8b-1d2e3f4a5b6c"}},"type":"device_pool"}}},"rename":{"summary":"Rename a Resource","value":{"resource":{"name":"Prod DB (primary)"}}},"set_pool_members":{"summary":"Replace the Clients a device pool names","value":{"resource":{"device_membership_criteria":{"device":{"field":"id","op":"in","value":["7cb89288-1fb3-433e-a522-2d087e45988d","cc9f561a-444d-4083-ab38-0abc6cf2314c"]}}}}}},"schema":{"$ref":"#/components/schemas/ResourceUpdateRequest"}}},"description":"Resource Attributes","required":true},"responses":{"200":{"content":{"application/json":{"examples":{"device_pool":{"summary":"Device pool","value":{"data":{"address":null,"address_description":null,"device_membership_criteria":{"device":{"field":"actor_id","op":"eq","value":{"subject":"actor_id"}}},"filters":[],"id":"5f0d3c1a-8e2b-4b7d-9a6c-3e4f5a6b7c8d","name":"My Devices","type":"device_pool"}}},"ip":{"summary":"IP Resource","value":{"data":{"address":"10.0.0.10","address_description":"Production Database","filters":[{"ports":["5432"],"protocol":"tcp"}],"id":"42a7f82f-831a-4a9d-8f17-c66c2bb6e205","name":"Prod DB","site_id":"0642e09d-b3a2-47e4-9cd1-c2195faeeb67","type":"ip"}}}},"schema":{"$ref":"#/components/schemas/ResourceResponse"}}},"description":"Resource Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update Resource","tags":["Resources"]}},"/entra_directories":{"get":{"callbacks":{},"operationId":"PortalAPI.EntraDirectoryController.index","parameters":[{"description":"Limit Entra Directories returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Entra Directories with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntraDirectoryListResponse"}}},"description":"Entra Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Entra Directories","tags":["Entra Directories"]}},"/entra_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.EntraAuthProviderController.show","parameters":[{"description":"Entra Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntraAuthProviderResponse"}}},"description":"Entra Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Entra Auth Provider","tags":["Entra Auth Providers"]}},"/clients":{"get":{"callbacks":{},"operationId":"PortalAPI.ClientController.index","parameters":[{"description":"Limit Clients returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Clients with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}},{"description":"Filter to the Client with this exact Firezone ID","in":"query","name":"firezone_id","required":false,"schema":{"type":"string"}},{"description":"Filter to Clients owned by this Actor","in":"query","name":"actor_id","required":false,"schema":{"format":"uuid","type":"string"}},{"description":"Filter to Clients that are connected (`true`) or not connected (`false`) right now","in":"query","name":"online","required":false,"schema":{"type":"boolean"}},{"description":"Filter to Clients whose latest connection started before this RFC 3339 timestamp.\nA Client with no recorded `last_seen_at` counts as last seen when it was created.\n`last_seen_at` is set when a Client connects, so a Client that has stayed\nconnected since before this time also matches; add `online=false` to leave it out.\n","example":"2026-01-01T00:00:00Z","in":"query","name":"last_seen_before","required":false,"schema":{"format":"date-time","type":"string"}},{"description":"Filter to Clients whose latest connection started at or after this RFC 3339\ntimestamp. A Client with no recorded `last_seen_at` counts as last seen when it\nwas created.\n","example":"2026-01-01T00:00:00Z","in":"query","name":"last_seen_after","required":false,"schema":{"format":"date-time","type":"string"}},{"description":"Filter to Clients of this type, read from the user agent of the latest session:\n`headless` (Linux and Windows headless Clients), `gui` (Linux and Windows GUI\nClients), `apple` (macOS and iOS), or `android`. Clients with no recorded user\nagent match no type.\n","in":"query","name":"client_type","required":false,"schema":{"enum":["headless","gui","apple","android"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientsResponse"}}},"description":"Client Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Clients","tags":["Clients"]}},"/account":{"get":{"callbacks":{},"operationId":"PortalAPI.AccountController.show","parameters":[],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountResponse"}}},"description":"AccountResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Account","tags":["Account"]}},"/sophos_devices/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.SophosDeviceController.show","parameters":[{"description":"Synced Sophos endpoint ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosDeviceResponse"}}},"description":"Sophos device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced Sophos device","tags":["Sophos Devices"]}},"/sites/{site_id}/gateway_tokens":{"delete":{"callbacks":{},"operationId":"PortalAPI.GatewayTokenController.delete_all","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeletedGatewayTokensResponse"}}},"description":"Deleted Tokens Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete all Gateway Tokens for a Site","tags":["Gateway Tokens"]},"post":{"callbacks":{},"deprecated":true,"description":"Deprecated: creates a multi-owner Site token shared by all of a Site's gateways. Prefer creating a single-owner token for a specific gateway via `POST /sites/{site_id}/gateways/{gateway_id}/token`.","operationId":"PortalAPI.GatewayTokenController.create","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayTokenResponse"}}},"description":"New Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create a Gateway Token","tags":["Gateway Tokens"]}},"/iru_devices/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.IruDeviceController.show","parameters":[{"description":"Synced Iru device ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruDeviceResponse"}}},"description":"Iru device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced Iru device","tags":["Iru Devices"]}},"/intune_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.IntuneDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntuneDeviceListResponse"}}},"description":"Intune device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced Intune devices","tags":["Intune Devices"]}},"/resources/{resource_id}/pool_members":{"get":{"callbacks":{},"deprecated":true,"description":"Deprecated. Read `device_membership_criteria` on the Resource instead, which\nalso describes the pools that pick their members by a rule.\n\nLists the Clients a `device_pool` Resource names as its members.\n\nReturns 400 for any other Resource type, and for a device pool whose members are\npicked by a rule rather than named.\n","operationId":"PortalAPI.PoolMemberController.index","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"resource_id","required":true,"schema":{"type":"string"}},{"description":"Limit Pool Members returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoolMemberListResponse"}}},"description":"Pool Member Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Pool Members","tags":["Pool Members"]},"patch":{"callbacks":{},"deprecated":true,"description":"Deprecated. Write `device_membership_criteria` on the Resource instead.\n\nAdds and/or removes individual Clients, leaving every other member of the\npool untouched.\n\nBoth operations are idempotent: adding a Client already in the pool and\nremoving one that isn't are both no-ops. `remove` is applied before `add`,\nso a Client named in both ends up in the pool.\n\nRemoving a Client drops its connections through the pool. Every other connection\nthrough the pool is left alone.\n","operationId":"PortalAPI.PoolMemberController.update_patch","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"resource_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoolMemberPatchRequest"}}},"description":"Pool Member Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoolMemberResponse"}}},"description":"Pool Member Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Add or Remove Pool Members","tags":["Pool Members"]},"put":{"callbacks":{},"deprecated":true,"description":"Deprecated. Write `device_membership_criteria` on the Resource instead.\n\nReplaces the Resource's entire membership list with the given Clients.\n\nAny Client not named in the request is removed from the pool. To add or\nremove individual Clients without disturbing the rest, use `PATCH`.\n\nRemoving a Client drops its connections through the pool. Every other connection\nthrough the pool is left alone.\n","operationId":"PortalAPI.PoolMemberController.update_put","parameters":[{"description":"Resource ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"resource_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoolMemberPutRequest"}}},"description":"Pool Member Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PoolMemberResponse"}}},"description":"Pool Member Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Replace Pool Members","tags":["Pool Members"]}},"/github_auth_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.GitHubAuthProviderController.index","parameters":[{"description":"Limit GitHub Auth Providers returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to GitHub Auth Providers with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubAuthProviderListResponse"}}},"description":"GitHub Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List GitHub Auth Providers","tags":["GitHub Auth Providers"]}},"/entra_directories/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.EntraDirectoryController.show","parameters":[{"description":"Entra Directory ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntraDirectoryResponse"}}},"description":"Entra Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Entra Directory","tags":["Entra Directories"]}},"/sentinelone_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes a SentinelOne posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled SentinelOne\nprovider is left, `sentinelone.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.SentinelOnePostureProviderController.delete","parameters":[{"description":"SentinelOne posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderResponse"}}},"description":"SentinelOne posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a SentinelOne posture provider","tags":["SentinelOne Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.SentinelOnePostureProviderController.show","parameters":[{"description":"SentinelOne posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderResponse"}}},"description":"SentinelOne posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a SentinelOne posture provider","tags":["SentinelOne Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables a SentinelOne posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled SentinelOne provider is left, `sentinelone.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SentinelOnePostureProviderController.update (2)","parameters":[{"description":"SentinelOne posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderUpdateRequest"}}},"description":"SentinelOne posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderResponse"}}},"description":"SentinelOne posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a SentinelOne posture provider","tags":["SentinelOne Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables a SentinelOne posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled SentinelOne provider is left, `sentinelone.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SentinelOnePostureProviderController.update","parameters":[{"description":"SentinelOne posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderUpdateRequest"}}},"description":"SentinelOne posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SentinelOnePostureProviderResponse"}}},"description":"SentinelOne posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a SentinelOne posture provider","tags":["SentinelOne Posture Providers"]}},"/email_otp_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.EmailOTPAuthProviderController.show","parameters":[{"description":"Email OTP Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailOTPAuthProviderResponse"}}},"description":"Email OTP Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Email OTP Auth Provider","tags":["Email OTP Auth Providers"]}},"/okta_directories/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.OktaDirectoryController.show","parameters":[{"description":"Okta Directory ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OktaDirectoryResponse"}}},"description":"Okta Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Okta Directory","tags":["Okta Directories"]}},"/iru_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.IruDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruDeviceListResponse"}}},"description":"Iru device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced Iru devices","tags":["Iru Devices"]}},"/groups/{id}":{"delete":{"callbacks":{},"description":"Deletes a Group and its memberships.\n\nPolicies that grant the Group are kept, but their `group_id` becomes null and they grant no access. A Policy for a synced Group is linked again automatically if the Group reappears on a later directory sync. The built-in Everyone Group cannot be deleted.\n","operationId":"PortalAPI.GroupController.delete","parameters":[{"description":"Group ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Group","tags":["Groups"]},"get":{"callbacks":{},"operationId":"PortalAPI.GroupController.show","parameters":[{"description":"Group ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Group","tags":["Groups"]},"patch":{"callbacks":{},"operationId":"PortalAPI.GroupController.update (2)","parameters":[{"description":"Group ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupUpdateRequest"}}},"description":"Group Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Group","tags":["Groups"]},"put":{"callbacks":{},"operationId":"PortalAPI.GroupController.update","parameters":[{"description":"Group ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupUpdateRequest"}}},"description":"Group Attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupResponse"}}},"description":"Group Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Group","tags":["Groups"]}},"/logs/{log_id}":{"get":{"callbacks":{},"description":"Fetches a single Log entry by its `log_id`. The entry's type is\ndetermined from the `log_id` itself: its first character identifies\nthe log stream (`c` change, `5` session, `f` flow, `a` api_request).\n","operationId":"PortalAPI.LogController.show","parameters":[{"description":"Identifier of the Log entry. A 24-character lowercase hexadecimal string.","example":"c00060db0c2c8eb400000000","in":"path","name":"log_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LogResponse"}}},"description":"Log Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Log","tags":["Logs"]}},"/oidc_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.OIDCAuthProviderController.show","parameters":[{"description":"OIDC Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OIDCAuthProviderResponse"}}},"description":"OIDC Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show OIDC Auth Provider","tags":["OIDC Auth Providers"]}},"/sites/{site_id}/gateways":{"get":{"callbacks":{},"operationId":"PortalAPI.GatewayController.index","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Limit Gateways returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to the Gateway with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}},{"description":"Filter to the Gateway with this exact tunnel IPv4 address","in":"query","name":"ipv4","required":false,"schema":{"type":"string"}},{"description":"Filter to the Gateway with this exact tunnel IPv6 address","in":"query","name":"ipv6","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewaysResponse"}}},"description":"Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Gateways","tags":["Gateways"]},"post":{"callbacks":{},"description":"Creates a Gateway and mints its single-owner token in one call. The token is returned once here - store it securely. If it's lost, rotate it via `POST /sites/{site_id}/gateways/{gateway_id}/token/rotate` once the Gateway has connected, or delete and re-provision it.\n\n`name` is optional; a random name is generated when omitted. `ipv4` and `ipv6` are the Gateway's tunnel addresses, allocated from the account's pool when the Gateway row is created - they are always present in this response, before the Gateway has ever connected.\n","operationId":"PortalAPI.GatewayController.create","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayCreateRequest"}}},"description":"Gateway attributes","required":false},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayProvisionResponse"}}},"description":"Provisioned Gateway Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Provision a Gateway","tags":["Gateways"]}},"/defender_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.DefenderDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderDeviceListResponse"}}},"description":"Defender device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced Defender devices","tags":["Defender Devices"]}},"/policies":{"get":{"callbacks":{},"operationId":"PortalAPI.PolicyController.index","parameters":[{"description":"Limit Policies returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Policies granting this Group","in":"query","name":"group_id","required":false,"schema":{"type":"string"}},{"description":"Filter to Policies granting access to this Resource","in":"query","name":"resource_id","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyListResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Policies","tags":["Policies"]},"post":{"callbacks":{},"description":"Creates a Policy.\n\nA Policy is enabled by default. Pass `is_disabled: true` to create it disabled, so it grants no access until enabled.\n\nEnterprise accounts with the `device_posture` entitlement can include\n`policy.postures`, a boolean expression of `and`, `or`, `not`, and typed\nprovider-field comparisons. Postures and all `policy.conditions` must hold\ntogether. For example:\n\n```json\n{\"policy\": {\"group_id\": \"00000000-0000-0000-0000-000000000001\",\n  \"resource_id\": \"00000000-0000-0000-0000-000000000002\",\n  \"postures\": {\"and\": [\n    {\"field\": \"intune.enrolled\", \"op\": \"is\", \"value\": true},\n    {\"field\": \"intune.compliance_state\", \"op\": \"is\", \"value\": \"compliant\"}\n  ]}}}\n```\n\nNon-empty `conditions` without the `policy_conditions` entitlement return\n403. Omit `postures` or use null for no posture requirement. Non-null\npostures without the entitlement return 403. Invalid expressions return 422 with\ndetails in `validation_errors.postures`. See `PolicyPostureNode` for the\ncomplete field catalog, operator types, platform behavior, and limits.\n`GET /posture_fields` lists the same fields as structured data.\n","operationId":"PortalAPI.PolicyController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyCreateRequest"}}},"description":"Policy Attributes","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PolicyResponse"}}},"description":"Policy Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create Policy","tags":["Policies"]}},"/logs":{"get":{"callbacks":{},"description":"Retrieves Firezone audit, session, network flow, or REST API request logs\nfor the authenticated account. Use this to investigate configuration\nchanges, review session activity, or troubleshoot network access and API\nrequests. Returns a page of log entries, most recent first.\n\n- `change`: audit entries recording each insert, update, or delete event\n  against an account-scoped object, most recent first.\n- `session`: one entry per Client, Gateway, or Portal session created,\n  most recent first.\n- `flow`: one entry per network flow reported by Clients and Gateways,\n  most recently started first.\n- `api_request`: one entry per authenticated REST API request, most\n  recent first.\n\nSelect one log stream with the required `type` argument. Narrow results\nwith `begin` and `end` RFC 3339 timestamps, for example\n`2026-05-26T00:00:00Z`. The inclusive window applies to the entry's\n`timestamp`, or `flow_start` for flows. Non-UTC offsets are converted\nto UTC. The default window is the last 90 days; `begin` must not be\nlater than `end`.\n\nResults can be further narrowed by `actor_id` (every type) or\n`actor_email` (`change`, `session`, and `flow`), which matches the\nemail recorded when the entry was created. API requests are made by\nAPI clients, which have no email, so `actor_email` is not supported\nfor `api_request`.\n\nReturns up to `limit` entries (default 50, maximum 100). Pass the\n`next_page` cursor from the response's `metadata` as `page_cursor`\nto retrieve the next page.\n","operationId":"PortalAPI.LogController.index","parameters":[{"description":"The log stream to list. One of `change`, `session`, `flow`, or `api_request`.","example":"change","in":"query","name":"type","required":true,"schema":{"type":"string"}},{"description":"Maximum number of Logs to return per page, from 1 to 100. Defaults to 50.\n","example":50,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor returned by a previous request.","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Inclusive start of the time window. RFC 3339 timestamp; non-UTC\noffsets are accepted and converted to UTC. Defaults to 90 days\nbefore the current time when omitted.\n\nFor `flow` entries the window applies to when the flow started.\n","example":"2026-02-25T00:00:00Z","in":"query","name":"begin","required":false,"schema":{"type":"string"}},{"description":"Inclusive end of the time window. RFC 3339 timestamp; non-UTC\noffsets are accepted and converted to UTC. Defaults to the current\ntime when omitted.\n\nFor `flow` entries the window applies to when the flow started.\n","example":"2026-05-26T00:00:00Z","in":"query","name":"end","required":false,"schema":{"type":"string"}},{"description":"Filter to entries whose actor matches.","example":"84e7f82f-831a-4a9d-8f17-c66c2bb6e205","in":"query","name":"actor_id","required":false,"schema":{"type":"string"}},{"description":"Filter to entries whose actor email matches the email recorded\nwhen the entry was created. Supported for `change`, `session`, and\n`flow` types.\n","example":"admin@example.com","in":"query","name":"actor_email","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LogsResponse"}}},"description":"Logs Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Logs","tags":["Logs"]}},"/sophos_devices":{"get":{"callbacks":{},"operationId":"PortalAPI.SophosDeviceController.index","parameters":[{"description":"Limit devices returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosDeviceListResponse"}}},"description":"Sophos device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List synced Sophos devices","tags":["Sophos Devices"]}},"/actors":{"get":{"callbacks":{},"operationId":"PortalAPI.ActorController.index","parameters":[{"description":"Limit Users returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Actors with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}},{"description":"Filter to Actors with this exact email","in":"query","name":"email","required":false,"schema":{"type":"string"}},{"description":"Filter to Actors of this type: account_user, account_admin_user, service_account, or api_client.","example":"service_account","in":"query","name":"type","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorsResponse"}}},"description":"ActorsResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Actors","tags":["Actors"]},"post":{"callbacks":{},"operationId":"PortalAPI.ActorController.create","parameters":[],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorCreateRequest"}}},"description":"Actor attributes","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActorResponse"}}},"description":"ActorResponse"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create an Actor","tags":["Actors"]}},"/okta_directories":{"get":{"callbacks":{},"operationId":"PortalAPI.OktaDirectoryController.index","parameters":[{"description":"Limit Okta Directories returned","example":10,"in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/Prev page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}},{"description":"Filter to Okta Directories with this exact name","in":"query","name":"name","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OktaDirectoryListResponse"}}},"description":"Okta Directory Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Okta Directories","tags":["Okta Directories"]}},"/santa_devices/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.SantaDeviceController.show","parameters":[{"description":"Synced Santa device ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SantaDeviceResponse"}}},"description":"Santa device response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a synced Santa device","tags":["Santa Devices"]}},"/iru_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.IruPostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IruPostureProviderListResponse"}}},"description":"Iru posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Iru posture providers","tags":["Iru Posture Providers"]}},"/okta_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.OktaAuthProviderController.show","parameters":[{"description":"Okta Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OktaAuthProviderResponse"}}},"description":"Okta Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Okta Auth Provider","tags":["Okta Auth Providers"]}},"/sophos_posture_providers/{id}":{"delete":{"callbacks":{},"description":"Deletes a Sophos posture provider and every device synced from it. This\ncannot be undone. Policies keep their posture rules. Once no enabled Sophos\nprovider is left, `sophos.*` posture rules see every device as not\nenrolled. Returns the deleted provider.\n","operationId":"PortalAPI.SophosPostureProviderController.delete","parameters":[{"description":"Sophos posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderResponse"}}},"description":"Sophos posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Delete a Sophos posture provider","tags":["Sophos Posture Providers"]},"get":{"callbacks":{},"operationId":"PortalAPI.SophosPostureProviderController.show","parameters":[{"description":"Sophos posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderResponse"}}},"description":"Sophos posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show a Sophos posture provider","tags":["Sophos Posture Providers"]},"patch":{"callbacks":{},"description":"Renames, enables, or disables a Sophos posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Sophos provider is left, `sophos.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SophosPostureProviderController.update (2)","parameters":[{"description":"Sophos posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderUpdateRequest"}}},"description":"Sophos posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderResponse"}}},"description":"Sophos posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Sophos posture provider","tags":["Sophos Posture Providers"]},"put":{"callbacks":{},"description":"Renames, enables, or disables a Sophos posture provider. Connecting a\nprovider or changing its tenant happens in the web console.\n\nA disabled provider stops syncing, and policies stop trusting its devices.\nOnce no enabled Sophos provider is left, `sophos.*` posture rules see every\ndevice as not enrolled. Enabling requires a verified provider, clears any\nsync error, and queues a device sync.\n","operationId":"PortalAPI.SophosPostureProviderController.update","parameters":[{"description":"Sophos posture provider ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderUpdateRequest"}}},"description":"Sophos posture provider attributes","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SophosPostureProviderResponse"}}},"description":"Sophos posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"422":{"content":{"application/problem+json":{"example":{"detail":"The request body failed validation.","status":422,"title":"Unprocessable Content","type":"about:blank","validation_errors":{"name":["can't be blank"]}},"schema":{"$ref":"#/components/schemas/ValidationProblemDetails"}}},"description":"Unprocessable Content"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Update a Sophos posture provider","tags":["Sophos Posture Providers"]}},"/sites/{site_id}/gateways/{gateway_id}/token/rotate":{"post":{"callbacks":{},"description":"Mints a replacement token for the gateway. A current token the gateway has connected with keeps working until the gateway first connects with the replacement or 4 hours elapse, whichever comes first; a token no gateway has ever connected with is replaced immediately. Rotating again before the gateway picks up the replacement replaces only the pending token and never invalidates the one in use. Once the replacement is confirmed the previous token is deleted - rolling the gateway's configuration back to it will strand the gateway.","operationId":"PortalAPI.GatewayTokenController.rotate","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"gateway_id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayTokenResponse"}}},"description":"New Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Rotate a single-owner Gateway Token","tags":["Gateway Tokens"]}},"/sites/{site_id}/gateways/{gateway_id}/token":{"post":{"callbacks":{},"description":"Creates a token bound to a single gateway. At most one active token can exist per gateway; if one already exists, this returns 409 Conflict - rotate the token or delete it first instead.","operationId":"PortalAPI.GatewayTokenController.create_for_gateway","parameters":[{"description":"Site ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"site_id","required":true,"schema":{"type":"string"}},{"description":"Gateway ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"gateway_id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayTokenResponse"}}},"description":"New Token Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"409":{"content":{"application/problem+json":{"example":{"detail":"The request conflicts with the current state of the resource.","status":409,"title":"Conflict","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Conflict"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Create a single-owner Gateway Token","tags":["Gateway Tokens"]}},"/defender_posture_providers":{"get":{"callbacks":{},"operationId":"PortalAPI.DefenderPostureProviderController.index","parameters":[{"description":"Limit providers returned","in":"query","name":"limit","required":false,"schema":{"maximum":100,"minimum":1,"type":"integer"}},{"description":"Next/previous page cursor","in":"query","name":"page_cursor","required":false,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefenderPostureProviderListResponse"}}},"description":"Defender posture provider response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"List Defender posture providers","tags":["Defender Posture Providers"]}},"/google_auth_providers/{id}":{"get":{"callbacks":{},"operationId":"PortalAPI.GoogleAuthProviderController.show","parameters":[{"description":"Google Auth Provider ID","example":"00000000-0000-0000-0000-000000000000","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GoogleAuthProviderResponse"}}},"description":"Google Auth Provider Response"},"400":{"content":{"application/problem+json":{"example":{"detail":"The request could not be processed.","status":400,"title":"Bad Request","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Bad Request"},"401":{"content":{"application/problem+json":{"example":{"detail":"Authentication credentials were missing or invalid.","status":401,"title":"Unauthorized","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Unauthorized"},"403":{"content":{"application/problem+json":{"example":{"detail":"You do not have permission to perform this action.","status":403,"title":"Forbidden","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Forbidden"},"404":{"content":{"application/problem+json":{"example":{"detail":"The requested resource could not be found.","status":404,"title":"Not Found","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Not Found"},"429":{"content":{"application/problem+json":{"example":{"detail":"Rate limit exceeded. Retry after the time indicated in the Retry-After header.","status":429,"title":"Too Many Requests","type":"about:blank"},"schema":{"$ref":"#/components/schemas/ProblemDetails"}}},"description":"Too Many Requests"}},"summary":"Show Google Auth Provider","tags":["Google Auth Providers"]}}},"security":[{"authorization":[]}],"servers":[{"url":"/","variables":{}}],"tags":[]}