OpenAPI specification (2023-05-26)
Defines the Kolide REST API when X-Kolide-Api-Version is 2023-05-26.
Use Import URL for Postman, MCP, Insomnia, or scripted curl;
Download JSON keeps the canonical openapi2023-05-26.json.
{
"openapi": "3.0.0",
"info": {
"version": "2023-05-26",
"title": "K2 API"
},
"servers": [
{
"url": "https://api.kolide.com/"
}
],
"security": [
{
"api_key": []
}
],
"paths": {
"/audit_logs": {
"get": {
"summary": "Fetch a list of Audit logs",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`timestamp` , `actor_name` , `description`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"timestamp:": {
"summary": "search the 'timestamp' property of the Audit Log records using ':' operator",
"value": "timestamp:2000-01-08T20:38:21Z"
},
"timestamp<": {
"summary": "search the 'timestamp' property of the Audit Log records using '<' operator",
"value": "timestamp<2000-01-08T20:38:21Z"
},
"timestamp>": {
"summary": "search the 'timestamp' property of the Audit Log records using '>' operator",
"value": "timestamp>2000-01-08T20:38:21Z"
},
"actor_name:": {
"summary": "search the 'actor_name' property of the Audit Log records using ':' operator",
"value": "actor_name:string"
},
"actor_name~": {
"summary": "search the 'actor_name' property of the Audit Log records using '~' operator",
"value": "actor_name~string"
},
"description:": {
"summary": "search the 'description' property of the Audit Log records using ':' operator",
"value": "description:string"
},
"description~": {
"summary": "search the 'description' property of the Audit Log records using '~' operator",
"value": "description~string"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Audit logs",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Kolide maintains an audit log of user actions in the Kolide web\nconsole. Examples of tracked events include, but are not limited to:\n - Inviting & removing Kolide team members\n - Changing the display name of a device\n - Requesting a device deletion\n - updating a Check's blocking configuration\n - Approving/denying a registration or exemption request\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/audit_log"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/audit_logs?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/audit_logs/{id}": {
"get": {
"summary": "Fetch information for a specific Audit log",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the audit log",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Kolide maintains an audit log of user actions in the Kolide web\nconsole. Examples of tracked events include, but are not limited to:\n - Inviting & removing Kolide team members\n - Changing the display name of a device\n - Requesting a device deletion\n - updating a Check's blocking configuration\n - Approving/denying a registration or exemption request\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/audit_log"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/whoami": {
"get": {
"summary": "Fetch information about the organization",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
}
],
"responses": {
"200": {
"description": "Returns information about the customer authenticated by the authorization token.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/who_am_i"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/devices/{deviceId}/open_issues": {
"get": {
"summary": "Fetch a list of Issues",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `detected_at` , `resolved_at` , `blocks_device_at` , `title` , `issue_key` , `issue_value` , `exempted` , `check_id` , `device_id` , `last_rechecked_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Issue records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"detected_at:": {
"summary": "search the 'detected_at' property of the Issue records using ':' operator",
"value": "detected_at:2000-01-08T20:38:21Z"
},
"detected_at<": {
"summary": "search the 'detected_at' property of the Issue records using '<' operator",
"value": "detected_at<2000-01-08T20:38:21Z"
},
"detected_at>": {
"summary": "search the 'detected_at' property of the Issue records using '>' operator",
"value": "detected_at>2000-01-08T20:38:21Z"
},
"resolved_at:": {
"summary": "search the 'resolved_at' property of the Issue records using ':' operator",
"value": "resolved_at:2000-01-08T20:38:21Z"
},
"resolved_at<": {
"summary": "search the 'resolved_at' property of the Issue records using '<' operator",
"value": "resolved_at<2000-01-08T20:38:21Z"
},
"resolved_at>": {
"summary": "search the 'resolved_at' property of the Issue records using '>' operator",
"value": "resolved_at>2000-01-08T20:38:21Z"
},
"blocks_device_at:": {
"summary": "search the 'blocks_device_at' property of the Issue records using ':' operator",
"value": "blocks_device_at:2000-01-08T20:38:21Z"
},
"blocks_device_at<": {
"summary": "search the 'blocks_device_at' property of the Issue records using '<' operator",
"value": "blocks_device_at<2000-01-08T20:38:21Z"
},
"blocks_device_at>": {
"summary": "search the 'blocks_device_at' property of the Issue records using '>' operator",
"value": "blocks_device_at>2000-01-08T20:38:21Z"
},
"title:": {
"summary": "search the 'title' property of the Issue records using ':' operator",
"value": "title:string"
},
"title~": {
"summary": "search the 'title' property of the Issue records using '~' operator",
"value": "title~string"
},
"issue_key:": {
"summary": "search the 'issue_key' property of the Issue records using ':' operator",
"value": "issue_key:string"
},
"issue_key~": {
"summary": "search the 'issue_key' property of the Issue records using '~' operator",
"value": "issue_key~string"
},
"issue_value:": {
"summary": "search the 'issue_value' property of the Issue records using ':' operator",
"value": "issue_value:string"
},
"issue_value~": {
"summary": "search the 'issue_value' property of the Issue records using '~' operator",
"value": "issue_value~string"
},
"exempted:": {
"summary": "search the 'exempted' property of the Issue records using ':' operator",
"value": "exempted:true"
},
"check_id:": {
"summary": "search the 'check_id' property of the Issue records using ':' operator",
"value": "check_id:string"
},
"check_id~": {
"summary": "search the 'check_id' property of the Issue records using '~' operator",
"value": "check_id~string"
},
"device_id:": {
"summary": "search the 'device_id' property of the Issue records using ':' operator",
"value": "device_id:string"
},
"device_id~": {
"summary": "search the 'device_id' property of the Issue records using '~' operator",
"value": "device_id~string"
},
"last_rechecked_at:": {
"summary": "search the 'last_rechecked_at' property of the Issue records using ':' operator",
"value": "last_rechecked_at:2000-01-08T20:38:21Z"
},
"last_rechecked_at<": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '<' operator",
"value": "last_rechecked_at<2000-01-08T20:38:21Z"
},
"last_rechecked_at>": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '>' operator",
"value": "last_rechecked_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the issue",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Issues",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "An Issue is created when a device fails a check. Some checks, when\nthey fail, will produce multiple Issues, each with a unique\nprimary_key_value.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/issue"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/open_issues?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/devices/{deviceId}/authentication_mode": {
"patch": {
"summary": "Update an existing Device authentication mode",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the device authentication mode",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Device authentication mode",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_authentication_mode"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_authentication_mode_request_body"
}
}
}
}
},
"put": {
"summary": "Update an existing Device authentication mode",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the device authentication mode",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Device authentication mode",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_authentication_mode"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_authentication_mode_request_body"
}
}
}
}
}
},
"/devices/{deviceId}/registration": {
"delete": {
"summary": "Delete a device registration",
"description": "Remove an existing device registration. This will prevent the\nregistered owner from authenticating with the device. If this device\nis the only registered device for the person, their\nTrust-On-First-Use (TOFU) status will be reset, allowing them to\nregister another device without needing admin approval. Deleting a\nmobile device's registration will also remove the device from the\nKolide.\n",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the device registration",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The deleted Device registration",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_registration"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/devices/{deviceId}/check_refreshes": {
"post": {
"summary": "Create a new Check refresh",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the check refresh",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The newly created Check refresh",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_refresh"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_refresh_request_body"
}
}
}
}
}
},
"/devices/{deviceId}/check_results": {
"get": {
"summary": "Fetch a list of Check results",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`device_display_name` , `ran_at` , `check_name` , `status`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"device_display_name:": {
"summary": "search the 'device_display_name' property of the Check Results records using ':' operator",
"value": "device_display_name:string"
},
"device_display_name~": {
"summary": "search the 'device_display_name' property of the Check Results records using '~' operator",
"value": "device_display_name~string"
},
"ran_at:": {
"summary": "search the 'ran_at' property of the Check Results records using ':' operator",
"value": "ran_at:2000-01-08T20:38:21Z"
},
"ran_at<": {
"summary": "search the 'ran_at' property of the Check Results records using '<' operator",
"value": "ran_at<2000-01-08T20:38:21Z"
},
"ran_at>": {
"summary": "search the 'ran_at' property of the Check Results records using '>' operator",
"value": "ran_at>2000-01-08T20:38:21Z"
},
"check_name:": {
"summary": "search the 'check_name' property of the Check Results records using ':' operator",
"value": "check_name:string"
},
"check_name~": {
"summary": "search the 'check_name' property of the Check Results records using '~' operator",
"value": "check_name~string"
},
"status:": {
"summary": "search the 'status' property of the Check Results records using ':' operator",
"value": "status:enumerated-value"
}
},
"schema": {
"type": "string"
}
},
{
"name": "deviceId",
"in": "path",
"required": true,
"description": "The device ID of the check",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Check results",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Check Result describes the data returned the last time a check ran on a single device.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/check_result"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/check_results?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/devices": {
"get": {
"summary": "Fetch a list of Devices",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `name` , `registered_at` , `last_authenticated_at` , `serial` , `note` , `hardware_uuid` , `device_type` , `will_block_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Device records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"name:": {
"summary": "search the 'name' property of the Device records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Device records using '~' operator",
"value": "name~string"
},
"registered_at:": {
"summary": "search the 'registered_at' property of the Device records using ':' operator",
"value": "registered_at:2000-01-08T20:38:21Z"
},
"registered_at<": {
"summary": "search the 'registered_at' property of the Device records using '<' operator",
"value": "registered_at<2000-01-08T20:38:21Z"
},
"registered_at>": {
"summary": "search the 'registered_at' property of the Device records using '>' operator",
"value": "registered_at>2000-01-08T20:38:21Z"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Device records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Device records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Device records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
},
"serial:": {
"summary": "search the 'serial' property of the Device records using ':' operator",
"value": "serial:string"
},
"serial~": {
"summary": "search the 'serial' property of the Device records using '~' operator",
"value": "serial~string"
},
"note:": {
"summary": "search the 'note' property of the Device records using ':' operator",
"value": "note:string"
},
"note~": {
"summary": "search the 'note' property of the Device records using '~' operator",
"value": "note~string"
},
"hardware_uuid:": {
"summary": "search the 'hardware_uuid' property of the Device records using ':' operator",
"value": "hardware_uuid:string"
},
"hardware_uuid~": {
"summary": "search the 'hardware_uuid' property of the Device records using '~' operator",
"value": "hardware_uuid~string"
},
"device_type:": {
"summary": "search the 'device_type' property of the Device records using ':' operator",
"value": "device_type:enumerated-value"
},
"will_block_at:": {
"summary": "search the 'will_block_at' property of the Device records using ':' operator",
"value": "will_block_at:2000-01-08T20:38:21Z"
},
"will_block_at<": {
"summary": "search the 'will_block_at' property of the Device records using '<' operator",
"value": "will_block_at<2000-01-08T20:38:21Z"
},
"will_block_at>": {
"summary": "search the 'will_block_at' property of the Device records using '>' operator",
"value": "will_block_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Devices",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Device is a computer or mobile device enrolled into Kolide",
"type": "array",
"items": {
"$ref": "#/components/schemas/device"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/devices?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/devices/{id}": {
"get": {
"summary": "Fetch information for a specific Device",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the device",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A Device is a computer or mobile device enrolled into Kolide",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"delete": {
"summary": "Delete a specific Device",
"description": "Mark a device as pending deletion. Note that the deletion will not\nhappen immediately: the deletion can be canceled in the web\ninterface until the device is actually deleted. The Kolide agent\non the device will also be disabled to prevent re-enrollment.\nIf this device is the only registered device for a user, their\nTrust-On-First-Use (TOFU) status will be reset, allowing them to\nregister another device without needing admin approval.\n",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the device",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The deleted Device",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/issues": {
"get": {
"summary": "Fetch a list of Issues",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `detected_at` , `resolved_at` , `blocks_device_at` , `title` , `issue_key` , `issue_value` , `exempted` , `check_id` , `device_id` , `last_rechecked_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Issue records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"detected_at:": {
"summary": "search the 'detected_at' property of the Issue records using ':' operator",
"value": "detected_at:2000-01-08T20:38:21Z"
},
"detected_at<": {
"summary": "search the 'detected_at' property of the Issue records using '<' operator",
"value": "detected_at<2000-01-08T20:38:21Z"
},
"detected_at>": {
"summary": "search the 'detected_at' property of the Issue records using '>' operator",
"value": "detected_at>2000-01-08T20:38:21Z"
},
"resolved_at:": {
"summary": "search the 'resolved_at' property of the Issue records using ':' operator",
"value": "resolved_at:2000-01-08T20:38:21Z"
},
"resolved_at<": {
"summary": "search the 'resolved_at' property of the Issue records using '<' operator",
"value": "resolved_at<2000-01-08T20:38:21Z"
},
"resolved_at>": {
"summary": "search the 'resolved_at' property of the Issue records using '>' operator",
"value": "resolved_at>2000-01-08T20:38:21Z"
},
"blocks_device_at:": {
"summary": "search the 'blocks_device_at' property of the Issue records using ':' operator",
"value": "blocks_device_at:2000-01-08T20:38:21Z"
},
"blocks_device_at<": {
"summary": "search the 'blocks_device_at' property of the Issue records using '<' operator",
"value": "blocks_device_at<2000-01-08T20:38:21Z"
},
"blocks_device_at>": {
"summary": "search the 'blocks_device_at' property of the Issue records using '>' operator",
"value": "blocks_device_at>2000-01-08T20:38:21Z"
},
"title:": {
"summary": "search the 'title' property of the Issue records using ':' operator",
"value": "title:string"
},
"title~": {
"summary": "search the 'title' property of the Issue records using '~' operator",
"value": "title~string"
},
"issue_key:": {
"summary": "search the 'issue_key' property of the Issue records using ':' operator",
"value": "issue_key:string"
},
"issue_key~": {
"summary": "search the 'issue_key' property of the Issue records using '~' operator",
"value": "issue_key~string"
},
"issue_value:": {
"summary": "search the 'issue_value' property of the Issue records using ':' operator",
"value": "issue_value:string"
},
"issue_value~": {
"summary": "search the 'issue_value' property of the Issue records using '~' operator",
"value": "issue_value~string"
},
"exempted:": {
"summary": "search the 'exempted' property of the Issue records using ':' operator",
"value": "exempted:true"
},
"check_id:": {
"summary": "search the 'check_id' property of the Issue records using ':' operator",
"value": "check_id:string"
},
"check_id~": {
"summary": "search the 'check_id' property of the Issue records using '~' operator",
"value": "check_id~string"
},
"device_id:": {
"summary": "search the 'device_id' property of the Issue records using ':' operator",
"value": "device_id:string"
},
"device_id~": {
"summary": "search the 'device_id' property of the Issue records using '~' operator",
"value": "device_id~string"
},
"last_rechecked_at:": {
"summary": "search the 'last_rechecked_at' property of the Issue records using ':' operator",
"value": "last_rechecked_at:2000-01-08T20:38:21Z"
},
"last_rechecked_at<": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '<' operator",
"value": "last_rechecked_at<2000-01-08T20:38:21Z"
},
"last_rechecked_at>": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '>' operator",
"value": "last_rechecked_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Issues",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "An Issue is created when a device fails a check. Some checks, when\nthey fail, will produce multiple Issues, each with a unique\nprimary_key_value.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/issue"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/issues?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/issues/{id}": {
"get": {
"summary": "Fetch information for a specific Issue",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the issue",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "An Issue is created when a device fails a check. Some checks, when\nthey fail, will produce multiple Issues, each with a unique\nprimary_key_value.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/issue"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/deprovisioned_people": {
"get": {
"summary": "Fetch a list of the people that have been deprovisioned",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `email` , `name` , `last_authenticated_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Deprovisioned Person records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"email:": {
"summary": "search the 'email' property of the Deprovisioned Person records using ':' operator",
"value": "email:string"
},
"email~": {
"summary": "search the 'email' property of the Deprovisioned Person records using '~' operator",
"value": "email~string"
},
"name:": {
"summary": "search the 'name' property of the Deprovisioned Person records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Deprovisioned Person records using '~' operator",
"value": "name~string"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Deprovisioned Person records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Deprovisioned Person records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Deprovisioned Person records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Deprovisioned people",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Deprovisioned Person is a representation of a Person that has been\nremoved from Kolide via SCIM\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/deprovisioned_person"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/deprovisioned_people?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/packages": {
"get": {
"summary": "Fetch a list of Packages",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Packages",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Installation packages are available for each of the major operating systems.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/package"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/packages?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/packages/{id}": {
"get": {
"summary": "Fetch information for a specific Package",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the package",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Installation packages are available for each of the major operating systems.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/package"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/people/{personId}/registered_devices": {
"get": {
"summary": "Fetch a list of Devices",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `name` , `registered_at` , `last_authenticated_at` , `serial` , `note` , `hardware_uuid` , `device_type` , `will_block_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Device records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"name:": {
"summary": "search the 'name' property of the Device records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Device records using '~' operator",
"value": "name~string"
},
"registered_at:": {
"summary": "search the 'registered_at' property of the Device records using ':' operator",
"value": "registered_at:2000-01-08T20:38:21Z"
},
"registered_at<": {
"summary": "search the 'registered_at' property of the Device records using '<' operator",
"value": "registered_at<2000-01-08T20:38:21Z"
},
"registered_at>": {
"summary": "search the 'registered_at' property of the Device records using '>' operator",
"value": "registered_at>2000-01-08T20:38:21Z"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Device records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Device records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Device records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
},
"serial:": {
"summary": "search the 'serial' property of the Device records using ':' operator",
"value": "serial:string"
},
"serial~": {
"summary": "search the 'serial' property of the Device records using '~' operator",
"value": "serial~string"
},
"note:": {
"summary": "search the 'note' property of the Device records using ':' operator",
"value": "note:string"
},
"note~": {
"summary": "search the 'note' property of the Device records using '~' operator",
"value": "note~string"
},
"hardware_uuid:": {
"summary": "search the 'hardware_uuid' property of the Device records using ':' operator",
"value": "hardware_uuid:string"
},
"hardware_uuid~": {
"summary": "search the 'hardware_uuid' property of the Device records using '~' operator",
"value": "hardware_uuid~string"
},
"device_type:": {
"summary": "search the 'device_type' property of the Device records using ':' operator",
"value": "device_type:enumerated-value"
},
"will_block_at:": {
"summary": "search the 'will_block_at' property of the Device records using ':' operator",
"value": "will_block_at:2000-01-08T20:38:21Z"
},
"will_block_at<": {
"summary": "search the 'will_block_at' property of the Device records using '<' operator",
"value": "will_block_at<2000-01-08T20:38:21Z"
},
"will_block_at>": {
"summary": "search the 'will_block_at' property of the Device records using '>' operator",
"value": "will_block_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
},
{
"name": "personId",
"in": "path",
"required": true,
"description": "The person ID of the device",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Devices",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Device is a computer or mobile device enrolled into Kolide",
"type": "array",
"items": {
"$ref": "#/components/schemas/device"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/registered_devices?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/people/{personId}/open_issues": {
"get": {
"summary": "Fetch a list of Issues",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `detected_at` , `resolved_at` , `blocks_device_at` , `title` , `issue_key` , `issue_value` , `exempted` , `check_id` , `device_id` , `last_rechecked_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Issue records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"detected_at:": {
"summary": "search the 'detected_at' property of the Issue records using ':' operator",
"value": "detected_at:2000-01-08T20:38:21Z"
},
"detected_at<": {
"summary": "search the 'detected_at' property of the Issue records using '<' operator",
"value": "detected_at<2000-01-08T20:38:21Z"
},
"detected_at>": {
"summary": "search the 'detected_at' property of the Issue records using '>' operator",
"value": "detected_at>2000-01-08T20:38:21Z"
},
"resolved_at:": {
"summary": "search the 'resolved_at' property of the Issue records using ':' operator",
"value": "resolved_at:2000-01-08T20:38:21Z"
},
"resolved_at<": {
"summary": "search the 'resolved_at' property of the Issue records using '<' operator",
"value": "resolved_at<2000-01-08T20:38:21Z"
},
"resolved_at>": {
"summary": "search the 'resolved_at' property of the Issue records using '>' operator",
"value": "resolved_at>2000-01-08T20:38:21Z"
},
"blocks_device_at:": {
"summary": "search the 'blocks_device_at' property of the Issue records using ':' operator",
"value": "blocks_device_at:2000-01-08T20:38:21Z"
},
"blocks_device_at<": {
"summary": "search the 'blocks_device_at' property of the Issue records using '<' operator",
"value": "blocks_device_at<2000-01-08T20:38:21Z"
},
"blocks_device_at>": {
"summary": "search the 'blocks_device_at' property of the Issue records using '>' operator",
"value": "blocks_device_at>2000-01-08T20:38:21Z"
},
"title:": {
"summary": "search the 'title' property of the Issue records using ':' operator",
"value": "title:string"
},
"title~": {
"summary": "search the 'title' property of the Issue records using '~' operator",
"value": "title~string"
},
"issue_key:": {
"summary": "search the 'issue_key' property of the Issue records using ':' operator",
"value": "issue_key:string"
},
"issue_key~": {
"summary": "search the 'issue_key' property of the Issue records using '~' operator",
"value": "issue_key~string"
},
"issue_value:": {
"summary": "search the 'issue_value' property of the Issue records using ':' operator",
"value": "issue_value:string"
},
"issue_value~": {
"summary": "search the 'issue_value' property of the Issue records using '~' operator",
"value": "issue_value~string"
},
"exempted:": {
"summary": "search the 'exempted' property of the Issue records using ':' operator",
"value": "exempted:true"
},
"check_id:": {
"summary": "search the 'check_id' property of the Issue records using ':' operator",
"value": "check_id:string"
},
"check_id~": {
"summary": "search the 'check_id' property of the Issue records using '~' operator",
"value": "check_id~string"
},
"device_id:": {
"summary": "search the 'device_id' property of the Issue records using ':' operator",
"value": "device_id:string"
},
"device_id~": {
"summary": "search the 'device_id' property of the Issue records using '~' operator",
"value": "device_id~string"
},
"last_rechecked_at:": {
"summary": "search the 'last_rechecked_at' property of the Issue records using ':' operator",
"value": "last_rechecked_at:2000-01-08T20:38:21Z"
},
"last_rechecked_at<": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '<' operator",
"value": "last_rechecked_at<2000-01-08T20:38:21Z"
},
"last_rechecked_at>": {
"summary": "search the 'last_rechecked_at' property of the Issue records using '>' operator",
"value": "last_rechecked_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
},
{
"name": "personId",
"in": "path",
"required": true,
"description": "The person ID of the issue",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Issues",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "An Issue is created when a device fails a check. Some checks, when\nthey fail, will produce multiple Issues, each with a unique\nprimary_key_value.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/issue"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/open_issues?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/people/{personId}/person_groups": {
"get": {
"summary": "Fetch a list of Person groups",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`name`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"name:": {
"summary": "search the 'name' property of the Person Group records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Person Group records using '~' operator",
"value": "name~string"
}
},
"schema": {
"type": "string"
}
},
{
"name": "personId",
"in": "path",
"required": true,
"description": "The person ID of the person group",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Person groups",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A group of people, these are synced from your SCIM provider\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/person_group"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/person_groups?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/people": {
"get": {
"summary": "Fetch a list of People",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `email` , `name` , `last_authenticated_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Person records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"email:": {
"summary": "search the 'email' property of the Person records using ':' operator",
"value": "email:string"
},
"email~": {
"summary": "search the 'email' property of the Person records using '~' operator",
"value": "email~string"
},
"name:": {
"summary": "search the 'name' property of the Person records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Person records using '~' operator",
"value": "name~string"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Person records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Person records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Person records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of People",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Person is a representation of a human in your organization, not\nnecessarily someone with admin access to the Kolide dashboard.\nDevices can be registered to a person.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/person"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/people?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/people/{id}": {
"get": {
"summary": "Fetch information for a specific Person",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the person",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A Person is a representation of a human in your organization, not\nnecessarily someone with admin access to the Kolide dashboard.\nDevices can be registered to a person.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/person"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/person_groups/{personGroupId}/people": {
"get": {
"summary": "Fetch a list of People",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `email` , `name` , `last_authenticated_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Person records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"email:": {
"summary": "search the 'email' property of the Person records using ':' operator",
"value": "email:string"
},
"email~": {
"summary": "search the 'email' property of the Person records using '~' operator",
"value": "email~string"
},
"name:": {
"summary": "search the 'name' property of the Person records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Person records using '~' operator",
"value": "name~string"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Person records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Person records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Person records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
},
{
"name": "personGroupId",
"in": "path",
"required": true,
"description": "The person group ID of the person",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of People",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Person is a representation of a human in your organization, not\nnecessarily someone with admin access to the Kolide dashboard.\nDevices can be registered to a person.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/person"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/people?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/person_groups": {
"get": {
"summary": "Fetch a list of Person groups",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`name`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"name:": {
"summary": "search the 'name' property of the Person Group records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Person Group records using '~' operator",
"value": "name~string"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Person groups",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A group of people, these are synced from your SCIM provider\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/person_group"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/person_groups?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/person_groups/{id}": {
"get": {
"summary": "Fetch information for a specific Person group",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the person group",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A group of people, these are synced from your SCIM provider\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/person_group"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/auth_logs": {
"get": {
"summary": "Fetch a list of Auth log sessions",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`timestamp` , `city` , `country` , `ip_address` , `agent_version` , `browser_name` , `person_name` , `person_email` , `person_id` , `device_id` , `result`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"timestamp:": {
"summary": "search the 'timestamp' property of the Auth Log records using ':' operator",
"value": "timestamp:2000-01-08T20:38:21Z"
},
"timestamp<": {
"summary": "search the 'timestamp' property of the Auth Log records using '<' operator",
"value": "timestamp<2000-01-08T20:38:21Z"
},
"timestamp>": {
"summary": "search the 'timestamp' property of the Auth Log records using '>' operator",
"value": "timestamp>2000-01-08T20:38:21Z"
},
"city:": {
"summary": "search the 'city' property of the Auth Log records using ':' operator",
"value": "city:string"
},
"city~": {
"summary": "search the 'city' property of the Auth Log records using '~' operator",
"value": "city~string"
},
"country:": {
"summary": "search the 'country' property of the Auth Log records using ':' operator",
"value": "country:string"
},
"country~": {
"summary": "search the 'country' property of the Auth Log records using '~' operator",
"value": "country~string"
},
"ip_address:": {
"summary": "search the 'ip_address' property of the Auth Log records using ':' operator",
"value": "ip_address:string"
},
"ip_address~": {
"summary": "search the 'ip_address' property of the Auth Log records using '~' operator",
"value": "ip_address~string"
},
"agent_version:": {
"summary": "search the 'agent_version' property of the Auth Log records using ':' operator",
"value": "agent_version:string"
},
"agent_version~": {
"summary": "search the 'agent_version' property of the Auth Log records using '~' operator",
"value": "agent_version~string"
},
"browser_name:": {
"summary": "search the 'browser_name' property of the Auth Log records using ':' operator",
"value": "browser_name:string"
},
"browser_name~": {
"summary": "search the 'browser_name' property of the Auth Log records using '~' operator",
"value": "browser_name~string"
},
"person_name:": {
"summary": "search the 'person_name' property of the Auth Log records using ':' operator",
"value": "person_name:string"
},
"person_name~": {
"summary": "search the 'person_name' property of the Auth Log records using '~' operator",
"value": "person_name~string"
},
"person_email:": {
"summary": "search the 'person_email' property of the Auth Log records using ':' operator",
"value": "person_email:string"
},
"person_email~": {
"summary": "search the 'person_email' property of the Auth Log records using '~' operator",
"value": "person_email~string"
},
"person_id:": {
"summary": "search the 'person_id' property of the Auth Log records using ':' operator",
"value": "person_id:string"
},
"person_id~": {
"summary": "search the 'person_id' property of the Auth Log records using '~' operator",
"value": "person_id~string"
},
"device_id:": {
"summary": "search the 'device_id' property of the Auth Log records using ':' operator",
"value": "device_id:string"
},
"device_id~": {
"summary": "search the 'device_id' property of the Auth Log records using '~' operator",
"value": "device_id~string"
},
"result:": {
"summary": "search the 'result' property of the Auth Log records using ':' operator",
"value": "result:enumerated-value"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Auth log sessions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "An Auth Log Session is a summarization of an end-user's experience\nwhen signing into apps via Kolide Device Trust authentication. An\nAuth Log Session is created when an end-user is first redirected to\nKolide to complete the Device Trust authentication flow and is\nupdated as the end-user or the system perform actions during the\nsession. These actions are considered Auth Log Events and are\nassociated with the Auth Log Session.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/auth_log_session"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/auth_logs?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/auth_logs/{id}": {
"get": {
"summary": "Fetch information for a specific Auth log session",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the auth log session",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "An Auth Log Session is a summarization of an end-user's experience\nwhen signing into apps via Kolide Device Trust authentication. An\nAuth Log Session is created when an end-user is first redirected to\nKolide to complete the Device Trust authentication flow and is\nupdated as the end-user or the system perform actions during the\nsession. These actions are considered Auth Log Events and are\nassociated with the Auth Log Session.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/auth_log_session"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/device_groups/{deviceGroupId}/devices": {
"get": {
"summary": "Fetch a list of Devices",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`id` , `name` , `registered_at` , `last_authenticated_at` , `serial` , `note` , `hardware_uuid` , `device_type` , `will_block_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"id:": {
"summary": "search the 'id' property of the Device records",
"value": "id:[\"a\", \"b\", \"c\"]"
},
"name:": {
"summary": "search the 'name' property of the Device records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Device records using '~' operator",
"value": "name~string"
},
"registered_at:": {
"summary": "search the 'registered_at' property of the Device records using ':' operator",
"value": "registered_at:2000-01-08T20:38:21Z"
},
"registered_at<": {
"summary": "search the 'registered_at' property of the Device records using '<' operator",
"value": "registered_at<2000-01-08T20:38:21Z"
},
"registered_at>": {
"summary": "search the 'registered_at' property of the Device records using '>' operator",
"value": "registered_at>2000-01-08T20:38:21Z"
},
"last_authenticated_at:": {
"summary": "search the 'last_authenticated_at' property of the Device records using ':' operator",
"value": "last_authenticated_at:2000-01-08T20:38:21Z"
},
"last_authenticated_at<": {
"summary": "search the 'last_authenticated_at' property of the Device records using '<' operator",
"value": "last_authenticated_at<2000-01-08T20:38:21Z"
},
"last_authenticated_at>": {
"summary": "search the 'last_authenticated_at' property of the Device records using '>' operator",
"value": "last_authenticated_at>2000-01-08T20:38:21Z"
},
"serial:": {
"summary": "search the 'serial' property of the Device records using ':' operator",
"value": "serial:string"
},
"serial~": {
"summary": "search the 'serial' property of the Device records using '~' operator",
"value": "serial~string"
},
"note:": {
"summary": "search the 'note' property of the Device records using ':' operator",
"value": "note:string"
},
"note~": {
"summary": "search the 'note' property of the Device records using '~' operator",
"value": "note~string"
},
"hardware_uuid:": {
"summary": "search the 'hardware_uuid' property of the Device records using ':' operator",
"value": "hardware_uuid:string"
},
"hardware_uuid~": {
"summary": "search the 'hardware_uuid' property of the Device records using '~' operator",
"value": "hardware_uuid~string"
},
"device_type:": {
"summary": "search the 'device_type' property of the Device records using ':' operator",
"value": "device_type:enumerated-value"
},
"will_block_at:": {
"summary": "search the 'will_block_at' property of the Device records using ':' operator",
"value": "will_block_at:2000-01-08T20:38:21Z"
},
"will_block_at<": {
"summary": "search the 'will_block_at' property of the Device records using '<' operator",
"value": "will_block_at<2000-01-08T20:38:21Z"
},
"will_block_at>": {
"summary": "search the 'will_block_at' property of the Device records using '>' operator",
"value": "will_block_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
},
{
"name": "deviceGroupId",
"in": "path",
"required": true,
"description": "The device group ID of the device",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Devices",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Device is a computer or mobile device enrolled into Kolide",
"type": "array",
"items": {
"$ref": "#/components/schemas/device"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/devices?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/device_groups/{deviceGroupId}/memberships": {
"post": {
"summary": "Add a Device to the Device Group",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceGroupId",
"in": "path",
"required": true,
"description": "The device group ID of the device group member",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The newly created Device group member",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_group_member"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_group_member_request_body"
}
}
}
}
}
},
"/device_groups/{deviceGroupId}/memberships/{id}": {
"delete": {
"summary": "Remove a specified Device from the Device Group",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "deviceGroupId",
"in": "path",
"required": true,
"description": "The device group ID of the device group member",
"schema": {
"type": "string"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the device group member",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The deleted Device group member",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_group_member"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/device_groups": {
"get": {
"summary": "Fetch a list of Device groups",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`created_at` , `name` , `description`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"created_at:": {
"summary": "search the 'created_at' property of the Device Group records using ':' operator",
"value": "created_at:2000-01-08T20:38:21Z"
},
"created_at<": {
"summary": "search the 'created_at' property of the Device Group records using '<' operator",
"value": "created_at<2000-01-08T20:38:21Z"
},
"created_at>": {
"summary": "search the 'created_at' property of the Device Group records using '>' operator",
"value": "created_at>2000-01-08T20:38:21Z"
},
"name:": {
"summary": "search the 'name' property of the Device Group records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Device Group records using '~' operator",
"value": "name~string"
},
"description:": {
"summary": "search the 'description' property of the Device Group records using ':' operator",
"value": "description:string"
},
"description~": {
"summary": "search the 'description' property of the Device Group records using '~' operator",
"value": "description~string"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Device groups",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Device Groups allow you to group devices together in ways that are\nbeneficial to your organization, both in the UI and programmatically\nvia the API.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/device_group"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/device_groups?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/device_groups/{id}": {
"get": {
"summary": "Fetch information for a specific Device group",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the device group",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Device Groups allow you to group devices together in ways that are\nbeneficial to your organization, both in the UI and programmatically\nvia the API.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/device_group"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/live_query_campaigns/{liveQueryCampaignId}/query_results": {
"get": {
"summary": "Fetch a list of Live query results",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`error_message` , `warning_message`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"error_message:": {
"summary": "search the 'error_message' property of the Live Query Result records using ':' operator",
"value": "error_message:string"
},
"error_message~": {
"summary": "search the 'error_message' property of the Live Query Result records using '~' operator",
"value": "error_message~string"
},
"warning_message:": {
"summary": "search the 'warning_message' property of the Live Query Result records using ':' operator",
"value": "warning_message:string"
},
"warning_message~": {
"summary": "search the 'warning_message' property of the Live Query Result records using '~' operator",
"value": "warning_message~string"
}
},
"schema": {
"type": "string"
}
},
{
"name": "liveQueryCampaignId",
"in": "path",
"required": true,
"description": "The live query campaign ID of the live query result",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Live query results",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "The results set for a single device targeted in a live query\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/live_query_result"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/query_results?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/live_query_campaigns": {
"get": {
"summary": "Fetch a list of Live query campaigns",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`created_at` , `name` , `published` , `tables_used`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"created_at:": {
"summary": "search the 'created_at' property of the Live Query records using ':' operator",
"value": "created_at:2000-01-08T20:38:21Z"
},
"created_at<": {
"summary": "search the 'created_at' property of the Live Query records using '<' operator",
"value": "created_at<2000-01-08T20:38:21Z"
},
"created_at>": {
"summary": "search the 'created_at' property of the Live Query records using '>' operator",
"value": "created_at>2000-01-08T20:38:21Z"
},
"name:": {
"summary": "search the 'name' property of the Live Query records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Live Query records using '~' operator",
"value": "name~string"
},
"published:": {
"summary": "search the 'published' property of the Live Query records using ':' operator",
"value": "published:true"
},
"tables_used:": {
"summary": "search the 'tables_used' property of the Live Query records using ':' operator",
"value": "tables_used:search_term"
},
"tables_used~": {
"summary": "search the 'tables_used' property of the Live Query records using '~' operator",
"value": "tables_used~search_term"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Live query campaigns",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Kolide's Live Query allows you to run your own ad-hoc SQL queries\nand get results from online devices in real time.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/live_query_campaign"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/live_query_campaigns?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"post": {
"summary": "Create a new Live query campaign",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
}
],
"responses": {
"200": {
"description": "The newly created Live query campaign",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign_request_body"
}
}
}
}
}
},
"/live_query_campaigns/{id}": {
"get": {
"summary": "Fetch information for a specific Live query campaign",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the live query campaign",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Kolide's Live Query allows you to run your own ad-hoc SQL queries\nand get results from online devices in real time.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"patch": {
"summary": "Update an existing Live query campaign",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the live query campaign",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Live query campaign",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign_request_body"
}
}
}
}
},
"put": {
"summary": "Update an existing Live query campaign",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the live query campaign",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Live query campaign",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign_request_body"
}
}
}
}
},
"delete": {
"summary": "Delete a specific Live query campaign",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the live query campaign",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The deleted Live query campaign",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/live_query_campaign"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/checks/{checkId}/results": {
"get": {
"summary": "Fetch a list of Check results",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`device_display_name` , `ran_at` , `check_name` , `status`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"device_display_name:": {
"summary": "search the 'device_display_name' property of the Check Results records using ':' operator",
"value": "device_display_name:string"
},
"device_display_name~": {
"summary": "search the 'device_display_name' property of the Check Results records using '~' operator",
"value": "device_display_name~string"
},
"ran_at:": {
"summary": "search the 'ran_at' property of the Check Results records using ':' operator",
"value": "ran_at:2000-01-08T20:38:21Z"
},
"ran_at<": {
"summary": "search the 'ran_at' property of the Check Results records using '<' operator",
"value": "ran_at<2000-01-08T20:38:21Z"
},
"ran_at>": {
"summary": "search the 'ran_at' property of the Check Results records using '>' operator",
"value": "ran_at>2000-01-08T20:38:21Z"
},
"check_name:": {
"summary": "search the 'check_name' property of the Check Results records using ':' operator",
"value": "check_name:string"
},
"check_name~": {
"summary": "search the 'check_name' property of the Check Results records using '~' operator",
"value": "check_name~string"
},
"status:": {
"summary": "search the 'status' property of the Check Results records using ':' operator",
"value": "status:enumerated-value"
}
},
"schema": {
"type": "string"
}
},
{
"name": "checkId",
"in": "path",
"required": true,
"description": "The check ID of the check",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Check results",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Check Result describes the data returned the last time a check ran on a single device.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/check_result"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/results?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/checks/{checkId}/configurations": {
"get": {
"summary": "Fetch information for a specific Check configuration",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "checkId",
"in": "path",
"required": true,
"description": "The check ID of the check configuration",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Check configurations are the settings that determine how a check is run\nand against what groups and devices.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_configuration"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"patch": {
"summary": "Update an existing Check configuration",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "checkId",
"in": "path",
"required": true,
"description": "The check ID of the check configuration",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Check configuration",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_configuration"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_configuration_request_body"
}
}
}
}
},
"put": {
"summary": "Update an existing Check configuration",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "checkId",
"in": "path",
"required": true,
"description": "The check ID of the check configuration",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Check configuration",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_configuration"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check_configuration_request_body"
}
}
}
}
}
},
"/checks/{checkId}/runs": {
"post": {
"summary": "Create a new External check run",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "checkId",
"in": "path",
"required": true,
"description": "The check ID of the external check run",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The newly created External check run",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/external_check_run"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/external_check_run_request_body"
}
}
}
}
}
},
"/checks": {
"get": {
"summary": "Fetch a list of Checks",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`name` , `check_description` , `check_tag_name` , `check_tag_description` , `check_tag_id` , `slug` , `type`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"name:": {
"summary": "search the 'name' property of the Check records using ':' operator",
"value": "name:string"
},
"name~": {
"summary": "search the 'name' property of the Check records using '~' operator",
"value": "name~string"
},
"check_description:": {
"summary": "search the 'check_description' property of the Check records using ':' operator",
"value": "check_description:string"
},
"check_description~": {
"summary": "search the 'check_description' property of the Check records using '~' operator",
"value": "check_description~string"
},
"check_tag_name:": {
"summary": "search the 'check_tag_name' property of the Check records using ':' operator",
"value": "check_tag_name:string"
},
"check_tag_name~": {
"summary": "search the 'check_tag_name' property of the Check records using '~' operator",
"value": "check_tag_name~string"
},
"check_tag_description:": {
"summary": "search the 'check_tag_description' property of the Check records using ':' operator",
"value": "check_tag_description:string"
},
"check_tag_description~": {
"summary": "search the 'check_tag_description' property of the Check records using '~' operator",
"value": "check_tag_description~string"
},
"check_tag_id:": {
"summary": "search the 'check_tag_id' property of the Check records using ':' operator",
"value": "check_tag_id:string"
},
"check_tag_id~": {
"summary": "search the 'check_tag_id' property of the Check records using '~' operator",
"value": "check_tag_id~string"
},
"slug:": {
"summary": "search the 'slug' property of the Check records using ':' operator",
"value": "slug:string"
},
"slug~": {
"summary": "search the 'slug' property of the Check records using '~' operator",
"value": "slug~string"
},
"type:": {
"summary": "search the 'type' property of the Check records using ':' operator",
"value": "type:enumerated-value"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Checks",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Check is a test that Kolide runs on a device on a regular cadence\nwhich typically produces a passing or failing result.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/check"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/checks?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/checks/{id}": {
"get": {
"summary": "Fetch information for a specific Check",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the check",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A Check is a test that Kolide runs on a device on a regular cadence\nwhich typically produces a passing or failing result.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/check"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/exemption_requests": {
"get": {
"summary": "Fetch a list of Exemption requests",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`status` , `requested_at` , `requester_message`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"status:": {
"summary": "search the 'status' property of the Exemption Request records using ':' operator",
"value": "status:enumerated-value"
},
"requested_at:": {
"summary": "search the 'requested_at' property of the Exemption Request records using ':' operator",
"value": "requested_at:2000-01-08T20:38:21Z"
},
"requested_at<": {
"summary": "search the 'requested_at' property of the Exemption Request records using '<' operator",
"value": "requested_at<2000-01-08T20:38:21Z"
},
"requested_at>": {
"summary": "search the 'requested_at' property of the Exemption Request records using '>' operator",
"value": "requested_at>2000-01-08T20:38:21Z"
},
"requester_message:": {
"summary": "search the 'requester_message' property of the Exemption Request records using ':' operator",
"value": "requester_message:string"
},
"requester_message~": {
"summary": "search the 'requester_message' property of the Exemption Request records using '~' operator",
"value": "requester_message~string"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Exemption requests",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "An exemption request is created when a user desires to permanently\nignore a specific issue or set of issues on a single device. Exemption\nrequests are created by users and can be approved or denied by admins.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/exemption_request"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/exemption_requests?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/exemption_requests/{id}": {
"get": {
"summary": "Fetch information for a specific Exemption request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the exemption request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "An exemption request is created when a user desires to permanently\nignore a specific issue or set of issues on a single device. Exemption\nrequests are created by users and can be approved or denied by admins.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/exemption_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"patch": {
"summary": "Update an existing Exemption request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the exemption request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Exemption request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/exemption_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/exemption_request_request_body"
}
}
}
}
},
"put": {
"summary": "Update an existing Exemption request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the exemption request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Exemption request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/exemption_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/exemption_request_request_body"
}
}
}
}
}
},
"/registration_requests": {
"get": {
"summary": "Fetch a list of Registration requests",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`status` , `requested_at` , `requester_message`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"status:": {
"summary": "search the 'status' property of the Registration Request records using ':' operator",
"value": "status:enumerated-value"
},
"requested_at:": {
"summary": "search the 'requested_at' property of the Registration Request records using ':' operator",
"value": "requested_at:2000-01-08T20:38:21Z"
},
"requested_at<": {
"summary": "search the 'requested_at' property of the Registration Request records using '<' operator",
"value": "requested_at<2000-01-08T20:38:21Z"
},
"requested_at>": {
"summary": "search the 'requested_at' property of the Registration Request records using '>' operator",
"value": "requested_at>2000-01-08T20:38:21Z"
},
"requester_message:": {
"summary": "search the 'requester_message' property of the Registration Request records using ':' operator",
"value": "requester_message:string"
},
"requester_message~": {
"summary": "search the 'requester_message' property of the Registration Request records using '~' operator",
"value": "requester_message~string"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Registration requests",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A registration request is created when someone requests admin\napproval to register a device with Kolide. Registration requests can\nbe approved or denied by admins.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/registration_request"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/registration_requests?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/registration_requests/{id}": {
"get": {
"summary": "Fetch information for a specific Registration request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the registration request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A registration request is created when someone requests admin\napproval to register a device with Kolide. Registration requests can\nbe approved or denied by admins.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/registration_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
},
"patch": {
"summary": "Update an existing Registration request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the registration request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Registration request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/registration_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/registration_request_request_body"
}
}
}
}
},
"put": {
"summary": "Update an existing Registration request",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the registration request",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "The updated Registration request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/registration_request"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/registration_request_request_body"
}
}
}
}
}
},
"/reporting/tables/{tableName}/table_records": {
"get": {
"summary": "Fetch a list of Table records",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "tableName",
"in": "path",
"required": true,
"description": "The table name of the table record",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Table records",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "There are many tables of data collected by Kolide that are available\nvia the API and reporting interfaces. The attributes included in\neach Table Record will vary based on the table: you can examine\neach table's [documentation](https://app.kolide.com/x/reporting/tables), which will describe the\nstructure of that table's results.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/table_record"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/table_records?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/reporting/tables": {
"get": {
"summary": "Fetch a list of Reporting tables",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Reporting tables",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "There are many tables of data collected by Kolide that are available via the API and reporting interfaces. More information about these tables can be found at: https://www.kolide.com/features/device-inventory/properties",
"type": "array",
"items": {
"$ref": "#/components/schemas/reporting_table"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/tables?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/reporting/tables/{name}": {
"get": {
"summary": "Fetch information for a specific Reporting table",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "name",
"in": "path",
"required": true,
"description": "The name of the reporting table",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "There are many tables of data collected by Kolide that are available via the API and reporting interfaces. More information about these tables can be found at: https://www.kolide.com/features/device-inventory/properties",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reporting_table"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/reporting/queries/{queryId}/results": {
"get": {
"summary": "Fetch a list of Report query results",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "queryId",
"in": "path",
"required": true,
"description": "The query ID of the report query result",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Report query results",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Resultset from executing the reporting query. Schema is dependent on the query projections.",
"type": "array",
"items": {
"$ref": "#/components/schemas/report_query_result"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/results?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/reporting/queries": {
"get": {
"summary": "Fetch a list of Report queries",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "omit_results",
"in": "query",
"schema": {
"type": "string"
},
"description": "In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field.\nHowever, this can lead to timeouts when retrieving queries with large resultsets.\n\nTo improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint (see below).\n\n> Note: The results field is deprecated and will be removed in a future API version.\n\nFor paginated access to query results, use the dedicated endpoint:\n\n```\n/reporting/queries/{queryId}/results\n```\n"
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Report queries",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "A Report Query is a SQL query run against the Reporting Database\nfeature of Kolide.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/report_query"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/queries?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/reporting/queries/{id}": {
"get": {
"summary": "Fetch information for a specific Report query",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "omit_results",
"in": "query",
"schema": {
"type": "string"
},
"description": "In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field.\nHowever, this can lead to timeouts when retrieving queries with large resultsets.\n\nTo improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint (see below).\n\n> Note: The results field is deprecated and will be removed in a future API version.\n\nFor paginated access to query results, use the dedicated endpoint:\n\n```\n/reporting/queries/{queryId}/results\n```\n"
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the report query",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A Report Query is a SQL query run against the Reporting Database\nfeature of Kolide.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/report_query"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/admin_users": {
"get": {
"summary": "Fetch a list of Admin users",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "cursor",
"in": "query",
"description": "Specify the cursor to begin returning results from",
"required": false,
"schema": {
"type": "string",
"default": ""
}
},
{
"name": "per_page",
"in": "query",
"description": "Specify the number of records to return in each response.",
"required": false,
"schema": {
"type": "integer",
"format": "int32",
"maximum": 100,
"minimum": 1,
"default": 25
}
},
{
"name": "query",
"in": "query",
"description": "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`first_name` , `last_name` , `email` , `created_at`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n",
"required": false,
"examples": {
"first_name:": {
"summary": "search the 'first_name' property of the Admin User records using ':' operator",
"value": "first_name:string"
},
"first_name~": {
"summary": "search the 'first_name' property of the Admin User records using '~' operator",
"value": "first_name~string"
},
"last_name:": {
"summary": "search the 'last_name' property of the Admin User records using ':' operator",
"value": "last_name:string"
},
"last_name~": {
"summary": "search the 'last_name' property of the Admin User records using '~' operator",
"value": "last_name~string"
},
"email:": {
"summary": "search the 'email' property of the Admin User records using ':' operator",
"value": "email:string"
},
"email~": {
"summary": "search the 'email' property of the Admin User records using '~' operator",
"value": "email~string"
},
"created_at:": {
"summary": "search the 'created_at' property of the Admin User records using ':' operator",
"value": "created_at:2000-01-08T20:38:21Z"
},
"created_at<": {
"summary": "search the 'created_at' property of the Admin User records using '<' operator",
"value": "created_at<2000-01-08T20:38:21Z"
},
"created_at>": {
"summary": "search the 'created_at' property of the Admin User records using '>' operator",
"value": "created_at>2000-01-08T20:38:21Z"
}
},
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "A paginated collection of Admin users",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"description": "Admin Users are those with access to the Kolide dashboard. Depending\non your organization's restrictions, they are able to view and\nmanage checks, devices, users, and other settings.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/admin_user"
}
},
"pagination": {
"type": "object",
"description": "Information about the current and next pages of results",
"properties": {
"next": {
"type": "string",
"format": "uri",
"description": "The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch",
"example": "https://api.kolide.com/admin_users?per_page=10&cursor=Imyw"
},
"current_cursor": {
"type": "string",
"description": "the pagination cursor used to fetch this page of results",
"example": "Miwy"
},
"next_cursor": {
"type": "string",
"description": "the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch ",
"example": "NCw0"
},
"count": {
"type": "integer",
"description": "the number of records in the current page of results",
"example": 10
}
}
}
}
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
},
"/admin_users/{id}": {
"get": {
"summary": "Fetch information for a specific Admin user",
"parameters": [
{
"name": "x-kolide-api-version",
"in": "header",
"description": "Specify the API version to be used",
"required": false,
"schema": {
"type": "string",
"default": "2023-05-26"
}
},
{
"name": "id",
"in": "path",
"required": true,
"description": "The ID of the admin user",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Admin Users are those with access to the Kolide dashboard. Depending\non your organization's restrictions, they are able to view and\nmanage checks, devices, users, and other settings.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/admin_user"
}
}
}
},
"401": {
"description": "An 'unauthorized' response may occur for features restricted by or unavailable to your organization",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "an error message describing why the endpoint is unavailable",
"example": "This feature has been disabled by your organization"
}
}
}
}
}
},
"403": {
"description": "A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"error": {
"type": "string",
"description": "a succinct error message",
"example": "Forbidden"
},
"message": {
"type": "string",
"description": "A longer-form error message explaining the reason for the response",
"example": "The API key used is not authorized to perform this action"
}
}
}
}
}
}
}
}
}
},
"components": {
"schemas": {
"admin_user": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this admin user"
},
"first_name": {
"type": "string",
"description": "The first name of the admin user"
},
"last_name": {
"type": "string",
"description": "The last name of the admin user"
},
"email": {
"type": "string",
"description": "The email address for this admin user"
},
"created_at": {
"type": "string",
"description": "when the admin user account was created",
"format": "date-time"
},
"access": {
"type": "string",
"description": "The access level granted to this admin user. One of: 'full', 'limited' or 'billing_only'"
},
"restrictions": {
"description": "The feature restrictions applied to this user. This list will be empty unless the user has an access level of 'limited'",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"audit_log_actor": {
"type": "object",
"properties": {
"actor_name": {
"type": "string",
"description": "The name of the entity triggering the event"
},
"actor_email": {
"type": "string",
"description": "The email of the entity triggering the event. Only present for 'User' actors"
},
"actor_type": {
"type": "string",
"description": "The type of entity triggering the event. Is either 'User', 'ApiKey' or 'System', for automated actions such as automatic device removal"
}
}
},
"audit_log": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this audit log"
},
"timestamp": {
"type": "string",
"description": "The timestamp the event occured",
"format": "date-time"
},
"actor_name": {
"type": "string",
"description": "The name of the entity triggering the event"
},
"description": {
"type": "string",
"description": "Description of the event that occured"
},
"actor_info": {
"allOf": [
{
"description": "Describes the entity triggering the event, specifically the actor"
},
{
"$ref": "#/components/schemas/audit_log_actor"
}
]
}
}
},
"auth_log_displayed_issue": {
"type": "object",
"properties": {
"title": {
"type": "string",
"description": "The title of the Issue"
},
"blocking_status": {
"type": "string",
"description": "The blocking status of the Issue - either 'blocked' or 'will_block'"
},
"id": {
"type": "string",
"description": "canonical identifier for the issue"
},
"link": {
"type": "string",
"description": "API URL where complete information about this issue can be found"
}
}
},
"auth_log_event": {
"type": "object",
"properties": {
"timestamp": {
"type": "string",
"description": "The timestamp representing the start of the auth event",
"format": "date-time"
},
"event_type": {
"type": "string",
"description": "The specific event type. Possibilities documented at https://app.kolide.com/docs/admins/auth-logs#event-types"
},
"event_description": {
"type": "string",
"description": "A brief description of the event"
}
}
},
"auth_log_session": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this auth session"
},
"timestamp": {
"type": "string",
"description": "The timestamp representing the start of the auth event",
"format": "date-time"
},
"person_name": {
"type": "string",
"description": "The name of the person triggering the event"
},
"person_email": {
"type": "string",
"description": "The email address of the person triggering the event"
},
"person_info": {
"allOf": [
{
"description": "Information for fetching the complete data on the person triggering this event"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"device_info": {
"allOf": [
{
"description": "Information for fetching the complete data on the device triggering this event"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"result": {
"type": "string",
"enum": [
"Success",
"Fail"
],
"description": "The result of the authentication attempt"
},
"initial_status": {
"type": "string",
"description": "The initial auth status of the device attempting authentication.\nOne of 'all_good', 'will_Block', 'blocked' or 'unknown' if no\ndevice was detected. \"\n"
},
"ip_address": {
"type": "string",
"description": "IP address of the request initiating this event. May be IPv4 or IPv6"
},
"agent_version": {
"type": "string",
"description": "Version of the Kolide Agent running on the endpoint if known"
},
"country": {
"type": "string",
"description": "The name of the country that the session originated from. This\nlocation data is determined via IP address, and is subject to\nthe limitations of IP geocoding. See\nhttps://www.kolide.com/docs/admins/auth-logs for details\non location accuracy.\n"
},
"city": {
"type": "string",
"description": "City that the session originated from. This location data is\ndetermined via IP address, and is subject to the limitations of\nIP geocoding. See https://www.kolide.com/docs/admins/auth-logs\nfor details on location accuracy.\n"
},
"browser_name": {
"type": "string",
"description": "The common name of the browser used to initiate this session.\nSee https://www.kolide.com/docs/admins/auth-logs for\ndetails on browser detection accuracy.\n"
},
"browser_user_agent": {
"type": "string",
"description": "The user agent information for the browser used to initiate this\nsession. See https://www.kolide.com/docs/admins/auth-logs\nfor details on browser detection accuracy.\n"
},
"issues_displayed": {
"description": "A list of Issue titles & blocking status that were displayed to the end user",
"type": "array",
"items": {
"$ref": "#/components/schemas/auth_log_displayed_issue"
}
},
"events": {
"description": "The events that occured during this authentication session",
"type": "array",
"items": {
"$ref": "#/components/schemas/auth_log_event"
}
},
"okta_app_instance_id": {
"type": "string",
"description": "The Okta application instance identifier from the SAML request"
},
"okta_app_name": {
"type": "string",
"description": "The Okta application name from the SAML request"
}
}
},
"check_auth_blocking_config": {
"type": "object",
"properties": {
"blocking_enabled": {
"type": "boolean",
"description": "Whether or not an issue for this check will block device trust authentication"
},
"grace_period_days": {
"type": "integer",
"description": "The number of days that a device is allowed to be failing the check before it will be blocked"
},
"blocking_group_names": {
"description": "The names of the groups that define which devices will be blocked by this check. See also `blocking_exempt_group_names`, as membership in an excluded group will exempt a device from being blocked by this check.",
"type": "array",
"items": {
"type": "string"
}
},
"blocking_exempt_group_names": {
"description": "The names of the Groups that are exempt from being blocked by this check",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"check_configuration": {
"type": "object",
"properties": {
"id": {
"type": "integer",
"description": "The unique identifier for this check configuration"
},
"organization_id": {
"type": "integer",
"description": "The ID of the organization to which this check belongs"
},
"check_id": {
"type": "integer",
"description": "The ID of the check associated with this configuration"
},
"name": {
"type": "string",
"description": "The name of the check associated with the check configuration"
},
"check_slug": {
"type": "string",
"description": "A slugified version of the check name, used for URL paths"
},
"issue_title": {
"type": "string",
"description": "The title of the issue associated with this check"
},
"options": {
"type": "string",
"description": "Additional options for this check configuration. Options are specified on a per-check basis and can be viewed in the UI",
"format": "json"
},
"use_custom_rationale_template": {
"type": "boolean",
"description": "Whether a custom rationale template is used"
},
"use_custom_fix_instructions_template": {
"type": "boolean",
"description": "Whether custom fix instructions are used"
},
"paused": {
"type": "boolean",
"description": "Whether this check is currently paused"
},
"paused_by": {
"type": "string",
"description": "The ID of the user who paused this check configuration"
},
"paused_at": {
"type": "string",
"description": "The timestamp when this check configuration was paused",
"format": "date-time"
},
"revision": {
"type": "string",
"description": "The revision number of this check configuration"
},
"block_auth_grace_period_days": {
"type": "integer",
"description": "Number of days a device is allowed to be out of compliance before blocking"
},
"auth_check_run_shelf_life_seconds": {
"type": "integer",
"description": "Number of seconds a check run is valid for authentication"
},
"begins_blocking_on": {
"type": "string",
"description": "Date when devices start being blocked if out of compliance",
"format": "date-time"
},
"snooze_disallowed": {
"type": "boolean",
"description": "Whether snoozing is disallowed for this check"
},
"exemptions_disallowed": {
"type": "boolean",
"description": "Whether exemption requests are disallowed for this check"
},
"customized_remediation_targeting": {
"type": "boolean",
"description": "Whether remediation targeting is customized for this check"
},
"customized_run_targeting": {
"type": "boolean",
"description": "Whether run targeting is customized for this check"
},
"remediation_strategy": {
"type": "string",
"enum": [
"block_immediately",
"warn_then_block",
"notify_only",
"report_only"
],
"description": "The strategy used for remediating this check"
},
"targeted_groups": {
"description": "List of groups targeted by this check",
"type": "array",
"items": {
"type": "string"
}
},
"excluded_groups": {
"description": "List of groups excluded from this check",
"type": "array",
"items": {
"type": "string"
}
},
"blocking_allowed_groups": {
"description": "List of groups allowed to be blocked by this check",
"type": "array",
"items": {
"type": "string"
}
},
"blocking_excluded_groups": {
"description": "List of groups excluded from being blocked by this check",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"check_configuration_request_body": {
"type": "object",
"properties": {
"paused": {
"type": "boolean",
"description": "Whether this check is currently paused"
},
"block_auth_grace_period_days": {
"type": "integer",
"description": "Number of days a device is allowed to be out of compliance before blocking"
},
"auth_check_run_shelf_life_seconds": {
"type": "integer",
"description": "Number of seconds a check result is considered valid for authentication. If a check result is older than this value at authentication time, it will be re-run during the authentication process."
},
"snooze_disallowed": {
"type": "boolean",
"description": "Whether users are allowed to snooze this check"
},
"exemptions_disallowed": {
"type": "boolean",
"description": "Whether users are allowed to request exemptions for this check"
},
"targeted_groups": {
"description": "List of groups targeted by this check. This field is a combination of group IDs and platform names. For platform names, use 'macos', 'windows', or 'linux'.",
"type": "array",
"items": {
"type": "string"
}
},
"excluded_groups": {
"description": "List of groups excluded from this check. This field is a combination of group IDs and platform names. For platform names, use 'macos', 'windows', or 'linux'.",
"type": "array",
"items": {
"type": "string"
}
},
"blocking_allowed_groups": {
"description": "List of groups allowed to be blocked by this check. This field is a combination of group IDs and platform names. For platform names, use 'macos', 'windows', or 'linux'.",
"type": "array",
"items": {
"type": "string"
}
},
"blocking_excluded_groups": {
"description": "List of groups excluded from being blocked by this check. This field is a combination of group IDs and platform names. For platform names, use 'macos', 'windows', or 'linux'.",
"type": "array",
"items": {
"type": "string"
}
},
"options": {
"type": "string",
"description": "Additional options for this check configuration. Changes to this field will overwrite previous options and any fields not specified here will be deleted. Options are specified on a per-check basis and can be viewed in the UI",
"format": "json"
},
"remediation_strategy": {
"type": "string",
"enum": [
"block_immediately",
"warn_then_block",
"notify_only",
"report_only"
],
"description": "The strategy used for remediating this check"
}
}
},
"check": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this check"
},
"name": {
"type": "string",
"description": "The short description of the state the check is meant to enforce"
},
"slug": {
"type": "string",
"description": "The unique, stable and human-readable identifier for this check"
},
"compatible_platforms": {
"description": "An array of device platforms this check can run on. The platform possibilities are:\n - linux: this check can run on all linux derivations\n - windows: this check can run on all windows devices\n - darwin: this check can run on all versions of macOS\n\nThe compatible platforms determine the default targeting if no custom targeting is configured\n",
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string",
"description": "Longer-form description of the check's purpose and operation"
},
"topics": {
"description": "A list of Kolide-set topics associated with the Check",
"type": "array",
"items": {
"type": "string"
}
},
"osquery_sql_template": {
"type": "string",
"description": "The templated SQL associated with a custom check query that will be run on devices to determine the custom check's status. This SQL may contain liquid variables. This field will be blank if the check is not a custom check. You can learn more about writing your own checks at https://www.kolide.com/docs/admins/checks."
},
"issue_title": {
"type": "string",
"description": "The title of the issue that will be created if the check fails"
},
"fix_instructions_template": {
"type": "string",
"description": "The markdown-formatted template for the fix instructions that will be provided to the user to fix the issue. This may contain liquid variables. You can learn more about customizing fix instructions at https://www.kolide.com/docs/admins/checks#customizing-end-user-fix-instructions."
},
"rationale_template": {
"type": "string",
"description": "The markdown-formatted template for the rationale that will be provided to the user when the check fails. This may contain liquid variables."
},
"check_tags": {
"description": "A list of Team-set tags associated with the Check",
"type": "array",
"items": {
"$ref": "#/components/schemas/check_tag"
}
},
"blocks_auth_configuration": {
"allOf": [
{
"description": "Object describing the authentication-blocking configuration of the check"
},
{
"$ref": "#/components/schemas/check_auth_blocking_config"
}
]
},
"targeting_configuration": {
"allOf": [
{
"description": "Object describing the device targeting configuration of the check"
},
{
"$ref": "#/components/schemas/check_targeting_config"
}
]
},
"percent_passing": {
"type": "integer",
"description": "Percentage of targeted devices currently passing this check (0–100). This value is truncated, not rounded, to avoid showing 100% when not all devices are passing."
},
"kolide_provided": {
"type": "boolean",
"description": "Kolide provided checks are created and maintained by the Kolide team. This field is false for user-created custom checks."
},
"type": {
"type": "string",
"enum": [
"osquery",
"custom",
"external"
],
"description": "The type of check."
}
}
},
"check_refresh": {
"type": "object",
"properties": {
"device_id": {
"type": "string",
"description": "The identifier of the device the check refresh was requested"
},
"check_id": {
"type": "string",
"description": "The identifier of the check to be re-run"
},
"check_refresh_initiated_at": {
"type": "string",
"description": "The UTC timestamp describing the check refresh was initiated",
"format": "date-time"
}
}
},
"check_refresh_request_body": {
"type": "object",
"properties": {
"check_id": {
"type": "string",
"description": "The identifier of the check that should be refreshed on the device"
}
}
},
"check_result": {
"type": "object",
"properties": {
"check_id": {
"type": "string",
"description": "The canonical identifier for the check"
},
"check_slug": {
"type": "string",
"description": "The human-readable stable identifier for this check"
},
"check_name": {
"type": "string",
"description": "The name of the check"
},
"device_id": {
"type": "string",
"description": "The canonical identifier for the device"
},
"device_display_name": {
"type": "string",
"description": "The display name of the device"
},
"ran_at": {
"type": "string",
"description": "The timestamp the check was most recently run on the device",
"format": "date-time"
},
"exemption_reason": {
"type": "string",
"description": "The reason the device was marked as exempt from this check. Null if not exempted"
},
"exemption_expires_at": {
"type": "string",
"description": "The time the exemption expires. Null if not exempted",
"format": "date-time"
},
"check_result_data": {
"description": "The full set of information used to determine the status of the check result",
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"type": "string",
"enum": [
"unknown",
"passing",
"failing",
"errored",
"inapplicable",
"stale",
"pending",
"out_of_scope"
],
"description": "The status of the check"
}
}
},
"check_tag": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this check tag"
},
"name": {
"type": "string",
"description": "The short name of the check tag"
},
"description": {
"type": "string",
"description": "The description of the check tag"
},
"color": {
"type": "string",
"description": "The rgba color value for this tag"
}
}
},
"check_targeting_config": {
"type": "object",
"properties": {
"excluded_groups": {
"description": "A list of names for the groups whose device members are excluded from being targets for this check",
"type": "array",
"items": {
"type": "string"
}
},
"targeted_groups": {
"description": "The names of the groups that define which devices will be targeted by this check. See also `excluded_groups`, as membership in an excluded group will exempt a device from being targeted by this check.",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"deprovisioned_person": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this person"
},
"name": {
"type": "string",
"description": "The human-readable name for this person"
},
"email": {
"type": "string",
"description": "the recorded email address for this person"
},
"created_at": {
"type": "string",
"description": "when the person record was created",
"format": "date-time"
},
"last_authenticated_at": {
"type": "string",
"description": "The timestamp representing when the person last authenticated with Kolide",
"format": "date-time"
},
"has_registered_device": {
"type": "boolean",
"description": "Whether or not this person has at least one registered device"
},
"api_url": {
"type": "string",
"description": "the URL that can be used to fetch information about this one Person"
}
}
},
"device_authentication_mode": {
"type": "object",
"properties": {
"device_id": {
"type": "string",
"description": "The canonical identifier for the device"
},
"authentication_mode": {
"type": "string",
"description": "Authentication mode describing who can authentication with this device. Must be one of: only_registered_owner, only_registered_owner_or_group_members, anyone"
},
"person_groups": {
"description": "Description of the groups allowed to authenticate with this device",
"type": "array",
"items": {
"$ref": "#/components/schemas/person_group"
}
}
}
},
"device_authentication_mode_request_body": {
"type": "object",
"properties": {
"authentication_mode": {
"type": "string",
"description": "Describes the authentication mode for this device. Must be one of: only_registered_owner, only_registered_owner_or_group_members, anyone"
},
"person_group_ids": {
"description": "The identifiers for the groups that should be allowed to\nauthenticate with this device. Ignored if the auth_mode is not\n'only_registered_owner_or_group_members'\n",
"type": "array",
"items": {
"type": "integer"
}
}
}
},
"device": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this device"
},
"name": {
"type": "string",
"description": "The canonical human name for the device. May be edited via the web interface."
},
"registered_at": {
"type": "string",
"description": "The timestamp representing when the device was registered to its current owner",
"format": "date-time"
},
"last_authenticated_at": {
"type": "string",
"description": "The timestamp representing when the device last authenticated with Kolide",
"format": "date-time"
},
"last_seen_at": {
"type": "string",
"description": "The timestamp when the device was last seen by the Kolide agent",
"format": "date-time"
},
"registered_owner_info": {
"allOf": [
{
"description": "Information for fetching the complete data on the registered owner of the device"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"operating_system": {
"type": "string",
"description": "The operating system installed on the device"
},
"hardware_model": {
"type": "string",
"description": "The specific hardware model of the device"
},
"serial": {
"type": "string",
"description": "The hardware serial of the device. May not be applicable"
},
"hardware_uuid": {
"type": "string",
"description": "The hardware UUID/UDID for the device. May not be applicable for some devices"
},
"note": {
"type": "string",
"description": "Notes provided by a Kolide administrator (in markdown format)"
},
"auth_state": {
"type": "string",
"enum": [
"Will Block",
"Blocked",
"Notified",
"Good"
],
"description": "The authorization status of the device, one of: 'Good', 'Notified', 'Will Block' or 'Blocked'"
},
"will_block_at": {
"type": "string",
"description": "If the auth status is 'Will Block', this timestamp describes when the device will be blocked by a failing check",
"format": "date-time"
},
"product_image_url": {
"type": "string",
"description": "The URL of the device's product image"
},
"auth_configuration": {
"allOf": [
{
"description": "Object describing the authentication configuration for the device. Will be null if the device is not registered."
},
{
"$ref": "#/components/schemas/device_authentication_mode"
}
]
},
"device_type": {
"type": "string",
"enum": [
"Mac",
"Linux",
"Windows",
"iOS",
"Android"
],
"description": "The platform type of the device"
},
"form_factor": {
"type": "string",
"enum": [
"Computer",
"Tablet",
"Phone"
],
"description": "The form factor of the device"
}
}
},
"device_group": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this group"
},
"created_at": {
"type": "string",
"description": "A timestamp describing when the device group was created",
"format": "date-time"
},
"name": {
"type": "string",
"description": "The human-readable name for this group"
},
"description": {
"type": "string",
"description": "Longer-form details about this device group"
},
"members_count": {
"type": "integer",
"description": "The number of member devices in this group"
}
}
},
"device_group_member": {
"type": "object",
"properties": {
"device_id": {
"type": "string",
"description": "Identifier of the device belonging to a group"
},
"group_id": {
"type": "string",
"description": "Identifier of the group that the device belongs to"
}
}
},
"device_group_member_request_body": {
"type": "object",
"properties": {
"device_ids": {
"description": "Array of identifiers for the devices to be added to/removed from the group",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"device_registration": {
"type": "object",
"properties": {
"device_id": {
"type": "string",
"description": "The unique identifier for the device registration"
},
"registered_at": {
"type": "string",
"description": "The date and time the device registration was created",
"format": "date-time"
},
"registered_owner_info": {
"allOf": [
{
"description": "Information for fetching the complete data on the registered owner of the device"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"device_info": {
"allOf": [
{
"description": "Information for fetching the complete data on the device"
},
{
"$ref": "#/components/schemas/link-object"
}
]
}
}
},
"exemption_request": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this Exemption Request"
},
"status": {
"type": "string",
"description": "The current status of this exemption request. One of: 'open', 'withdrawn', 'approved', or 'denied'"
},
"internal_explanation": {
"type": "string",
"description": "The internal explanation the admin provided when approving or denying this exemption, for internal documentation. This message is not shown to the person requesting the exemption. This property will be blank if the exemption has not been approved or denied."
},
"denial_explanation": {
"type": "string",
"description": "The message the admin provided for the requester when denying this exemption. This message is meant to be shown to the person requesting the exemption. This property will be blank if the exemption has not been denied."
},
"requested_at": {
"type": "string",
"description": "The timestamp representing when the exemption was requested",
"format": "date-time"
},
"requester_message": {
"type": "string",
"description": "The message the requester provided when asking for this exemption"
},
"requester_information": {
"allOf": [
{
"description": "Information for fetching the complete data on the person who requested this exemption"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"device_information": {
"allOf": [
{
"description": "Information for fetching the complete data about the device for which this exemption was requested"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"issues": {
"description": "A list of the issues the person is requesting exemption from",
"type": "array",
"items": {
"$ref": "#/components/schemas/link-object"
}
}
}
},
"exemption_request_request_body": {
"type": "object",
"properties": {
"status": {
"type": "string",
"description": "Desired status of the exemption request. One of: 'approved' or 'denied'"
},
"internal_message": {
"type": "string",
"description": "The internal explanation for approving or denying this exemption. This message is not shown to the person requesting the exemption, it is only for internal documentation in the audit log. This parameter is required"
},
"denial_explanation": {
"type": "string",
"description": "The message the admin provided for the requester when denying this exemption. This message is meant to be shown to the person requesting the exemption. This parameter is required if the status is 'denied'"
}
}
},
"external_check_run": {
"type": "object",
"properties": {
"check_id": {
"type": "integer",
"description": "The ID of the check"
},
"device_id": {
"type": "integer",
"description": "The ID of the device"
},
"status": {
"type": "string",
"enum": [
"FAIL",
"PASS",
"UNKNOWN",
"INAPPLICABLE",
"ERROR"
],
"description": "The status of the check for the device"
},
"check_data": {
"type": "string",
"description": "Additional data for the check",
"format": "json"
},
"person_id": {
"type": "integer",
"description": "The ID of the person for this check run"
},
"person_name": {
"type": "string",
"description": "The name of the person for this check run"
},
"person_email": {
"type": "string",
"description": "The email of the person for this check run"
}
}
},
"external_check_run_request_body": {
"type": "object",
"properties": {
"device_id": {
"type": "integer",
"description": "The ID of the device. Must pass exactly one of device_id, person_id, or person_email."
},
"person_id": {
"type": "integer",
"description": "The ID of the person. Must pass exactly one of device_id, person_id, or person_email."
},
"person_email": {
"type": "string",
"description": "The email of the person. Falls back to matching an identity email if no person matches directly. Must pass exactly one of device_id, person_id, or person_email."
},
"check_data": {
"type": "string",
"description": "Data for the check result. Must include a KOLIDE_CHECK_STATUS attribute with a value matching one of FAIL, PASS, UNKNOWN, INAPPLICABLE, ERROR. May optionally include additional key-value pairs as extra metadata. May contain one element, or many elements in an array.",
"format": "json"
}
}
},
"issue": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this Issue"
},
"issue_key": {
"type": "string",
"description": "The name of the primary key that distinguishes one Issue from\nanother in the context of a single Check. Only applicable for\nChecks that can produce multiple Issues\n"
},
"issue_value": {
"type": "string",
"description": "The primary identifying value that distinguishes the Issue from\nother instances of the failing Check. Only applicable for Checks\nthat can produce multiple Issues\n"
},
"title": {
"type": "string",
"description": "The short description of the Issue"
},
"value": {
"type": "object",
"description": "Relevant data that describes why the device failed the Check"
},
"exempted": {
"type": "boolean",
"description": "Whether this Issue has been granted an exemption"
},
"resolved_at": {
"type": "string",
"description": "The timestamp when this Issue was resolved. Will be null if the Issue is open.",
"format": "date-time"
},
"detected_at": {
"type": "string",
"description": "A timestamp describing when the Issue was initially detected",
"format": "date-time"
},
"blocks_device_at": {
"type": "string",
"description": "A timestamp describing the time after which the Issue will cause\nthe associated Device to be blocked from authenticating. This\nproperty will be null if the check is not configured to block\nauthentication for the device.\n",
"format": "date-time"
},
"device_information": {
"allOf": [
{
"description": "Information for fetching the complete data on the device for which this issue was generated"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"check_information": {
"allOf": [
{
"description": "Information for fetching the Check that defines the conditions causing this Issue to be generated"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"last_rechecked_at": {
"type": "string",
"description": "The timestamp when this Issue was last rechecked.\n",
"format": "date-time"
}
}
},
"live_query_campaign": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this live query campaign"
},
"name": {
"type": "string",
"description": "The author-supplied title of the live query campaign"
},
"osquery_sql": {
"type": "string",
"description": "The sql to be run on all targeted devices"
},
"created_at": {
"type": "string",
"description": "The creation timestamp of the live query campaign",
"format": "date-time"
},
"published": {
"type": "boolean",
"description": "Describes whether or not the author of the LQ has published the live query (true) or if it is still a draft (false)"
},
"revision": {
"type": "integer",
"description": "Editing a Live Query will increment its revision. When the revision is incremented, the live query will be re-run on all target devices"
},
"tables_used": {
"description": "The names of the tables referenced in the osquery SQL",
"type": "array",
"items": {
"type": "string"
}
},
"successful_devices_count": {
"type": "integer",
"description": "The number of device that have successfully run the query"
},
"errored_devices_count": {
"type": "integer",
"description": "The number of device that returned an error when attempting to run the query"
},
"waiting_devices_count": {
"type": "integer",
"description": "The number of device that have not yet reported results or errors running the device"
}
}
},
"live_query_campaign_request_body": {
"type": "object",
"properties": {
"targeted_device_ids": {
"description": "Target Devices in Live Query",
"type": "array",
"items": {
"type": "integer"
}
},
"target_all_devices": {
"type": "boolean",
"description": "Target All Devices in Live Query"
},
"target_macs": {
"type": "boolean",
"description": "Target all MacOS devices in Live Query"
},
"target_windows_devices": {
"type": "boolean",
"description": "Target all windows devices in Live Query"
},
"target_linux_devices": {
"type": "boolean",
"description": "Target all Linux devices in Live Query"
},
"sql": {
"type": "string",
"description": "The sql to be run on all targeted devices"
},
"name": {
"type": "string",
"description": "The title of the live query"
}
}
},
"live_query_result": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this live query result"
},
"result_count": {
"type": "string",
"description": "Number of rows returned in the result set"
},
"error_message": {
"type": "string",
"description": "Any errors the device may emit while attempting to run a live query"
},
"revision": {
"type": "integer",
"description": "The revision of the parent Live Query this result corresponds to"
},
"warning_message": {
"type": "string",
"description": "Any warnings the device emits while running a live query"
},
"device_information": {
"allOf": [
{
"description": "Information that can be used to fetch the full data on the device that generated this result set"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"results": {
"description": "The returned rows of data for the live query on this device",
"type": "array",
"items": {
"type": "integer"
}
}
}
},
"package": {
"type": "object",
"properties": {
"built_at": {
"type": "string",
"description": "The timestamp describing when the installation package was built",
"format": "date-time"
},
"id": {
"type": "string",
"description": "The unique identifier for the package"
},
"url": {
"type": "string",
"description": "The URL that can be used to download the installation package. Requests to this url require the standard Authorization header needed for all API requests"
},
"version": {
"type": "string",
"description": "The version of the Launcher agent that will be installed by the package"
}
}
},
"person": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this person"
},
"name": {
"type": "string",
"description": "The human-readable name for this person"
},
"email": {
"type": "string",
"description": "the recorded email address for this person"
},
"created_at": {
"type": "string",
"description": "when the person record was created",
"format": "date-time"
},
"last_authenticated_at": {
"type": "string",
"description": "The timestamp representing when the person last authenticated with Kolide",
"format": "date-time"
},
"has_registered_device": {
"type": "boolean",
"description": "Whether or not this person has at least one registered device"
},
"usernames": {
"description": "The usernames imported from the SCIM provider that are associated with this person",
"type": "array",
"items": {
"type": "integer"
}
}
}
},
"person_group": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this group"
},
"name": {
"type": "string",
"description": "The human-readable name for this group"
}
}
},
"registration_request": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this Registration Request"
},
"status": {
"type": "string",
"description": "The current status of this registration request. One of: pending, approved, denied"
},
"requester_message": {
"type": "string",
"description": "The message the person provided when requesting approval for this registration"
},
"internal_denial_note": {
"type": "string",
"description": "The internal explanation the admin provided when denying this request, for internal documentation. This message is not shown to the person requesting the registration approval. This property will be blank if the registration has not been denied."
},
"internal_approval_note": {
"type": "string",
"description": "The internal explanation the admin provided when approving this request, for internal documentation. This message is not shown to the person requesting the registration approval. This property will be blank if the registration has not been approved."
},
"requested_at": {
"type": "string",
"description": "The timestamp representing when the registration approval was requested",
"format": "date-time"
},
"end_user_denial_note": {
"type": "string",
"description": "The message the admin provided for the requester when denying this registration request. This message is meant to be shown to the person requesting the exemption. This property will be blank if the exemption has not been denied"
},
"requester_information": {
"allOf": [
{
"description": "Information for fetching the complete data on the person who requested this registration"
},
{
"$ref": "#/components/schemas/link-object"
}
]
},
"device_information": {
"allOf": [
{
"description": "Information for fetching the complete data about the device the person is trying to register"
},
{
"$ref": "#/components/schemas/link-object"
}
]
}
}
},
"registration_request_request_body": {
"type": "object",
"properties": {
"status": {
"type": "string",
"description": "Desired status of the registration request. One of: 'approved' or 'denied'"
},
"internal_denial_reason": {
"type": "string",
"description": "DEPRECATED: use the 'internal_message' field instead.\nThe internal explanation for denying this request.\nThis message is not shown to the person requesting\nregistration approval, it is only for internal documentation\nin the audit log. This parameter is ignored unless the status is 'denied'.\n"
},
"internal_message": {
"type": "string",
"description": "The internal explanation for approving or denying this request.\nThis message is not shown to the person requesting\nregistration approval, it is only for internal documentation\nin the audit log. This parameter is optional\n"
},
"end_user_denial_message": {
"type": "string",
"description": "The message the admin provided for the requester when denying\nthis registration. This message is meant to be shown to the\nperson requesting registration approval. This parameter is\nrequired if the status is 'denied'\n"
}
}
},
"report_query": {
"type": "object",
"properties": {
"id": {
"type": "integer",
"description": "The canonical identifier for this report query"
},
"name": {
"type": "string",
"description": "The human-readable name for this report query"
},
"osquery_sql": {
"type": "string",
"description": "The SQL query used to generate the report"
},
"result_count": {
"type": "integer",
"description": "Number of rows returned in the result set"
},
"created_at": {
"type": "string",
"description": "when the report query was created",
"format": "date-time"
},
"results": {
"description": "In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field. However, this can lead to timeouts when retrieving queries with large resultsets. To improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint: `/reporting/queries/{queryId}/results`.",
"type": "array",
"items": {
"type": "object"
}
}
}
},
"report_query_result": {
"type": "object",
"properties": {}
},
"reporting_table": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The name of the table"
},
"category": {
"type": "string",
"description": "The category of the table"
},
"description": {
"type": "string",
"description": "The description of the table"
},
"column_names": {
"description": "The names of the columns in the table",
"type": "array",
"items": {
"type": "integer"
}
},
"searchable_fields": {
"description": "Fields that can be filtered using the query parameter on the table_records endpoint",
"type": "array",
"items": {
"type": "integer"
}
},
"documentation_url": {
"type": "string",
"description": "A link to the detailed documentation for this table"
}
}
},
"resolved_issue": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The canonical identifier for this Issue"
},
"check_id": {
"type": "string",
"description": "The identifier of the Check that produced this Issue"
},
"device_id": {
"type": "string",
"description": "The identifier of the Device that failed the Check"
},
"title": {
"type": "string",
"description": "The short description of the Issue"
},
"value": {
"type": "object",
"description": "Relevant data that describes why the device failed the Check"
},
"resolved_at": {
"type": "string",
"description": "A timestamp describing when the Issue was resolved",
"format": "date-time"
}
}
},
"table_record": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique identifier for this table record"
}
}
},
"who_am_i": {
"type": "object",
"properties": {
"organization_id": {
"type": "string",
"description": "The canonical identifier for this Organization"
},
"organization_name": {
"type": "string",
"description": "The name of this Organization"
}
}
},
"link-object": {
"type": "object",
"properties": {
"identifier": {
"type": "string",
"description": "the canonical identifier for this object"
},
"location": {
"type": "string",
"format": "url",
"description": "the API URL where complete information about this object can be found"
}
}
}
},
"securitySchemes": {
"api_key": {
"type": "http",
"scheme": "bearer"
}
}
}
}