Skip to content
Cloudflare API
Start here
API Reference
Zero Trust
Devices

Posture

List device posture rules
client.zeroTrust.devices.posture.list(PostureListParams { account_id } params, RequestOptionsoptions?): SinglePage<DevicePostureRule { id, description, expiration, 5 more } >
GET/accounts/{account_id}/devices/posture
Get device posture rule details
client.zeroTrust.devices.posture.get(stringruleId, PostureGetParams { account_id } params, RequestOptionsoptions?): DevicePostureRule { id, description, expiration, 5 more } | null
GET/accounts/{account_id}/devices/posture/{rule_id}
Create a device posture rule
client.zeroTrust.devices.posture.create(PostureCreateParams { account_id, name, type, 5 more } params, RequestOptionsoptions?): DevicePostureRule { id, description, expiration, 5 more } | null
POST/accounts/{account_id}/devices/posture
Update a device posture rule
client.zeroTrust.devices.posture.update(stringruleId, PostureUpdateParams { account_id, name, type, 5 more } params, RequestOptionsoptions?): DevicePostureRule { id, description, expiration, 5 more } | null
PUT/accounts/{account_id}/devices/posture/{rule_id}
Delete a device posture rule
client.zeroTrust.devices.posture.delete(stringruleId, PostureDeleteParams { account_id } params, RequestOptionsoptions?): PostureDeleteResponse { id } | null
DELETE/accounts/{account_id}/devices/posture/{rule_id}
ModelsExpand Collapse
CarbonblackInput = string
ClientCertificateInput { certificate_id, cn }
certificate_id: string

UUID of Cloudflare managed certificate.

maxLength36
cn: string

Common Name that is protected by the certificate.

CrowdstrikeInput { connection_id, last_seen, operator, 6 more }
connection_id: string

Posture Integration ID.

last_seen?: string

For more details on last seen, please refer to the Crowdstrike documentation.

operator?: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
os?: string

Os Version.

overall?: string

Overall.

sensor_config?: string

SensorConfig.

state?: "online" | "offline" | "unknown"

For more details on state, please refer to the Crowdstrike documentation.

One of the following:
"online"
"offline"
"unknown"
version?: string

Version.

versionOperator?: "<" | "<=" | ">" | 2 more

Version Operator.

One of the following:
"<"
"<="
">"
">="
"=="
DeviceInput = FileInput { operating_system, path, exists, 2 more } | UniqueClientIDInput { id, operating_system } | DomainJoinedInput { operating_system, domain } | 17 more

The value to be checked against.

One of the following:
FileInput { operating_system, path, exists, 2 more }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

File path.

exists?: boolean

Whether or not file exists.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

UniqueClientIDInput { id, operating_system }
id: string

List ID.

operating_system: "android" | "ios" | "chromeos"

Operating System.

One of the following:
"android"
"ios"
"chromeos"
DomainJoinedInput { operating_system, domain }
operating_system: "windows"

Operating System.

domain?: string

Domain.

OSVersionInput { operating_system, operator, version, 3 more }
operating_system: "windows"

Operating System.

operator: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
version: string

Version of OS.

os_distro_name?: string

Operating System Distribution Name (linux only).

os_distro_revision?: string

Version of OS Distribution (linux only).

os_version_extra?: string

Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.

FirewallInput { enabled, operating_system }
enabled: boolean

Enabled.

operating_system: "windows" | "mac"

Operating System.

One of the following:
"windows"
"mac"
SentineloneInput { operating_system, path, sha256, thumbprint }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

File path.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

TeamsDevicesCarbonblackInputRequest { operating_system, path, sha256, thumbprint }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

File path.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

TeamsDevicesAccessSerialNumberListInputRequest { id }
id: string

UUID of Access List.

maxLength36
DiskEncryptionInput { checkDisks, requireAll }
checkDisks?: Array<CarbonblackInput>

List of volume names to be checked for encryption.

requireAll?: boolean

Whether to check all disks for encryption.

TeamsDevicesApplicationInputRequest { operating_system, path, sha256, thumbprint }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

Path for the application.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

ClientCertificateInput { certificate_id, cn }
certificate_id: string

UUID of Cloudflare managed certificate.

maxLength36
cn: string

Common Name that is protected by the certificate.

TeamsDevicesClientCertificateV2InputRequest { certificate_id, check_private_key, operating_system, 4 more }
certificate_id: string

UUID of Cloudflare managed certificate.

maxLength36
check_private_key: boolean

Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.

operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
cn?: string

Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables.

extended_key_usage?: Array<"clientAuth" | "emailProtection">

List of values indicating purposes for which the certificate public key can be used.

One of the following:
"clientAuth"
"emailProtection"
locations?: Locations { paths, trust_stores }
paths?: Array<string>

List of paths to check for client certificate on linux.

trust_stores?: Array<"system" | "user">

List of trust stores to check for client certificate.

One of the following:
"system"
"user"
subject_alternative_names?: Array<string>

List of certificate Subject Alternative Names.

TeamsDevicesAntivirusInputRequest { update_window_days }
update_window_days?: number

Number of days that the antivirus should be updated within.

WorkspaceOneInput { compliance_status, connection_id }
compliance_status: "compliant" | "noncompliant" | "unknown"

Compliance Status.

One of the following:
"compliant"
"noncompliant"
"unknown"
connection_id: string

Posture Integration ID.

CrowdstrikeInput { connection_id, last_seen, operator, 6 more }
connection_id: string

Posture Integration ID.

last_seen?: string

For more details on last seen, please refer to the Crowdstrike documentation.

operator?: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
os?: string

Os Version.

overall?: string

Overall.

sensor_config?: string

SensorConfig.

state?: "online" | "offline" | "unknown"

For more details on state, please refer to the Crowdstrike documentation.

One of the following:
"online"
"offline"
"unknown"
version?: string

Version.

versionOperator?: "<" | "<=" | ">" | 2 more

Version Operator.

One of the following:
"<"
"<="
">"
">="
"=="
IntuneInput { compliance_status, connection_id }
compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more

Compliance Status.

One of the following:
"compliant"
"noncompliant"
"unknown"
"notapplicable"
"ingraceperiod"
"error"
connection_id: string

Posture Integration ID.

KolideInput { connection_id, countOperator, issue_count }
connection_id: string

Posture Integration ID.

countOperator?: "<" | "<=" | ">" | 2 more

Count Operator.

One of the following:
"<"
"<="
">"
">="
"=="
issue_count?: string

The Number of Issues.

TaniumInput { connection_id, eid_last_seen, operator, 3 more }
connection_id: string

Posture Integration ID.

eid_last_seen?: string

For more details on eid last seen, refer to the Tanium documentation.

operator?: "<" | "<=" | ">" | 2 more

Operator to evaluate risk_level or eid_last_seen.

One of the following:
"<"
"<="
">"
">="
"=="
risk_level?: "low" | "medium" | "high" | "critical"

For more details on risk level, refer to the Tanium documentation.

One of the following:
"low"
"medium"
"high"
"critical"
scoreOperator?: "<" | "<=" | ">" | 2 more

Score Operator.

One of the following:
"<"
"<="
">"
">="
"=="
total_score?: number

For more details on total score, refer to the Tanium documentation.

SentineloneS2sInput { connection_id, active_threats, infected, 4 more }
connection_id: string

Posture Integration ID.

active_threats?: number

The Number of active threats.

infected?: boolean

Whether device is infected.

is_active?: boolean

Whether device is active.

network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"

Network status of device.

One of the following:
"connected"
"disconnected"
"disconnecting"
"connecting"
operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more

Agent operational state.

One of the following:
"na"
"partially_disabled"
"auto_fully_disabled"
"fully_disabled"
"auto_partially_disabled"
"disabled_error"
"db_corruption"
operator?: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
TeamsDevicesCustomS2sInputRequest { connection_id, operator, score }
connection_id: string

Posture Integration ID.

operator: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
score: number

A value between 0-100 assigned to devices set by the 3rd party posture provider.

DeviceMatch { platform }
platform?: "windows" | "mac" | "linux" | 3 more
One of the following:
"windows"
"mac"
"linux"
"android"
"ios"
"chromeos"
DevicePostureRule { id, description, expiration, 5 more }
id?: string

API UUID.

maxLength36
description?: string

The description of the device posture rule.

expiration?: string

Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.

input?: DeviceInput

The value to be checked against.

match?: Array<DeviceMatch { platform } >

The conditions that the client must match to run the rule.

platform?: "windows" | "mac" | "linux" | 3 more
One of the following:
"windows"
"mac"
"linux"
"android"
"ios"
"chromeos"
name?: string

The name of the device posture rule.

schedule?: string

Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m.

type?: "file" | "application" | "tanium" | 20 more

The type of device posture rule.

One of the following:
"file"
"application"
"tanium"
"gateway"
"warp"
"disk_encryption"
"serial_number"
"sentinelone"
"carbonblack"
"firewall"
"os_version"
"domain_joined"
"client_certificate"
"client_certificate_v2"
"antivirus"
"unique_client_id"
"kolide"
"tanium_s2s"
"crowdstrike_s2s"
"intune"
"workspace_one"
"sentinelone_s2s"
"custom_s2s"
DiskEncryptionInput { checkDisks, requireAll }
checkDisks?: Array<CarbonblackInput>

List of volume names to be checked for encryption.

requireAll?: boolean

Whether to check all disks for encryption.

DomainJoinedInput { operating_system, domain }
operating_system: "windows"

Operating System.

domain?: string

Domain.

FileInput { operating_system, path, exists, 2 more }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

File path.

exists?: boolean

Whether or not file exists.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

FirewallInput { enabled, operating_system }
enabled: boolean

Enabled.

operating_system: "windows" | "mac"

Operating System.

One of the following:
"windows"
"mac"
IntuneInput { compliance_status, connection_id }
compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more

Compliance Status.

One of the following:
"compliant"
"noncompliant"
"unknown"
"notapplicable"
"ingraceperiod"
"error"
connection_id: string

Posture Integration ID.

KolideInput { connection_id, countOperator, issue_count }
connection_id: string

Posture Integration ID.

countOperator?: "<" | "<=" | ">" | 2 more

Count Operator.

One of the following:
"<"
"<="
">"
">="
"=="
issue_count?: string

The Number of Issues.

OSVersionInput { operating_system, operator, version, 3 more }
operating_system: "windows"

Operating System.

operator: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
version: string

Version of OS.

os_distro_name?: string

Operating System Distribution Name (linux only).

os_distro_revision?: string

Version of OS Distribution (linux only).

os_version_extra?: string

Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.

SentineloneInput { operating_system, path, sha256, thumbprint }
operating_system: "windows" | "linux" | "mac"

Operating system.

One of the following:
"windows"
"linux"
"mac"
path: string

File path.

sha256?: string

SHA-256.

thumbprint?: string

Signing certificate thumbprint.

SentineloneS2sInput { connection_id, active_threats, infected, 4 more }
connection_id: string

Posture Integration ID.

active_threats?: number

The Number of active threats.

infected?: boolean

Whether device is infected.

is_active?: boolean

Whether device is active.

network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"

Network status of device.

One of the following:
"connected"
"disconnected"
"disconnecting"
"connecting"
operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more

Agent operational state.

One of the following:
"na"
"partially_disabled"
"auto_fully_disabled"
"fully_disabled"
"auto_partially_disabled"
"disabled_error"
"db_corruption"
operator?: "<" | "<=" | ">" | 2 more

Operator.

One of the following:
"<"
"<="
">"
">="
"=="
TaniumInput { connection_id, eid_last_seen, operator, 3 more }
connection_id: string

Posture Integration ID.

eid_last_seen?: string

For more details on eid last seen, refer to the Tanium documentation.

operator?: "<" | "<=" | ">" | 2 more

Operator to evaluate risk_level or eid_last_seen.

One of the following:
"<"
"<="
">"
">="
"=="
risk_level?: "low" | "medium" | "high" | "critical"

For more details on risk level, refer to the Tanium documentation.

One of the following:
"low"
"medium"
"high"
"critical"
scoreOperator?: "<" | "<=" | ">" | 2 more

Score Operator.

One of the following:
"<"
"<="
">"
">="
"=="
total_score?: number

For more details on total score, refer to the Tanium documentation.

UniqueClientIDInput { id, operating_system }
id: string

List ID.

operating_system: "android" | "ios" | "chromeos"

Operating System.

One of the following:
"android"
"ios"
"chromeos"
WorkspaceOneInput { compliance_status, connection_id }
compliance_status: "compliant" | "noncompliant" | "unknown"

Compliance Status.

One of the following:
"compliant"
"noncompliant"
"unknown"
connection_id: string

Posture Integration ID.

PostureDeleteResponse { id }
id?: string

API UUID.

maxLength36

PostureIntegrations

List your device posture integrations
client.zeroTrust.devices.posture.integrations.list(IntegrationListParams { account_id } params, RequestOptionsoptions?): SinglePage<Integration { id, config, interval, 2 more } >
GET/accounts/{account_id}/devices/posture/integration
Get device posture integration details
client.zeroTrust.devices.posture.integrations.get(stringintegrationId, IntegrationGetParams { account_id } params, RequestOptionsoptions?): Integration { id, config, interval, 2 more } | null
GET/accounts/{account_id}/devices/posture/integration/{integration_id}
Create a device posture integration
client.zeroTrust.devices.posture.integrations.create(IntegrationCreateParams { account_id, config, interval, 2 more } params, RequestOptionsoptions?): Integration { id, config, interval, 2 more } | null
POST/accounts/{account_id}/devices/posture/integration
Update a device posture integration
client.zeroTrust.devices.posture.integrations.edit(stringintegrationId, IntegrationEditParams { account_id, config, interval, 2 more } params, RequestOptionsoptions?): Integration { id, config, interval, 2 more } | null
PATCH/accounts/{account_id}/devices/posture/integration/{integration_id}
Delete a device posture integration
client.zeroTrust.devices.posture.integrations.delete(stringintegrationId, IntegrationDeleteParams { account_id } params, RequestOptionsoptions?): IntegrationDeleteResponse | null
DELETE/accounts/{account_id}/devices/posture/integration/{integration_id}
ModelsExpand Collapse
Integration { id, config, interval, 2 more }
id?: string

API UUID.

maxLength36
config?: Config { api_url, auth_url, client_id }

The configuration object containing third-party integration information.

api_url: string

The Workspace One API URL provided in the Workspace One Admin Dashboard.

auth_url: string

The Workspace One Authorization URL depending on your region.

client_id: string

The Workspace One client ID provided in the Workspace One Admin Dashboard.

interval?: string

The interval between each posture check with the third-party API. Use m for minutes (e.g. 5m) and h for hours (e.g. 12h).

name?: string

The name of the device posture integration.

type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more

The type of device posture integration.

One of the following:
"workspace_one"
"crowdstrike_s2s"
"uptycs"
"intune"
"kolide"
"tanium_s2s"
"sentinelone_s2s"
"custom_s2s"
IntegrationDeleteResponse = unknown | string | null
One of the following:
unknown
string