Skip to main content
Get all the endpoints for the specified tenant.
External DocumentationTo learn more, visit the Sophos documentation.

​
Basic Parameters

ParameterDescription
Health StatusFind endpoints by health status.
Hostname ContainsFind endpoints where the hostname contains the given string. Only the first 10 characters of the given string are matched.
Isolation StatusFind endpoints by isolation status.
Lockdown StatusFind endpoints by lockdown status.
SearchTerm to search for in the specified search fields.
SortA comma-separated list of sorting criteria, for example: lastSeenAs:asc,hostname:desc. For more information about this parameter, refer to Sophos’s documentation.
TypeA comma-seperated list of types to query the endpoints by.
ViewType of view to be returned in response.

​
Advanced Parameters

ParameterDescription
Associated Person ContainsFind endpoints where the name of the person associated with the endpoint contains the given string. Only the first 10 characters of the given string are matched.
CloudFind endpoints that are cloud instances. You must use URL encoding.
FieldsThe fields to return in a partial response.
Group IDsA comma-seperated list of group IDs to query endpoints by.
Group Name ContainsFind endpoints where the name of the group the endpoint is in contains the given string. Only the first 10 characters of the given string are matched.
IDsA comma-seperated list of IDs to query the endpoints by.
IP AddressesA comma-seperated list of IP addresses to query the endpoints by.
Last Seen AfterFind endpoints that were last seen after the given date and time (UTC) or a duration relative to the current date and time (inclusive).
Last Seen BeforeFind endpoints that were last seen before the given date and time (UTC) or a duration relative to the current date and time (exclusive).
MAC AddressesA comma seperated list of MAC Addresses to query the endpoints by.
Note: Can be in EUI-48 or EUI-64 format, case insensitive, colon, hyphen or dot separated, or with no separator e.g. 01:23:45:67:89:AB, 01-23-45-67-89-ab, 0123.4567.89ab, 0123456789ab, 01:23:45:67:89:ab:cd:ef.
Page From KeyThe key of the item from where to fetch a page.
Page SizeThe size of the page requested.
Page TotalWhether the number of pages should be calculated and returned in the response.
Search FieldsA comma-separated list of fields for finding the given search term. Defaults to all applicable fields.
Tamper Protection EnabledFind endpoints by whether Tamper Protection is turned on.

​
Example Output

{
	"items": [
		{
			"assignedProducts": [
				{
					"code": "Endpoint product.",
					"status": "Installation status of a product assigned to the endpoint.",
					"version": "Version of a product assigned to an endpoint."
				}
			],
			"associatedPerson": {
				"id": "Unique ID for the Person.",
				"name": "Person's name.",
				"viaLogin": "Person's login on the endpoint."
			},
			"cloud": {
				"instanceId": "Unique ID for the cloud instance.",
				"provider": "Cloud provider in which the endpoint is running."
			},
			"encryption": {
				"volumes": [
					{
						"status": "Endpoint volume encryption status.",
						"volumeId": "Endpoint volume ID."
					}
				]
			},
			"group": {
				"id": "Unique ID for endpoint group.",
				"name": "Endpoint group name."
			},
			"health": {
				"overall": "Health status of an endpoint or a service running on an endpoint.",
				"services": {
					"serviceDetails": [
						{
							"name": "Service name.",
							"status": "Status of a service on an endpoint."
						}
					],
					"status": "Health status of an endpoint or a service running on an endpoint."
				},
				"threats": {
					"status": "Health status of an endpoint or a service running on an endpoint."
				}
			},
			"hostname": "Hostname of the endpoint.",
			"id": "Unique ID for the endpoint.",
			"ipv4Addresses": [
				"string"
			],
			"ipv6Addresses": [
				"string"
			],
			"isolation": {
				"adminIsolated": false,
				"selfIsolated": false,
				"status": "Isolation status reported by endpoint."
			},
			"lastSeenAt": "2019-09-23T12:02:01.700Z",
			"lockdown": {
				"status": "Endpoint lockdown status.",
				"updateStatus": "Endpoint lockdown update status."
			},
			"macAddresses": [
				"string"
			],
			"online": false,
			"os": {
				"build": 0,
				"isServer": false,
				"majorVersion": 0,
				"minorVersion": 0,
				"name": "OS name as reported by the endpoint.",
				"platform": "OS platform type."
			},
			"tamperProtectionEnabled": false,
			"tenant": {
				"id": "The ID of the referenced object."
			},
			"type": "Endpoint type."
		}
	],
	"pages": {
		"fromKey": "The key of the first item in the returned page.",
		"items": 0,
		"maxSize": 0,
		"nextKey": "The key to use when fetching the next page.",
		"size": 0,
		"total": 0
	}
}

​
Workflow Library Example

List Endpoints with Sophos and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop