Retrieves BitLocker recovery key records (key protector ID, drive letter, computer, domain) for managed computers, filterable by key protector ID, computer name, or domain. SENSITIVE: this endpoint returns BitLocker recovery keys — secrets that unlock encrypted drives. Only use it when key retrieval is genuinely needed (e.g. recovering a locked-out drive), never for routine reporting. The default response deliberately omits the recovery_key field; set raw: true to expose the actual key material.

Retrieves drive-level BitLocker encryption details across managed computers: encryption status, protection status, encryption method, lock status, drive letter, and drive size per volume. Supports filtering by computer resource_id or domain.

Retrieves Trusted Platform Module (TPM) details across managed computers: manufacturer, version, spec version, and whether the TPM is enabled, activated, and owned. Supports filtering by computer resource_id or domain.

Retrieves the list of existing custom data type names defined for custom fields, and whether any custom data types exist at all. Useful before creating or updating custom fields.

Retrieves the maximum number of characters allowed for the user data type of a specific custom field.

Checks whether a custom (user) data type with the given name is already defined in the system.

Retrieves the custom field metadata linked to a specific computer: display name, actual column name (e.g. COL301), data type, max allowed size, input format, default and current values, and PII flag. Use this to discover the actualColumnName needed by the custom column modify/remove tools.

Retrieves the custom field values linked to a specific resource (owner, location, product number, shipping/expiry dates, notes, search tag, and any user-defined fields).

Retrieves all custom groups with their group ID, name, type (e.g. Computers), category (e.g. Static, Dynamic), associated domain, and creation/modification timestamps (epoch millis).

Retrieves all devices that were blocked across the network (Device Control Management): device type, vendor/product, serial number, user, computer, and insert/remove times. Supports filters for time period, computer, group, device type, OS platform, and domain.

Retrieves per-computer device control status for all Windows computers: one record per computer with a status ID for each device class (disk drive, CD-ROM, WPD, Bluetooth, printer, etc.). Curated default omits legacy port classes; use raw: true for every device class.

Retrieves all device activity events detected across the network (Device Control Management): device type, vendor/product, serial number, user, computer, insert/remove times, and whether access was blocked. Supports filters for time period, computer, group, device type, block status, OS platform, and domain.

Retrieves devices granted temporary exemptions from device control policies, with the policy, target computer/user, exemption window, and status. Supports filters for time period, OS platform, device type, exemption status, and domain.

Retrieves the list of unique devices detected in the network (Device Control Management), with connection counts, last occurrence, and block status per device. Supports filters for OS platform, device type, and block status.

Retrieves device types (whole classes, e.g. all disk drives) granted temporary exemptions from device control policies, with the policy, target computer/user, exemption window, and status. Supports filters for time period, OS platform, device type, exemption status, and domain.

Retrieves file shadow (mirror copy) operations performed for files transferred to removable devices: source file, shadow path, device, user, computer, and operation status. Supports filters for time period, computer, group, domain, shadow status, and last-N-days activity.

Retrieves file activities (create, open, modify, delete, rename, move, copy, read) detected on devices across the network: file name/size, event type, process, device, user, and computer. Supports filters for event type, file extension or extension group, block status, device instance path, time period, computer, group, and domain.

Retrieves per-computer device control status for all Mac computers: one record per computer with a status ID for each device class (disk drive, CD-ROM, WPD, Bluetooth, printer, etc.).

Retrieves the Digital Employee Experience (DEX) addon module status and device counts: moduleStatus (0 disabled, 1 enabled, 2 selectively enabled), total managed devices, and how many devices DEX manages. Useful as a first check that DEX is licensed and active before calling the score tools.

Retrieves the DEX experience overview for one device under a score profile: baseline and current experience scores, overall score health (0 poor, 1 average, 2 good, 3 unknown), OS name/version, device name, model, type, platform, last logged-on user, and when the score was last updated.

Retrieves the indicator-wise DEX metric breakdown for one device under a score profile: for each indicator (e.g. Device Performance, Application Reliability) the individual metrics with their score, health (0 poor, 1 average, 2 good, 3 unknown), display name, and a human-readable summary line. Optionally restrict to only the metrics that currently have issues.

Retrieves the most recent time the DEX experience score summary was generated. Useful for judging how fresh the scores returned by the other dex_* tools are.

Retrieves the most recent DEX experience score for a score profile: overall score, health (0 poor, 1 average, 2 good, 3 unknown), baseline score, change from the previous day, and per-category scores (Device Performance, Application Reliability, etc.). Optionally scope the score to a single device, a remote office, or a custom group.

Retrieves DEX module configuration and feature flags: ruleset ID, extension/chatbot/timeline/sentiment status, whether initial score data has been prepared, and lastVisitedProfileId — a score profile ID usable as scoreProfileId in the dex_device_experience, dex_device_experience_metrics, and dex_latest_experience_scores tools.

Retrieves the scheduled time of the next DEX experience score summary generation — i.e. when the scores returned by the other dex_* tools will next be refreshed.

Retrieves all DLP activities performed on endpoints: user, file path, boundary application/domain, Leak Prevention action taken (allowed/blocked/self override/reported false positive), and sensitivity classification details. Supports filtering by action and pagination.

Retrieves business justification messages provided by endpoint users when overriding DLP restrictions, with the boundary type/value, event type, override comment, and event time. Supports filtering by justification message and pagination.

Retrieves false positives reported by endpoints in the enterprise perimeter (containment boundaries), listing each boundary value (printer, domain, device, ...) with the number of endpoints that raised false positives against it. Supports filtering by boundary type and pagination.

Retrieves false positives reported by endpoints for data rule violations, listing each triggered DLP data rule with the number of endpoints that reported false positives against it. Supports filtering by rule class and pagination.

Retrieves all hardware devices (by device instance path) known to DLP with their custom group association count. Supports pagination.

Retrieves all email domains deployed in DLP policies across the network, with the number of custom groups each domain is associated with. Supports pagination.

Retrieves all network printers deployed in DLP policies, with the number of custom groups each printer is associated with. Supports pagination.

Retrieves all enterprise applications deployed in DLP policies across the network, with the number of custom groups each application is associated with. Supports pagination.

Retrieves all DLP data rules deployed in the network, with the number of custom groups each rule is associated with. Supports filtering by rule class and pagination.

Retrieves all USB printers deployed in DLP policies (by device instance path), with the number of custom groups each USB printer is associated with. Supports pagination.

Retrieves all web domains deployed in DLP policies across the network, with the number of custom groups each domain is associated with. Supports pagination.

Retrieves the overall Inventory module summary: scan/audit status counts, software counts (commercial, non-commercial, prohibited), license compliance summary, computers by OS, and warranty summary.

Retrieves the detailed inventory summary for one computer: asset counts, OS details, disk usage, hardware summary (model, processor, memory, serial number, warranty), and network adapters.

Retrieves the computers that have a specific hardware component (by hardware_id from inventory_hardware_list), with model, service tag, RAM, warranty, and computer details.

Retrieves the computers associated with a specific software license (by license_id from inventory_licenses_list), with the license name and computer details.

Retrieves the computers associated with a specific licensed software (by licensed software id from inventory_license_software_list), including which license each computer maps to.

Retrieves the computers on which a specific prohibited software (by software_id from inventory_prohibited_software_list) is detected, with install location and exception-request counts (approved, pending, rejected, not requested).

Retrieves the computers on which a specific software (by software_id from inventory_software_list) is installed, with install date, version, and computer details.

Retrieves the computers tracked by a specific software metering rule (by app_definition_id from inventory_software_metering_summary), with per-computer usage: total run time, run count, and last used.

Retrieves the valid values for inventory filters: OS names, software categories, software/hardware/computer manufacturers, and hardware types. Use these values with the filter inputs of other inventory tools.

Retrieves all detected hardware components across the network with manufacturer, hardware type, and managed/network installation counts. Use inventory_filter_params for valid filter values.

Retrieves the software installed on a specific computer with version, manufacturer, category, install format, license/compliance status, and whether usage is prohibited.

Retrieves the licenses recorded for a specific software (by software_id) with license name, edition, copies, mapped computer count, purchase/expiry dates, and purchase details. License key and file-path fields are available via raw: true.

Retrieves all software that has license records, with total/installed/remaining copies, compliance status (under/over licensed, in compliance, expired), and network installation counts.

Retrieves prohibited software detected across the network with installation counts, installer format (MSI/EXE), and whether silent uninstallation is supported.

Retrieves all inventory computers with their scan status (not done/failed/in progress/success), agent installation status, live status, and last successful scan time.

Retrieves all software detected across the network with version, manufacturer, category, installation counts, license copies, and compliance status.

Retrieves all software metering rules with usage metrics across the network: total run time, run count, discovered installation count, and rule metadata. Use app_definition_id with inventory_computers_with_metering to see per-computer usage.

Retrieves the installation status of a specific patch (by patch_id) on every applicable computer: which systems have it installed, which are missing it, and deployment remarks. Supports filtering and pagination.

Retrieves the complete list of patches applicable to managed systems, with per-patch installed/missing/failed system counts, severity, approval status, and download status. Supports filtering and pagination.

Retrieves all managed systems with their patch health status (healthy/vulnerable/highly vulnerable), missing and installed patch counts by type and severity, and last scan/patch times. Supports filtering and pagination.

Retrieves all Automatic Patch Deployment (APD) tasks with their task name, ID, platform, target count, collection status, creator, and creation/modification times. Use this to discover the task_name values required by the APD suspend/resume/delete tools. On-premise only — this endpoint does not exist on Endpoint Central Cloud.

Retrieves the current patch approval settings — whether newly supported patches are approved automatically or require manual approval.

Retrieves the status of the ongoing or most recent vulnerability/patch database update: last update status and time, next scheduled update, and whether automatic DB updates are disabled.

Retrieves all patch deployment policies (deployment templates) configured in Endpoint Central, with their IDs, names, default flag, and creation/modification metadata. Supports pagination.

Retrieves the details of all patch binaries downloaded to the Endpoint Central server, including download status, time, size, and remarks. Supports pagination.

Retrieves the configured system health policy: the missing-patch count thresholds per severity that classify a system as vulnerable or highly vulnerable, plus advanced settings (exclude third-party apps, consider only approved patches).

Retrieves all systems with their patch scan status (success/failed/in progress/not scanned), scan remarks, last scan times, agent details, and patch health. Supports filtering and pagination.

Retrieves the patch module summary: installed/missing/applicable patch counts, missing-patch severity breakdown, system health summary, scan summary, APD task summary, and vulnerability DB update status.

Retrieves the catalog of all patches supported and manageable by Endpoint Central (not just those applicable to current systems), with severity, approval status, and download status. Supports filtering and pagination.

Retrieves every patch applicable to a specific computer (by resource_id) with its install status (installed/missing/failed), approval status, severity, deployment remarks, and install time. Supports filtering and pagination.

Retrieves all patch deployment configurations with their execution status and per-target success/failure/yet-to-apply counts. Supports filtering by execution status and pagination.

Fetches the rows of a specific custom report by its view name (the viewName from reports_custom_reports_list). Columns and output size depend entirely on how the report was built, so prefer a small pageLimit on first call. Default output is condensed to columns, row values, and navigation info; raw: true returns the full table response.

Retrieves all custom reports available to the API user with their report ID, label, owner, view name, description, and last-modified time. Use a report's viewName with reports_custom_report_data to fetch its rows.

Fetches the rows and column metadata of a specific query report by its numeric report ID (from reports_query_reports_list). Rows are returned as-is: their shape and output size depend entirely on the report's underlying query, so prefer a small limit on first call.

Retrieves all query reports defined in Endpoint Central with their report ID, label, owner, view name, description, and last-modified time. Use a report's id with reports_query_report_data to fetch its rows.

Retrieves the Endpoint Central server's login configuration: whether it accepts local authentication only, which Active Directory domains are enabled for authentication, and the default domain. Useful for confirming connectivity and identifying the AD domain a service account belongs to. This is the one endpoint that requires no authentication, so it also succeeds when the API token is invalid.

Retrieves the Endpoint Central server's environment summary: the domains, custom group names, and branch offices it manages. Useful for discovering valid domain/branch-office/group values to use in other tools' filters.

Retrieves managed computers from Endpoint Central (SoM) with hostname, IP, OS, agent install status, live status, and branch office details. Supports filtering and pagination.

Retrieves all configured remote/branch offices with their replication status, communication type, and distribution server details.

Retrieves the Scope of Management summary: total computers, agent installation counts, and live status breakdown across the network.

Retrieves all patches applicable to managed systems from the threats module, with severity, KB/bulletin IDs, vendor, missing/installed/failed system counts, and approval status. Supports extensive filtering and pagination.

Retrieves web-server hardening misconfigurations (e.g. Tomcat/IIS/Apache issues) detected across the network, with severity, category, affected-system counts, and resolution guidance. Supports filtering and pagination.

Retrieves OS/system-level misconfigurations (e.g. firewall disabled, BitLocker off) detected across the network, with severity, category, fix availability, reversibility, and affected-system counts. Supports filtering and pagination.

Retrieves the combined per-computer threat report: each record is one system (resource_id) with its nested vulnerabilities, applicable patches, server misconfigurations, and system misconfigurations. Filter by resource ID to inspect specific systems.

Retrieves systems with their per-system patch details (status Missing/Failed/Installed, approval status, install errors, installed time). Each record is one system (resource_id) with a nested patches array. Supports extensive filtering and pagination.

Retrieves systems with their per-system web-server misconfiguration instances (hardening ID, status, affected file path). Each record is one system (resource_id) with a nested servermisconfigurations array.

Retrieves systems with their per-system OS misconfiguration instances (misconfiguration ID, status, global GPO state). Each record is one system (resource_id) with a nested systemmisconfigurations array.

Retrieves systems affected by known vulnerabilities. Each record is one system (resource_id) with a nested vulnerabilities array (vulnerability ID/name, severity, status, last-updated time). Supports filtering and pagination.

Retrieves the network-wide list of detected vulnerabilities with severity, CVE IDs, CVSS scores, exploit status, affected-system counts, and fixing-patch availability. Supports extensive filtering and pagination.

Retrieves the detailed vulnerability-to-computer mapping: every record pairs one computer with one vulnerability (resource, FQDN, IP, CVEs, CVSS, status). Built for bulk export and paginated by an opaque cursor: the first call needs no cursor; if the result says more data is available, call again passing the returned cursor. Requires Endpoint Central 11.3.2430.01+; not supported on Endpoint Central MSP.