---
title: "Perform an action on a device"
method: POST
path: "/v1/devices/{enrollmentCode}/actions"
tags: ["devices"]
---

# Perform an action on a device

`POST /v1/devices/{enrollmentCode}/actions`

Perform a supported action on a device through its enrollment code.

## Path parameters

- `enrollmentCode` string, required

## Headers

- `Workspace` string, required

## Request body

- SupportedDeviceActionsRequest
  - `action` 'tamperProtection' | 'deviceProtection' | 'license' | 'malwareScan' | 'dataGovernanceScan' | 'updateAgent' | 'driveEncryption' | 'deviceState', required — The supported device actions. These include:<br>tamperProtection - Tamper protection prevents users and certain types of malware from tampering with important security features or disabling protection.<br>deviceProtection - Remove a device from protection.<br>malwareScan - Malware scans conduct a thorough scan of specified drives, detecting malware.<br>dataGovernanceScan - Data governance scans conduct a thorough scan of specified drives for sensitive data.<br>updateAgent - Update the device’s Coro Agent to the latest version.<br>driveEncryption - Drive encryption protects the data on that drive from unauthorized access.<br>deviceState - The state of the device, which can be shut down or restarted.
  - `value` string, required — The values of the device actions. These include, for the different actions:<br>tamperProtection - enable, disable<br>deviceProtection - remove<br>malwareScan - start, stop<br>dataGovernanceScan - startFullScan, startPartialScan, stop. Full scans can take a long time. A partial scan ends if a significant amount of sensitive data is found.<br>updateAgent - updateToLatest<br>driveEncryption - encrypt<br>deviceState - shutdown, restart
  - `metadata` object — Additional data required for drive encryption.

## Response `200`

Success

- DeviceActionResponse
  - `deviceStatus` 'OK' | 'ERROR' | 'UNABLE_TO_PERFORM_ACTION' — The status of the device action.

## Other responses

- `400` — Bad request, validation error
- `401` — Unauthorized request
- `403` — Access forbidden
- `429` — Too Many Requests
- `500` — Internal server error

---

[API](https://skmtc.dev/coro/apis/coro-cybersecurity-public-api.md) · [All operations](https://skmtc.dev/coro/apis/coro-cybersecurity-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/coro/coro-cybersecurity-public-api/revisions/b635522b2393/schema)