---
title: "Get a machine's taint configuration"
method: GET
path: "/api/machine_taint/"
tags: ["Filters, rules and taint"]
---

# Get a machine's taint configuration

`GET /api/machine_taint/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/machine_taint/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Returns the tri-state taint config for the given scope (machine query param = a machine public_id, '' or absent = global). Every gate key is reported as on, off, or unset: socket, file, stdin, foreign, env, make_vuln, argv, weak_random, hardcoded, build, posture, concurrency, resource, secret, memory, ffi, lifetime, arith, identity, subprocess, worker, dns, db_rows, calldata, caller, returndata, storage, chainenv, oracle, http, report_cmdline, report_env, report_code, drop_suppressed, handoff. drop_suppressed is not a taint source: switched on, the server discards that machine's suppressed events as they arrive instead of storing them, and a discarded event cannot be recovered. Each product's filters page offers the subset listed for that product. A key an agent has no counterpart for is ignored by that agent, never mapped onto a different source. es-chromium, es-c, es-cpp, es-node, es-ruby and es-php do not fetch this configuration at all, so nothing set here reaches them.

This is a **read**: a read-only API key may call it.

## Query parameters

- `machine` string

## Response `200`

OK. For example:

```
{
  "taint": {
    "socket": "on",
    "file": "unset",
    "stdin": "unset",
    "foreign": "off",
    "env": "unset",
    …one entry for every gate key
  }
}
```

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)