--- title: "Update an application" method: PUT path: "/organizations/{organizationId}/applications/{applicationId}" tags: ["Organizations"] --- # Update an application `PUT /organizations/{organizationId}/applications/{applicationId}` ## Request - Base URL: `https://api.xfa.tech` - URL: `https://api.xfa.tech/organizations/{organizationId}/applications/{applicationId}` - Auth: HTTP bearer ## Path parameters - `organizationId` string, required - `applicationId` string, required ## Request body - Application - `organizationID` string, required: ID of the organization - `applicationID` string, required: ID of the application - `policyID` string: ID of the policy - `type` 'MicrosoftEAM' | 'Okta' | 'Onelogin' | 'Google' | 'Microsoft' | 'OktaDiscovery' | 'IdP': Type of the application - `testKey` string: Test key - `name` string, required: Name of the application - `iconUrl` string: Icon URL of the application - `policies` Policies: Shared policy representation. On PUT, each OS-specific override (`windows_os`, `macos_os`, `linux_os`, `android_os`, `ios_os`, and `ipados_os`) uses presence-aware update semantics: an omitted key preserves the stored override, `null` removes it and resumes inheritance from `os`, `{}` stores an explicitly disabled override without falling back, and a non-empty object replaces it with a custom version policy. These rules apply both to the policy PUT request body and to the same policy object when it is nested under `Application.Policies` in an application PUT request. For example, use `{"Policies":{"windows_os":null}}` to clear an inline Windows override. - `policy_id` string, required: Unique identifier for the policy - `organization_id` string, required: Organization identifier - `created_by_email` string: Email of the user who created the policy - `created_at_epoch_seconds` integer: Unix epoch seconds when the policy was created - `updated_by_email` string: Email of the user who last updated the policy - `updated_at_epoch_seconds` integer: Unix epoch seconds when the policy was last updated - `name` string, required: Policy name - `installed` boolean: Require the native application to be installed - `unsupported` boolean: Skip unsupported devices automatically - `skip` boolean: Allow users to skip the token flow - `skip_limit` SkipLimit - `max_skips` integer, required - `skip_mobile` boolean: Allow users to skip the token flow on mobile - `skip_desktop` boolean: Allow users to skip the token flow on desktop - `agentless_allowed` boolean: Allow agentless providing of posture - `os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `windows_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `macos_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `linux_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `android_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `ios_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `ipados_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `os_autoupdate` object - `warn` boolean, required: Warn users if OS auto-update is not enabled - `block` boolean, required: Block users if OS auto-update is not enabled - `goal` boolean: Goal - whether OS auto-update should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `browser` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `pdf_readers` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `disk_encryption` object - `warn` boolean, required: Warn users if disk is not encrypted - `block` boolean, required: Block users if disk is not encrypted - `goal` boolean: Goal - whether disk encryption should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `screen_lock` object - `warn` boolean, required: Warn users if screen lock is not enabled or timeout exceeds max_timeout - `block` boolean, required: Block users if screen lock is not enabled or timeout exceeds max_timeout - `goal` boolean: Goal - whether screen lock should be enabled - `max_timeout` integer: Maximum allowed screen lock timeout in seconds - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `antivirus` AntivirusPolicy - `warn` boolean, required: Warn users if antivirus is not enabled - `block` boolean, required: Block users if antivirus is not enabled - `goal` boolean: Goal - whether antivirus should be enabled - `requirements` AntivirusRequirements, nullable: Missing requirements preserve stored rules on update; null clears all rules. Missing OS fields preserve their rule; null clears it. - `windows` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `linux` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `macos` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `password_manager` object - `warn` boolean, required: Warn users if password manager is not enabled - `block` boolean, required: Block users if password manager is not enabled - `goal` boolean: Goal - whether password manager should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `biometrics` object - `warn` boolean, required: Warn users if biometric is not enabled - `block` boolean, required: Block users if biometric is not enabled - `goal` boolean: Goal - whether biometric should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `reboot` object - `WarnTimeInDays` integer: Warn users if they have not reboot their device more than this many days - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTimeInDays` integer: Block users if they have not reboot their device more than this many days - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTimeInDays` integer: Goal - days that devices are allowed to be without rebooting - `windows_recall` object - `warn` boolean, required: Warn users if they have not disabled windows recall - `block` boolean, required: Block users if they have not disabled windows recall - `goal` boolean: Goal - whether windows recall should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `xfa_version` VersionPolicyInDays - `WarnTimeInDays` integer: Warn users if their version is older than this many days - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTimeInDays` integer: Block users if their version is older than this many days - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTimeInDays` integer: Goal - days that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `firewall` object - `warn` boolean, required: Warn users if firewall is not enabled - `block` boolean, required: Block users if firewall is not enabled - `goal` boolean: Goal - whether firewall should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `dns` object - `dns_servers` string[], required: List of required DNS servers - `validation_mode` 'exact_match' | 'exact_with_extra' | 'contains', required: How to validate DNS server configuration - `warn` boolean, required: Warn users if requirement is not configured properly - `block` boolean, required: Block users if requirement is not configured properly - `goal` boolean: Goal - whether dns should be configured properly - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `screen_sharing` object - `warn` boolean, required: Warn users if screen sharing is enabled - `block` boolean, required: Block users if screen sharing is enabled - `goal` boolean: Goal - whether screen sharing should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_login` object - `warn` boolean, required: Warn users if remote login is enabled - `block` boolean, required: Block users if remote login is enabled - `goal` boolean: Goal - whether remote login should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_management` object - `warn` boolean, required: Warn users if remote management is enabled - `block` boolean, required: Block users if remote management is enabled - `goal` boolean: Goal - whether remote management should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_scripting` object - `warn` boolean, required: Warn users if remote scripting is enabled - `block` boolean, required: Block users if remote scripting is enabled - `goal` boolean: Goal - whether remote scripting should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `jailbroken` object - `warn` boolean, required: Warn users if device is jailbroken - `block` boolean, required: Block users if device is jailbroken - `goal` boolean: Goal - whether device should not be jailbroken - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `rooted` object - `warn` boolean, required: Warn users if device is rooted - `block` boolean, required: Block users if device is rooted - `goal` boolean: Goal - whether device should not be rooted - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `developer_mode` object - `warn` boolean, required: Warn users if developer mode is enabled - `block` boolean, required: Block users if developer mode is enabled - `goal` boolean: Goal - whether developer mode should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `secure_boot` object - `warn` boolean, required: Warn users if secure boot is not enabled - `block` boolean, required: Block users if secure boot is not enabled - `goal` boolean: Goal - whether secure boot should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `integrity_protection` object - `warn` boolean, required: Warn users if integrity protection is not enabled - `block` boolean, required: Block users if integrity protection is not enabled - `goal` boolean: Goal - whether integrity protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `find_my_device` object - `warn` boolean, required: Warn users if find my device is enabled - `block` boolean, required: Block users if find my device is enabled - `goal` boolean: Goal - whether find my device should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `vanta` object - `warn` boolean, required: Warn users if vanta is not enabled - `block` boolean, required: Block users if vanta is not enabled - `goal` boolean: Goal - whether vanta should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `intune` object - `tenant_ids` string[], required: List of allowed Intune tenant IDs - `external_enrollment_allowed` boolean: Allow devices to be enrolled with an external organisation - `warn` boolean, required: Warn users if intune is not enabled - `block` boolean, required: Block users if intune is not enabled - `goal` boolean: Goal - whether intune should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `aikido_safe_chain` object - `warn` boolean, required: Warn users if Aikido Safe Chain is not installed and active - `block` boolean, required: Block users if Aikido Safe Chain is not installed and active - `goal` boolean: Goal - whether Aikido Safe Chain should be installed and active - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `aikido_endpoint` object - `endpoint_token` string: Aikido Endpoint registration token used for self-installation and tenant association - `warn` boolean, required: Warn users if Aikido Endpoint is not installed and active - `block` boolean, required: Block users if Aikido Endpoint is not installed and active - `goal` boolean: Goal - whether Aikido Endpoint should be installed and active - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `secrets_in_environment` object - `warn` boolean, required: Warn users if secrets are detected in environment - `block` boolean, required: Block users if secrets are detected in environment - `goal` boolean: Goal - whether secrets should not be in environment - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `autonomous_agents_present` object - `warn` boolean, required: Warn users if autonomous agents are present - `block` boolean, required: Block users if autonomous agents are present - `goal` boolean: Goal - whether autonomous agents should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unsafe_ai_mode` object - `warn` boolean, required: Warn users if unsafe AI configurations are detected - `block` boolean, required: Block users if unsafe AI configurations are detected - `goal` boolean: Goal - whether unsafe AI configurations should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unguarded_elevation` object - `warn` boolean, required: Warn users if unguarded elevation is detected - `block` boolean, required: Block users if unguarded elevation is detected - `goal` boolean: Goal - whether unguarded elevation should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_safebrowsing_enabled` object - `warn` boolean, required: Warn users if Chrome Safe Browsing is not enabled - `block` boolean, required: Block users if Chrome Safe Browsing is not enabled - `goal` boolean: Goal - whether Chrome Safe Browsing should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_safebrowsing_enhanced` object - `warn` boolean, required: Warn users if Chrome Enhanced Safe Browsing is not enabled - `block` boolean, required: Block users if Chrome Enhanced Safe Browsing is not enabled - `goal` boolean: Goal - whether Chrome Enhanced Safe Browsing should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_do_not_track` object - `warn` boolean, required: Warn users if Chrome Do Not Track is not enabled - `block` boolean, required: Block users if Chrome Do Not Track is not enabled - `goal` boolean: Goal - whether Chrome Do Not Track should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_dns_over_https` object - `warn` boolean, required: Warn users if Chrome DNS over HTTPS is not enabled - `block` boolean, required: Block users if Chrome DNS over HTTPS is not enabled - `goal` boolean: Goal - whether Chrome DNS over HTTPS should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_https_only` object - `warn` boolean, required: Warn users if Firefox HTTPS-Only mode is not enabled - `block` boolean, required: Block users if Firefox HTTPS-Only mode is not enabled - `goal` boolean: Goal - whether Firefox HTTPS-Only mode should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_dns_over_https` object - `warn` boolean, required: Warn users if Firefox DNS over HTTPS is not enabled - `block` boolean, required: Block users if Firefox DNS over HTTPS is not enabled - `goal` boolean: Goal - whether Firefox DNS over HTTPS should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_enhanced_tracking_protection` object - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection is not enabled - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection is not enabled - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_enhanced_tracking_protection_strict` object - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection strict mode is not enabled - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection strict mode is not enabled - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection strict mode should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unattended_remote_access` object - `warn` boolean, required: Warn users if unattended remote access tools are configured - `block` boolean, required: Block users if unattended remote access tools are configured - `goal` boolean: Goal - whether unattended remote access tools should not be configured - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `install_protection` object: Policy for the OS-level install protection guardrail (Gatekeeper on macOS, SmartScreen / Defender PUA on Windows). - `warn` boolean, required: Warn users if install protection is not enabled - `block` boolean, required: Block users if install protection is not enabled - `goal` boolean: Goal - whether install protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_revoked_signature_apps` object: Policy for apps whose code-signing certificate has been revoked by the OS. - `warn` boolean, required: Warn users if apps with revoked signatures are present - `block` boolean, required: Block users if apps with revoked signatures are present - `goal` boolean: Goal - whether apps with revoked signatures should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_tampered_apps` object: Policy for apps whose binary does not match its code signature. - `warn` boolean, required: Warn users if tampered apps are present - `block` boolean, required: Block users if tampered apps are present - `goal` boolean: Goal - whether tampered apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_untrusted_signer_apps` object: Policy for apps signed by an untrusted or unknown developer. - `warn` boolean, required: Warn users if apps from untrusted signers are present - `block` boolean, required: Block users if apps from untrusted signers are present - `goal` boolean: Goal - whether apps from untrusted signers should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_unsigned_apps` object: Policy for apps that carry no code signature at all. - `warn` boolean, required: Warn users if unsigned apps are present - `block` boolean, required: Block users if unsigned apps are present - `goal` boolean: Goal - whether unsigned apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_adhoc_signed_apps` object: Policy for apps that carry only an ad-hoc (self-issued) signature. - `warn` boolean, required: Warn users if ad-hoc signed apps are present - `block` boolean, required: Block users if ad-hoc signed apps are present - `goal` boolean: Goal - whether ad-hoc signed apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_unnotarized_apps` object: Policy for macOS apps signed with a Developer ID but without Apple notarization. - `warn` boolean, required: Warn users if apps without notarization are present - `block` boolean, required: Block users if apps without notarization are present - `goal` boolean: Goal - whether apps without notarization should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_cryptominers` object: Policy for cryptominer applications. - `warn` boolean, required: Warn users if cryptominer applications are present - `block` boolean, required: Block users if cryptominer applications are present - `goal` boolean: Goal - whether cryptominer applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_hacking_pentest` object: Policy for hacking and pentest tools. - `warn` boolean, required: Warn users if hacking and pentest tools are present - `block` boolean, required: Block users if hacking and pentest tools are present - `goal` boolean: Goal - whether hacking and pentest tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_piracy_p2p` object: Policy for piracy and peer-to-peer applications. - `warn` boolean, required: Warn users if piracy and P2P applications are present - `block` boolean, required: Block users if piracy and P2P applications are present - `goal` boolean: Goal - whether piracy and P2P applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_jailbreak_rooting` object: Policy for jailbreak and rooting tools. - `warn` boolean, required: Warn users if jailbreak and rooting tools are present - `block` boolean, required: Block users if jailbreak and rooting tools are present - `goal` boolean: Goal - whether jailbreak and rooting tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_vpn_clients` object: Policy for VPN clients. - `warn` boolean, required: Warn users if VPN clients are present - `block` boolean, required: Block users if VPN clients are present - `goal` boolean: Goal - whether VPN clients should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_third_party_ai_coding` object: Policy for third-party AI coding tools. - `warn` boolean, required: Warn users if third-party AI coding tools are present - `block` boolean, required: Block users if third-party AI coding tools are present - `goal` boolean: Goal - whether third-party AI coding tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_experimental_browsers` object: Policy for experimental browsers. - `warn` boolean, required: Warn users if experimental browsers are present - `block` boolean, required: Block users if experimental browsers are present - `goal` boolean: Goal - whether experimental browsers should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_virtualization` object: Policy for virtualization software. - `warn` boolean, required: Warn users if virtualization software is present - `block` boolean, required: Block users if virtualization software is present - `goal` boolean: Goal - whether virtualization software should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_games` object: Policy for games and gaming tools. - `warn` boolean, required: Warn users if games or gaming tools are present - `block` boolean, required: Block users if games or gaming tools are present - `goal` boolean: Goal - whether games and gaming tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_permission_hungry` object: Policy for applications that request unusually broad system permissions. - `warn` boolean, required: Warn users if permission-hungry applications are present - `block` boolean, required: Block users if permission-hungry applications are present - `goal` boolean: Goal - whether permission-hungry applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `allowedApplicationDomainRegexes` string[], required: Allowed application domain regexes - `publicCerts` string[], required: Public certificates - `SAMLMetadataUrl` string, required: SAML Metadata URL - `SAMLConfiguration` SAMLConfiguration - `enabled` boolean, required: Indicates if SAML is enabled - `service_provider_assertion_consumer_service_url` string, required: URL for the service provider's assertion consumer service - `identity_provider_sso_url` string, required: URL for the identity provider's SSO - `identity_provider_issuer` string, required: Issuer for the identity provider - `identity_provider_public_certificate` string, required: Public certificate for the identity provider - `sign_response` boolean, required: Indicates if the response should be signed - `factor_only` boolean: Indicates if only factor authentication is used - `factor_only_audience` string: Audience for factor-only authentication - `force_reauthentication` boolean: Indicates if reauthentication is forced - `prevent_passive_login` boolean: Indicates if passive login is prevented - `azure_force_account_chooser` boolean: Indicates if Azure account chooser is forced - `google_force_account_chooser` boolean: Indicates if Google account chooser is forced - `service_provider_signing_certificate` string: Service provider's signing certificate (PEM) used to verify signed SP requests - `service_provider_entity_id` string: Service provider's entity ID used to verify signed SP requests - `OAuthConfiguration` OAuthConfiguration - `enabled` boolean, required: Indicates if OAuth is enabled - `redirect_url_to_client` string: URL to redirect to the client - `token_endpoint_of_provider` string: Token endpoint of the provider - `authorize_endpoint_of_provider` string: The provider's OAuth2 authorization endpoint. When set, XFA performs the device check before redirecting the user to the provider's authorize endpoint, so the provider's authorization code is minted after the device check rather than before it (which prevents the code expiring during the check). When omitted, the existing flow is used unchanged. - `clientSecret` string: Client secret - `SSOUrl` string, required: SSO URL - `issuer` string, required: Issuer - `customSessionDurationInHours` integer: Custom session duration in hours - `filteredEmail` string[], required: Filtered email addresses - `filterMobile` boolean: Filter mobile devices - `filterDesktop` boolean: Filter desktop devices - `filteredOS` string[]: Filtered operating systems - `enableMfa` boolean: Enable MFA - `enableMfaAutoApproveFirstDevice` boolean: Enable MFA auto-approve first device - `alwaysVerifyMfa` boolean: Double Identity Verification - `uniquePurpose` 'DashboardDemo': Unique purpose of the application - `enabled` boolean: Enabled - `allowedEmailDomains` string[]: Allowed email-domain allow-list for the IdP connection - `mfaFirst` boolean: Run passkey/MFA before device posture (IdP connection) - `requireEmailVerification` boolean: Require recovery-email proof at onboarding (IdP connection) - `IdPProvider` 'Google': Branded provider of an IdP connection, such as a Google Workspace connection. Only valid when type is IdP; unrelated to the Google type (Workspace device discovery). Cannot be cleared once set. - `googleConnection` GoogleConnection - `scopes` string[], required - `error_mobile_devices_api` string: Error message for mobile devices API - `email` string: Email of the Google connection - `error_cloud_identity_api` string: Error message for Cloud Identity API - `only_unmanaged` boolean: Only unmanaged devices - `only_groups` object[], required: only discover devices in these groups (empty means all groups) - `name` string - `id` string - `exclude_desktop` boolean: Exclude desktop devices - `exclude_mobile` boolean: Exclude mobile devices - `last_error` string: Last error message - `first_full_read_done` boolean: Whether the first full discovery read completed successfully - `microsoftConnection` MicrosoftConnection - `scopes` string[], required: List of scopes for the Microsoft connection - `last_error` string: Last error message - `only_unmanaged` boolean: Only discover unmanaged devices - `only_groups` object[], required: Only discover devices from users in these groups (no groups means all groups) - `name` string: Name of the group - `id` string: ID of the group - `exclude_desktop` boolean: Exclude desktop devices - `exclude_mobile` boolean: Exclude mobile devices - `last_sync` integer: Last time the devices were discovered - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination) - `first_full_read_done` boolean: Whether the first full discovery read completed successfully - `oktaConnection` OktaConnection - `okta_domain` string, required: Domain of the Okta connection - `client_id` string, required: Client ID for the Okta connection - `client_secret` string, required: Client secret for the Okta connection - `last_error` string: Last error message - `last_sync` integer: Last time the devices were discovered - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination) - `first_full_read_done` boolean: Whether the first full discovery read completed successfully ## Response `200` Application updated - Application - `organizationID` string, required: ID of the organization - `applicationID` string, required: ID of the application - `policyID` string: ID of the policy - `type` 'MicrosoftEAM' | 'Okta' | 'Onelogin' | 'Google' | 'Microsoft' | 'OktaDiscovery' | 'IdP': Type of the application - `testKey` string: Test key - `name` string, required: Name of the application - `iconUrl` string: Icon URL of the application - `policies` Policies: Shared policy representation. On PUT, each OS-specific override (`windows_os`, `macos_os`, `linux_os`, `android_os`, `ios_os`, and `ipados_os`) uses presence-aware update semantics: an omitted key preserves the stored override, `null` removes it and resumes inheritance from `os`, `{}` stores an explicitly disabled override without falling back, and a non-empty object replaces it with a custom version policy. These rules apply both to the policy PUT request body and to the same policy object when it is nested under `Application.Policies` in an application PUT request. For example, use `{"Policies":{"windows_os":null}}` to clear an inline Windows override. - `policy_id` string, required: Unique identifier for the policy - `organization_id` string, required: Organization identifier - `created_by_email` string: Email of the user who created the policy - `created_at_epoch_seconds` integer: Unix epoch seconds when the policy was created - `updated_by_email` string: Email of the user who last updated the policy - `updated_at_epoch_seconds` integer: Unix epoch seconds when the policy was last updated - `name` string, required: Policy name - `installed` boolean: Require the native application to be installed - `unsupported` boolean: Skip unsupported devices automatically - `skip` boolean: Allow users to skip the token flow - `skip_limit` SkipLimit - `max_skips` integer, required - `skip_mobile` boolean: Allow users to skip the token flow on mobile - `skip_desktop` boolean: Allow users to skip the token flow on desktop - `agentless_allowed` boolean: Allow agentless providing of posture - `os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `windows_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `macos_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `linux_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `android_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `ios_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `ipados_os` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `os_autoupdate` object - `warn` boolean, required: Warn users if OS auto-update is not enabled - `block` boolean, required: Block users if OS auto-update is not enabled - `goal` boolean: Goal - whether OS auto-update should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `browser` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `pdf_readers` VersionPolicy - `WarnTime` integer: Warn users if their version is older than this many seconds - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTime` integer: Block users if their version is older than this many seconds - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTime` integer: Goal - time in seconds that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `disk_encryption` object - `warn` boolean, required: Warn users if disk is not encrypted - `block` boolean, required: Block users if disk is not encrypted - `goal` boolean: Goal - whether disk encryption should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `screen_lock` object - `warn` boolean, required: Warn users if screen lock is not enabled or timeout exceeds max_timeout - `block` boolean, required: Block users if screen lock is not enabled or timeout exceeds max_timeout - `goal` boolean: Goal - whether screen lock should be enabled - `max_timeout` integer: Maximum allowed screen lock timeout in seconds - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `antivirus` AntivirusPolicy - `warn` boolean, required: Warn users if antivirus is not enabled - `block` boolean, required: Block users if antivirus is not enabled - `goal` boolean: Goal - whether antivirus should be enabled - `requirements` AntivirusRequirements, nullable: Missing requirements preserve stored rules on update; null clears all rules. Missing OS fields preserve their rule; null clears it. - `windows` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `linux` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `macos` AntivirusProductRequirement, nullable - `allowed_products` string[], required: One healthy listed product suffices. An empty list allows any supported healthy product. Windows accepts microsoft_defender or wsc followed by a colon and a normalized full registration name; Linux accepts clamav or microsoft_defender_endpoint; macOS accepts apple_xprotect. - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `password_manager` object - `warn` boolean, required: Warn users if password manager is not enabled - `block` boolean, required: Block users if password manager is not enabled - `goal` boolean: Goal - whether password manager should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `biometrics` object - `warn` boolean, required: Warn users if biometric is not enabled - `block` boolean, required: Block users if biometric is not enabled - `goal` boolean: Goal - whether biometric should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `reboot` object - `WarnTimeInDays` integer: Warn users if they have not reboot their device more than this many days - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTimeInDays` integer: Block users if they have not reboot their device more than this many days - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTimeInDays` integer: Goal - days that devices are allowed to be without rebooting - `windows_recall` object - `warn` boolean, required: Warn users if they have not disabled windows recall - `block` boolean, required: Block users if they have not disabled windows recall - `goal` boolean: Goal - whether windows recall should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `xfa_version` VersionPolicyInDays - `WarnTimeInDays` integer: Warn users if their version is older than this many days - `WarnTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `BlockTimeInDays` integer: Block users if their version is older than this many days - `BlockTimeOption` 'direct': Optional dropdown option for policy threshold timing. Missing means the client should use legacy goal-relative fallback. - `GoalTimeInDays` integer: Goal - days that devices are allowed to be outdated with security updates - `older_supported_major_versions` MajorVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on older, but supported major version - `dont_block` boolean, required: Do not block users if on older, but supported major version - `beta_versions` BetaVersionsPolicy - `dont_warn` boolean, required: Do not warn users if on beta version - `dont_block` boolean, required: Do not block users if on beta version - `firewall` object - `warn` boolean, required: Warn users if firewall is not enabled - `block` boolean, required: Block users if firewall is not enabled - `goal` boolean: Goal - whether firewall should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `dns` object - `dns_servers` string[], required: List of required DNS servers - `validation_mode` 'exact_match' | 'exact_with_extra' | 'contains', required: How to validate DNS server configuration - `warn` boolean, required: Warn users if requirement is not configured properly - `block` boolean, required: Block users if requirement is not configured properly - `goal` boolean: Goal - whether dns should be configured properly - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `screen_sharing` object - `warn` boolean, required: Warn users if screen sharing is enabled - `block` boolean, required: Block users if screen sharing is enabled - `goal` boolean: Goal - whether screen sharing should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_login` object - `warn` boolean, required: Warn users if remote login is enabled - `block` boolean, required: Block users if remote login is enabled - `goal` boolean: Goal - whether remote login should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_management` object - `warn` boolean, required: Warn users if remote management is enabled - `block` boolean, required: Block users if remote management is enabled - `goal` boolean: Goal - whether remote management should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `remote_scripting` object - `warn` boolean, required: Warn users if remote scripting is enabled - `block` boolean, required: Block users if remote scripting is enabled - `goal` boolean: Goal - whether remote scripting should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `jailbroken` object - `warn` boolean, required: Warn users if device is jailbroken - `block` boolean, required: Block users if device is jailbroken - `goal` boolean: Goal - whether device should not be jailbroken - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `rooted` object - `warn` boolean, required: Warn users if device is rooted - `block` boolean, required: Block users if device is rooted - `goal` boolean: Goal - whether device should not be rooted - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `developer_mode` object - `warn` boolean, required: Warn users if developer mode is enabled - `block` boolean, required: Block users if developer mode is enabled - `goal` boolean: Goal - whether developer mode should be disabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `secure_boot` object - `warn` boolean, required: Warn users if secure boot is not enabled - `block` boolean, required: Block users if secure boot is not enabled - `goal` boolean: Goal - whether secure boot should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `integrity_protection` object - `warn` boolean, required: Warn users if integrity protection is not enabled - `block` boolean, required: Block users if integrity protection is not enabled - `goal` boolean: Goal - whether integrity protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `find_my_device` object - `warn` boolean, required: Warn users if find my device is enabled - `block` boolean, required: Block users if find my device is enabled - `goal` boolean: Goal - whether find my device should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `vanta` object - `warn` boolean, required: Warn users if vanta is not enabled - `block` boolean, required: Block users if vanta is not enabled - `goal` boolean: Goal - whether vanta should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `intune` object - `tenant_ids` string[], required: List of allowed Intune tenant IDs - `external_enrollment_allowed` boolean: Allow devices to be enrolled with an external organisation - `warn` boolean, required: Warn users if intune is not enabled - `block` boolean, required: Block users if intune is not enabled - `goal` boolean: Goal - whether intune should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `aikido_safe_chain` object - `warn` boolean, required: Warn users if Aikido Safe Chain is not installed and active - `block` boolean, required: Block users if Aikido Safe Chain is not installed and active - `goal` boolean: Goal - whether Aikido Safe Chain should be installed and active - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `aikido_endpoint` object - `endpoint_token` string: Aikido Endpoint registration token used for self-installation and tenant association - `warn` boolean, required: Warn users if Aikido Endpoint is not installed and active - `block` boolean, required: Block users if Aikido Endpoint is not installed and active - `goal` boolean: Goal - whether Aikido Endpoint should be installed and active - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `secrets_in_environment` object - `warn` boolean, required: Warn users if secrets are detected in environment - `block` boolean, required: Block users if secrets are detected in environment - `goal` boolean: Goal - whether secrets should not be in environment - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `autonomous_agents_present` object - `warn` boolean, required: Warn users if autonomous agents are present - `block` boolean, required: Block users if autonomous agents are present - `goal` boolean: Goal - whether autonomous agents should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unsafe_ai_mode` object - `warn` boolean, required: Warn users if unsafe AI configurations are detected - `block` boolean, required: Block users if unsafe AI configurations are detected - `goal` boolean: Goal - whether unsafe AI configurations should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unguarded_elevation` object - `warn` boolean, required: Warn users if unguarded elevation is detected - `block` boolean, required: Block users if unguarded elevation is detected - `goal` boolean: Goal - whether unguarded elevation should not be present - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_safebrowsing_enabled` object - `warn` boolean, required: Warn users if Chrome Safe Browsing is not enabled - `block` boolean, required: Block users if Chrome Safe Browsing is not enabled - `goal` boolean: Goal - whether Chrome Safe Browsing should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_safebrowsing_enhanced` object - `warn` boolean, required: Warn users if Chrome Enhanced Safe Browsing is not enabled - `block` boolean, required: Block users if Chrome Enhanced Safe Browsing is not enabled - `goal` boolean: Goal - whether Chrome Enhanced Safe Browsing should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_do_not_track` object - `warn` boolean, required: Warn users if Chrome Do Not Track is not enabled - `block` boolean, required: Block users if Chrome Do Not Track is not enabled - `goal` boolean: Goal - whether Chrome Do Not Track should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `chrome_dns_over_https` object - `warn` boolean, required: Warn users if Chrome DNS over HTTPS is not enabled - `block` boolean, required: Block users if Chrome DNS over HTTPS is not enabled - `goal` boolean: Goal - whether Chrome DNS over HTTPS should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_https_only` object - `warn` boolean, required: Warn users if Firefox HTTPS-Only mode is not enabled - `block` boolean, required: Block users if Firefox HTTPS-Only mode is not enabled - `goal` boolean: Goal - whether Firefox HTTPS-Only mode should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_dns_over_https` object - `warn` boolean, required: Warn users if Firefox DNS over HTTPS is not enabled - `block` boolean, required: Block users if Firefox DNS over HTTPS is not enabled - `goal` boolean: Goal - whether Firefox DNS over HTTPS should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_enhanced_tracking_protection` object - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection is not enabled - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection is not enabled - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `firefox_enhanced_tracking_protection_strict` object - `warn` boolean, required: Warn users if Firefox Enhanced Tracking Protection strict mode is not enabled - `block` boolean, required: Block users if Firefox Enhanced Tracking Protection strict mode is not enabled - `goal` boolean: Goal - whether Firefox Enhanced Tracking Protection strict mode should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `unattended_remote_access` object - `warn` boolean, required: Warn users if unattended remote access tools are configured - `block` boolean, required: Block users if unattended remote access tools are configured - `goal` boolean: Goal - whether unattended remote access tools should not be configured - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `install_protection` object: Policy for the OS-level install protection guardrail (Gatekeeper on macOS, SmartScreen / Defender PUA on Windows). - `warn` boolean, required: Warn users if install protection is not enabled - `block` boolean, required: Block users if install protection is not enabled - `goal` boolean: Goal - whether install protection should be enabled - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_revoked_signature_apps` object: Policy for apps whose code-signing certificate has been revoked by the OS. - `warn` boolean, required: Warn users if apps with revoked signatures are present - `block` boolean, required: Block users if apps with revoked signatures are present - `goal` boolean: Goal - whether apps with revoked signatures should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_tampered_apps` object: Policy for apps whose binary does not match its code signature. - `warn` boolean, required: Warn users if tampered apps are present - `block` boolean, required: Block users if tampered apps are present - `goal` boolean: Goal - whether tampered apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_untrusted_signer_apps` object: Policy for apps signed by an untrusted or unknown developer. - `warn` boolean, required: Warn users if apps from untrusted signers are present - `block` boolean, required: Block users if apps from untrusted signers are present - `goal` boolean: Goal - whether apps from untrusted signers should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_unsigned_apps` object: Policy for apps that carry no code signature at all. - `warn` boolean, required: Warn users if unsigned apps are present - `block` boolean, required: Block users if unsigned apps are present - `goal` boolean: Goal - whether unsigned apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_adhoc_signed_apps` object: Policy for apps that carry only an ad-hoc (self-issued) signature. - `warn` boolean, required: Warn users if ad-hoc signed apps are present - `block` boolean, required: Block users if ad-hoc signed apps are present - `goal` boolean: Goal - whether ad-hoc signed apps should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_unnotarized_apps` object: Policy for macOS apps signed with a Developer ID but without Apple notarization. - `warn` boolean, required: Warn users if apps without notarization are present - `block` boolean, required: Block users if apps without notarization are present - `goal` boolean: Goal - whether apps without notarization should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_cryptominers` object: Policy for cryptominer applications. - `warn` boolean, required: Warn users if cryptominer applications are present - `block` boolean, required: Block users if cryptominer applications are present - `goal` boolean: Goal - whether cryptominer applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_hacking_pentest` object: Policy for hacking and pentest tools. - `warn` boolean, required: Warn users if hacking and pentest tools are present - `block` boolean, required: Block users if hacking and pentest tools are present - `goal` boolean: Goal - whether hacking and pentest tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_piracy_p2p` object: Policy for piracy and peer-to-peer applications. - `warn` boolean, required: Warn users if piracy and P2P applications are present - `block` boolean, required: Block users if piracy and P2P applications are present - `goal` boolean: Goal - whether piracy and P2P applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_jailbreak_rooting` object: Policy for jailbreak and rooting tools. - `warn` boolean, required: Warn users if jailbreak and rooting tools are present - `block` boolean, required: Block users if jailbreak and rooting tools are present - `goal` boolean: Goal - whether jailbreak and rooting tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_vpn_clients` object: Policy for VPN clients. - `warn` boolean, required: Warn users if VPN clients are present - `block` boolean, required: Block users if VPN clients are present - `goal` boolean: Goal - whether VPN clients should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_third_party_ai_coding` object: Policy for third-party AI coding tools. - `warn` boolean, required: Warn users if third-party AI coding tools are present - `block` boolean, required: Block users if third-party AI coding tools are present - `goal` boolean: Goal - whether third-party AI coding tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_experimental_browsers` object: Policy for experimental browsers. - `warn` boolean, required: Warn users if experimental browsers are present - `block` boolean, required: Block users if experimental browsers are present - `goal` boolean: Goal - whether experimental browsers should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_virtualization` object: Policy for virtualization software. - `warn` boolean, required: Warn users if virtualization software is present - `block` boolean, required: Block users if virtualization software is present - `goal` boolean: Goal - whether virtualization software should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_games` object: Policy for games and gaming tools. - `warn` boolean, required: Warn users if games or gaming tools are present - `block` boolean, required: Block users if games or gaming tools are present - `goal` boolean: Goal - whether games and gaming tools should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `no_permission_hungry` object: Policy for applications that request unusually broad system permissions. - `warn` boolean, required: Warn users if permission-hungry applications are present - `block` boolean, required: Block users if permission-hungry applications are present - `goal` boolean: Goal - whether permission-hungry applications should be absent - `escalation` CheckEscalation - `mode` 'grace_days', required - `block_after_days` integer - `allowedApplicationDomainRegexes` string[], required: Allowed application domain regexes - `publicCerts` string[], required: Public certificates - `SAMLMetadataUrl` string, required: SAML Metadata URL - `SAMLConfiguration` SAMLConfiguration - `enabled` boolean, required: Indicates if SAML is enabled - `service_provider_assertion_consumer_service_url` string, required: URL for the service provider's assertion consumer service - `identity_provider_sso_url` string, required: URL for the identity provider's SSO - `identity_provider_issuer` string, required: Issuer for the identity provider - `identity_provider_public_certificate` string, required: Public certificate for the identity provider - `sign_response` boolean, required: Indicates if the response should be signed - `factor_only` boolean: Indicates if only factor authentication is used - `factor_only_audience` string: Audience for factor-only authentication - `force_reauthentication` boolean: Indicates if reauthentication is forced - `prevent_passive_login` boolean: Indicates if passive login is prevented - `azure_force_account_chooser` boolean: Indicates if Azure account chooser is forced - `google_force_account_chooser` boolean: Indicates if Google account chooser is forced - `service_provider_signing_certificate` string: Service provider's signing certificate (PEM) used to verify signed SP requests - `service_provider_entity_id` string: Service provider's entity ID used to verify signed SP requests - `OAuthConfiguration` OAuthConfiguration - `enabled` boolean, required: Indicates if OAuth is enabled - `redirect_url_to_client` string: URL to redirect to the client - `token_endpoint_of_provider` string: Token endpoint of the provider - `authorize_endpoint_of_provider` string: The provider's OAuth2 authorization endpoint. When set, XFA performs the device check before redirecting the user to the provider's authorize endpoint, so the provider's authorization code is minted after the device check rather than before it (which prevents the code expiring during the check). When omitted, the existing flow is used unchanged. - `clientSecret` string: Client secret - `SSOUrl` string, required: SSO URL - `issuer` string, required: Issuer - `customSessionDurationInHours` integer: Custom session duration in hours - `filteredEmail` string[], required: Filtered email addresses - `filterMobile` boolean: Filter mobile devices - `filterDesktop` boolean: Filter desktop devices - `filteredOS` string[]: Filtered operating systems - `enableMfa` boolean: Enable MFA - `enableMfaAutoApproveFirstDevice` boolean: Enable MFA auto-approve first device - `alwaysVerifyMfa` boolean: Double Identity Verification - `uniquePurpose` 'DashboardDemo': Unique purpose of the application - `enabled` boolean: Enabled - `allowedEmailDomains` string[]: Allowed email-domain allow-list for the IdP connection - `mfaFirst` boolean: Run passkey/MFA before device posture (IdP connection) - `requireEmailVerification` boolean: Require recovery-email proof at onboarding (IdP connection) - `IdPProvider` 'Google': Branded provider of an IdP connection, such as a Google Workspace connection. Only valid when type is IdP; unrelated to the Google type (Workspace device discovery). Cannot be cleared once set. - `googleConnection` GoogleConnection - `scopes` string[], required - `error_mobile_devices_api` string: Error message for mobile devices API - `email` string: Email of the Google connection - `error_cloud_identity_api` string: Error message for Cloud Identity API - `only_unmanaged` boolean: Only unmanaged devices - `only_groups` object[], required: only discover devices in these groups (empty means all groups) - `name` string - `id` string - `exclude_desktop` boolean: Exclude desktop devices - `exclude_mobile` boolean: Exclude mobile devices - `last_error` string: Last error message - `first_full_read_done` boolean: Whether the first full discovery read completed successfully - `microsoftConnection` MicrosoftConnection - `scopes` string[], required: List of scopes for the Microsoft connection - `last_error` string: Last error message - `only_unmanaged` boolean: Only discover unmanaged devices - `only_groups` object[], required: Only discover devices from users in these groups (no groups means all groups) - `name` string: Name of the group - `id` string: ID of the group - `exclude_desktop` boolean: Exclude desktop devices - `exclude_mobile` boolean: Exclude mobile devices - `last_sync` integer: Last time the devices were discovered - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination) - `first_full_read_done` boolean: Whether the first full discovery read completed successfully - `oktaConnection` OktaConnection - `okta_domain` string, required: Domain of the Okta connection - `client_id` string, required: Client ID for the Okta connection - `client_secret` string, required: Client secret for the Okta connection - `last_error` string: Last error message - `last_sync` integer: Last time the devices were discovered - `discovered_until` integer: Unix time up until which devices have been discovered (for pagination) - `first_full_read_done` boolean: Whether the first full discovery read completed successfully --- [API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)