Sophos Central MCP

Cancel a running or pending Live Discover query run. Uses POST to the /cancel sub-resource.

Cancel a running or pending XDR query run. Uses POST to the /cancel sub-resource.

Check if firmware upgrades are available for the specified managed firewalls.

Initiate post-delivery clawback/remediation for a delivered email. Removes the message from recipient mailboxes.

Clone an existing endpoint policy. Creates a copy with a new name, inheriting all settings from the source policy.

Create a new account-level access token for a tenant. Currently supported token type: 'sophosLinuxSensor' — used to authenticate downloads of the Sophos Linux Sensor package. The token secret is returned only on creation; store it securely as it cannot be retrieved again.

Create a new partner-level administrator. The admin will receive an invitation email.

Assign a role to a tenant admin.

Add a globally allowed item. For 'sha256' type supply sha256. For 'path' type supply fileName and optionally path. For 'certificateSigner' type supply certificateSigner.

Block an item by SHA256 hash globally. Optionally include filename and path for context.

Create a new investigation case.

Create a new cloud security runtime detection profile, or create a new version of an existing profile. Provide 'name' when creating a new profile; provide 'profile_id' when adding a new version to an existing profile. Use sophos_list_cloud_security_default_contents to get available content versions.

Create a new endpoint group in a tenant. Groups organize endpoints by type (computer or server) and can be used for targeted policy assignment.

Create a new global scanning exclusion. The 'value' is the exclusion path/process/URL. The 'comment' field documents the reason.

Add a custom application to exploit mitigation monitoring. Provide one or more executable paths (supports environment variable prefixes like $programfiles).

Create a new firewall group. At least one firewall UUID must be assigned at creation.

Create an IPS exclusion to exempt specific traffic from intrusion prevention scanning. Direction must be 'inbound' or 'outbound'. Remote addresses is a comma-separated list of IPs/URLs.

Create an isolation exclusion so specific traffic can pass through even when an endpoint is network-isolated. Direction must be 'inbound' or 'outbound'.

Add a single mailbox to email protection.

Add threat indicators (IOCs) to a firewall's MDR threat feed. Indicators can be IPv4 addresses, domain names, or URLs.

Create a new mobile app group. Provide a name, target platform, and a JSON array of app objects to include in the group.

Register a new mobile device in Sophos Mobile MDM. Requires device name, ownership type (corporate/employee), and platform (iOS, macOS, android, chrome, windows).

Create a new mobile device group in Sophos Mobile. Requires name and compliance policy IDs for both employee- and corporate-owned devices.

Add a custom property (key/value pair) to a mobile device. The key must follow the pattern 'custom.<alphanumeric>'.

Assign a role to a partner admin (add a role to an admin's existing role set).

Create a new partner-level role with the specified name and permission sets.

Create a new endpoint policy. Specify the policy type, name, and optionally priority, enabled state, and settings as a JSON string.

Assign a partner role to an admin (principal).

Create a new tenant under this Sophos Central Partner account. Requires tenant name, data geography, billing type, and primary contact details.

Create an administrator for a specific managed tenant using the partner-level endpoint. The admin will receive an invitation email.

Create a custom role in a tenant. Use sophos_list_tenant_permission_sets to discover available permission set IDs.

Create a new directory user in a tenant.

Create a user activity attestation — push a security question to a user's Intercept X for Mobile device. Use this to verify whether suspicious activity (e.g. an unexpected login) was performed by the legitimate user. The user receives the question on their mobile device and selects an answer option. Poll the attestation status using sophos_get_user_attestation. Status values: 'pending' (awaiting response), 'completed' (user answered), 'expired' (timed out).

Create a new directory user group.

Create a Web Control local site override to allow or block a specific URL/domain. categoryId is an integer from the categories list.

Remove network isolation from an endpoint, restoring normal network connectivity.

Delete ALL threat indicators from a firewall's MDR threat feed. This is a destructive operation with no undo.

Delete a globally allowed item.

Remove a globally blocked item (unblock it).

Delete an investigation case by ID.

Delete one or more cloud security runtime detection profiles by their IDs. Profiles that are currently assigned to a policy cannot be deleted and will appear in the 'skippedProfiles' list in the response.

Delete (deregister) an endpoint from Sophos Central. This removes the endpoint record but does not uninstall the agent. Use with caution.

Delete an endpoint group. Endpoints in the group will not be deleted.

Delete a global scanning exclusion by ID.

Remove a custom application from exploit mitigation monitoring.

Remove a firewall from Sophos Central management.

Delete a firewall group.

Delete an IPS exclusion.

Delete an isolation exclusion.

Remove a single mailbox from email protection by its ID.

Delete specific threat indicators from a firewall's MDR threat feed by their values.

Delete a pending MDM action (cancel it before execution).

Delete a mobile app group from Sophos Mobile.

Remove a mobile device from Sophos Mobile MDM enrollment.

Delete a mobile device group from Sophos Mobile.

Delete a custom property from a mobile device by its key.

Delete a partner-level administrator.

Remove a specific role assignment from a partner admin.

Delete a partner role.

Delete an endpoint policy from a tenant. Endpoints previously governed by this policy will fall back to the base policy. Use with caution.

Delete one or more post-delivery quarantined messages.

Delete one or more pre-delivery quarantined messages. Optionally block sender.

Remove a role assignment from a partner admin (principal).

Delete the user comment for a specific static software package.

Delete a tenant managed by this partner. WARNING: This is a destructive, irreversible operation. Confirm the tenant ID carefully before calling this tool.

Delete an administrator from a tenant.

Delete a custom role from a tenant. Built-in roles cannot be deleted.

Remove a specific role assignment from a tenant admin.

Delete a directory user.

Delete a directory user group.

Delete a Web Control local site override.

Create a custom domain list for DNS Protection. The list is assigned as allowed or blocked on a policy (via sophos_dns_create_policy or sophos_dns_update_policy), not typed here.

Create a new DNS Protection location. Provide either IP addresses or domain names (combined total max 100).

Create a new DNS Protection policy with category filtering, allowed/blocked custom domain lists, and safe-search settings.

Delete a custom domain list.

Delete a DNS Protection location.

Delete a DNS Protection policy.

Get a specific custom domain list.

Get details for a specific DNS Protection location.

Get details for a specific DNS Protection policy.

List custom domain lists (allowed/blocked) for DNS Protection.

List all DNS Protection locations for a tenant.

List all DNS Protection policies for a tenant.

Update a custom domain list (name, description, or domains).

Update a DNS Protection location. Send an empty array for ip_addresses or domain_names to clear them.

Update a DNS Protection policy. For array fields (locationIds, allowedCustomDomainIds, etc.) send a full replacement array, null to clear, or an add/remove object.

Initiate a download job for attachments from a post-delivery quarantined message. Returns a downloadId for status polling.

Initiate a download job for attachments from a pre-delivery quarantined message. Returns a downloadId for status polling.

Export the full results of a completed XDR query run. Returns a download URL or streamed content for bulk result export.

Force an endpoint to check for and apply software updates from Sophos Central immediately.

Get account health check report for a tenant. Shows protection coverage, policy compliance, and configuration issues across endpoints and network devices.

Get Adaptive Attack Protection (AAP) settings for an endpoint. AAP temporarily increases protection during active attacks.

Get the full details of a specific alert by ID, including its allowedActions list.

Get details for a specific globally allowed item.

Get the full details of a specific audit event by its ID, including the actor, action performed, affected resource, and timestamp.

Get billing usage data for a specific month. Shows per-tenant, per-product usage quantities.

Get details for a specific globally blocked item.

Get full details for a specific case/investigation by ID.

Get a specific detection within a case by detection ID.

Get impacted entities (endpoints, users, etc.) associated with a case.

Get the MITRE ATT&CK framework summary for a case — tactics and techniques observed across all associated detections.

Get the status of an email clawback operation.

Get details of a specific cloud security runtime detection profile, including its override settings (rules and lists). Optionally retrieve a specific version of the profile.

Get details for a specific detected exploit event.

Get detection counts grouped by severity and type over a time range. Returns per-hour or per-day buckets.

Get the status of a running detection-groups query. Poll until status is 'finished'.

Get results of a completed detection-groups query. Each item represents a group of similar detections with a count, detection rule, MITRE ATT&CK tags, and device info.

Get results of a completed detections query. Only call after sophos_get_detections_query_status returns status='finished'.

Get the status of a running detections query. Poll until status is 'finished'. Result will be 'succeeded' or 'failed'.

Get detailed information about a specific endpoint by its ID, including health, OS, network, assigned products, and isolation status.

Get details of a specific endpoint group, including its name, description, type, and endpoint count.

Get details for a specific global scanning exclusion.

Get details for a specific exploit mitigation application, including its protection settings.

Get details for a specific firewall group.

Get the synchronisation status of firewalls in a firewall group.

Get firewalls and their licenses for a Sophos Central tenant or partner. Provide either tenant_id (for tenant context) or partner_id (for partner context), but not both.

Poll the status/result of an asynchronous firewall-config operation (e.g. MDR threat-feed retrieval). Use the transactionId returned by the originating call.

Get the status of a forensic log collection request previously initiated with sophos_request_forensic_logs.

Get the global tamper protection on/off switch for a tenant. For per-endpoint tamper protection passwords, use sophos_get_tamper_protection.

Get historical account health check scores for a tenant to track improvement over time.

Get available Sophos agent installer download links for specified products and platforms.

Get details for a specific IPS exclusion.

Get details for a specific isolation exclusion.

Get the current isolation status of an endpoint.

Get all product licenses (with current usage) for a Sophos Central tenant. Returns license type, quantity, start/end dates, perpetual flag, and current usage counts.

Get details for a specific Live Discover query category by its category ID.

Get per-endpoint execution status for a Live Discover query run. Shows which endpoints responded, are still running, or failed.

Retrieve the results of a completed Live Discover query run. Uses key-based pagination: pass the nextKey from the previous response as page_from_key to get the next page.

Check the status of a previously submitted Live Discover query run. Status values: pending | started | finished. Result values: notAvailable | succeeded | failed | timedOut.

Get details for a specific mailbox by ID.

Retrieve the MDR threat-feed configuration for a specific firewall. Returns a transactionId — poll sophos_get_firewall_transaction with that ID to retrieve the result.

Get the status of a memory dump request previously initiated with sophos_request_memory_dump.

Get the status and details of a specific endpoint migration job.

Get details for a specific MDM action by its ID.

Get details for a specific mobile app group by its ID.

Get full details for a specific mobile device by its ID, including compliance status, installed apps, platform, and assigned policies.

Get details for a specific mobile device group by its ID.

Get the last known GPS location for a specific mobile device.

Get static setup data for IXM (Intercept X for Mobile) auto-enrollment, including the connection code required to enroll the IXM app.

Get details for a specific mobile operating system by its ID.

Get details for a specific partner-level administrator.

Return partner level information for a distributor's partners. Filters by billing sub-region and optionally by name, update date, or EDI number.

Get details for a specific partner role.

Get details for a specific peripheral device.

Get detailed information about a specific endpoint policy, including its settings, priority, and which endpoints it applies to.

Get the status of a post-delivery quarantine attachment download job.

Get the status of a quarantine attachment download job initiated by sophos_download_quarantine_attachments.

Get details for a specific pre-delivery quarantined message by ID.

Get URLs found in a pre-delivery quarantined message.

Get full details for a specific Sophos Business Automation quote by proposal number.

Get the recommended (latest stable) Sophos software package versions for each supported platform.

Get account health score comparisons against regional peers. Useful for benchmarking your tenant's security posture against similar tenants in your region.

Get full details of a specific saved Live Discover query by its query ID.

Retrieve alerts from the Sophos SIEM API for integration with external SIEM systems. Alerts are from the last 24 hours only. Use the cursor from the response (next_cursor) to paginate; check has_more to know if more pages exist.

Retrieve security events from the Sophos SIEM API for integration with external SIEM systems. Events are from the last 24 hours only. Use the cursor from the response (next_cursor) to paginate; check has_more to know if more pages exist.

Get the user comment for a specific static software package.

Get details for a specific static software package by ID.

Retrieve the MAC filter settings for a tenant's managed switches. The MAC filter allows or blocks devices connected to the switch by their MAC addresses.

Get the tamper protection status and password for an endpoint. Tamper protection prevents unauthorized changes to Sophos agent settings.

Get details for a specific managed tenant by ID, including its regional API host.

Get details for a specific tenant administrator.

Get details for a specific tenant role.

Get Web Control TLS decryption settings (which categories have decryption enabled).

Get details for a specific directory user.

Get the current status and details of a user activity attestation by its ID. Poll this after creating an attestation to check whether the user has responded. Status values: 'pending' (user has not answered yet), 'completed' (user selected an option — see 'selectedOption'), 'expired' (user did not respond before the timeout).

Get details for a specific user group.

Get details for a specific Web Control local site override.

Retrieve the MAC filter settings for a tenant's managed Wi-Fi access points. The MAC filter allows or blocks devices connecting to access points by their MAC addresses.

Get details for a specific saved XDR query template by its query ID.

Retrieve the results of a completed XDR query run. Uses key-based pagination: pass the nextKey from the previous response as page_from_key to get the next page.

Check the status of a previously submitted XDR query run. Status values: pending | started | finished. Result values: notAvailable | succeeded | failed | timedOut | canceled.

Invite a new administrator to a specific tenant via the common API (/common/v1/admins). The admin will receive an invitation email.

Isolate an endpoint from the network. The endpoint will only be able to communicate with Sophos Central. Use this for incident response to contain a compromised machine.

List all account-level access tokens for a tenant. These tokens are used to authenticate downloads of Sophos products such as Sophos Linux Sensor. Returns token metadata (ID, label, type, expiry) but NOT the actual token secret.

List role assignments for a specific tenant admin.

List all partner-level administrators for this Sophos Central Partner account.

List alerts from Sophos Central for a given tenant, with optional severity, product, category, date range, and pagination filters.

List all globally allowed items (SHA256 hashes, certificate signers, file paths) for a tenant.

List audit trail events for a Sophos Central tenant. Covers admin actions, policy changes, user logins, and configuration modifications. Supports filtering by date range, category, user, and cursor-based pagination.

List globally blocked IP addresses and ranges for a tenant.

List all globally blocked items (SHA256 hashes) for a tenant.

List all detections associated with a case.

List all cases/investigations for a tenant with rich filtering options.

List all available default content versions that can be used when creating or versioning a cloud security runtime detection profile. Returns the content ID and version string for each available content package.

List all cloud security runtime detection profiles for a tenant (latest versions). Profiles define detection rules and allow/block lists applied to cloud workloads.

List exploit attempts detected by exploit mitigation. Optionally exclude specific exploit thumbprints.

Get available software installer download links for a tenant. Returns URLs for licensed Sophos products. Optionally filter by product name or platform.

List all endpoint groups in a tenant. Groups are used to organize endpoints for policy assignment and management.

List endpoint migration jobs for a tenant. Shows status of endpoint migrations between Sophos Central tenants.

List endpoints in a Sophos Central tenant with optional filtering by type, health status, tamper protection, hostname, or free-text search. Returns paginated results.

List global scanning exclusions for a tenant. Optionally filter by exclusion type (path, process, web, pua, amsi, behavioral, certificateSigner).

List exploit mitigation applications and their protection status. Filter by type ('detected' for auto-detected, 'custom' for manually added) or by modification date.

List exploit mitigation categories (the types of exploits that can be individually enabled/disabled per application).

List all firewall groups in a tenant.

List all managed firewalls in a Sophos Central tenant.

List all endpoints that are members of a specific endpoint group.

List intrusion prevention system (IPS) exclusions for a tenant (traffic excluded from IPS scanning).

List isolation exclusions (IP/port combinations that remain reachable when an endpoint is network-isolated).

List Live Discover query categories available for the tenant.

List all Live Discover query runs (history) with optional filtering by status, result, or saved query ID.

List email mailboxes in a tenant with optional filters.

List the endpoints included in a specific endpoint migration job and their migration status.

List MDM actions (sync, scan, lock, wipe, etc.) for a tenant with filtering by type, state, endpoint IDs, and date ranges.

List mobile app groups (managed app collections) in a Sophos Mobile tenant.

List applications installed on a specific mobile device.

List mobile device groups in a Sophos Mobile tenant.

List MDM policies assigned to a specific mobile device.

List custom device properties for a specific mobile device.

List IXM (Intercept X for Mobile) scan results for a specific mobile device.

List compliance violations for a specific mobile device.

List mobile devices enrolled in Sophos Mobile for a tenant. Supports filtering by platform, management type, compliance status, health state, ownership, device groups, and date ranges. Returns paginated results.

List mobile operating systems known to Sophos Mobile, with optional filtering by platform or version prefix.

List role assignments for a specific partner admin (shows which roles this admin holds).

List peripheral devices detected by peripheral control across the tenant.

List all available permission sets that can be used when creating partner roles.

List endpoint policies in a tenant. Optionally filter by policy type. Supported types: threat-protection, web-control, application-control, peripheral-control, data-collection-and-investigation, device-encryption, server-threat-protection, server-peripheral-control, server-application-control, server-lockdown.

List the endpoints or endpoint groups governed by a specific policy.

List attachments of a post-delivery quarantined message.

List attachments of a pre-delivery quarantined message.

List distributor quotes from the Sophos Business Automation API. Only approved quotes are returned. Requires a Distributor ID.

List all admins assigned to a specific partner role.

List all available partner-level roles that can be assigned to administrators.

List saved Live Discover queries available for the tenant.

List user-added comments for all static software packages in a tenant.

List available static (fixed-version) software packages. Supports filtering by endpoint type, platform, package type, and date ranges.

List management tasks for the tenant's switches, with optional filtering by policy type and pagination. Tasks represent configuration changes pushed to managed switches.

List all administrators for a specific managed tenant using the partner-level endpoint. For tenant-scoped admin management (common/v1), use the tenant admin tools instead.

List administrators for a specific tenant with pagination support. Alias of sophos_list_tenant_admins that exposes pageSize and pageFromKey.

List all permission sets available at the tenant level. Use the returned IDs when creating custom roles.

List all roles available in a tenant.

List all tenants managed by this Sophos Central Partner account. Returns tenant ID, name, data region, billing type, and regional API host for each tenant.

List websites excluded from TLS decryption inspection.

List user groups in a tenant's directory.

List directory users in a Sophos Central tenant.

List all users that are members of a specific directory user group.

List all Web Control categories available for URL filtering. Category IDs are used when creating local site overrides.

List Web Control local site overrides (custom URL allow/block entries) for a tenant.

List management tasks for the tenant's Wi-Fi access points, with optional filtering by policy type and pagination. Tasks represent configuration changes pushed to managed access points.

List saved XDR query templates available for the tenant.

List XDR query categories available for the tenant.

List XDR query run history with optional pagination.

Add or remove email aliases for a mailbox.

Add or remove delegate access for a mailbox.

Add or remove distribution list owners for a mailbox.

Get Sophos-specific detection and hunting guidance for MITRE ATT&CK techniques. Returns detection capability, Live Discover SQL queries, policy settings, and escalation guidance.

Request log collection from up to 50 mobile devices for investigation purposes.

Trigger a GPS location request on up to 50 mobile devices. A reason is required and will be logged in the Sophos Mobile privacy log.

Remotely lock up to 50 mobile devices. Optionally provide a lock code (required for Macs), a lock screen message (Android/iOS), and a phone number to display on locked iPhones.

Trigger an IXM malware scan on up to 50 mobile devices.

Send a push message to up to 50 mobile devices. The message is displayed as a notification on the device.

Trigger a sync action on up to 50 mobile devices — forces devices to check in with Sophos Mobile and apply pending policies.

Unenroll up to 50 mobile devices from Sophos Mobile MDM management.

DESTRUCTIVE: Remotely wipe up to 50 mobile devices, erasing all data. Use with extreme caution — this operation cannot be undone. Macs require a 6-digit wipe code.

Get details for a specific tenant under this Sophos Central Organization account.

List tenants under this Sophos Central Organization account. Use this when your identity type is 'organization' rather than 'partner'. Supports pagination via page_key.

Get SOC incident response playbook for Sophos endpoint incidents. Returns step-by-step guidance referencing exact Sophos MCP tool names.

Get malware triage guidance for specific detection types. Returns containment decisions, evidence collection steps, recovery procedures, and IOC extraction guide.

Get threat hunting playbook for Sophos Live Discover and XDR. Returns SQL queries, MITRE mappings, and isolation decision trees.

Preview the content of a post-delivery quarantined message.

Preview the content (headers, body snippet) of a pre-delivery quarantined message.

Reattach previously stripped attachments to a quarantined message.

Release one or more post-delivery quarantined messages back to recipients.

Release one or more pre-delivery quarantined messages to recipients. Optionally allow sender or submit to labs.

Remove one or more endpoints from an endpoint group. The endpoints themselves are not deleted.

Remove a user from one or more directory user groups.

Remove one or more users from a directory user group.

Request bulk sender privilege for a mailbox that needs to send high volumes of email.

Request forensic log collection from an endpoint for investigation. Returns a forensicLogRequestId to poll for status.

Request a memory dump from an endpoint for forensic investigation. Requires specifying the dump mode and expiry time. Returns a memoryDumpRequestId to poll for status.

Permanently revoke (delete) an account-level access token. Revoking a token immediately invalidates it — any software using it for package downloads will stop working. This action is irreversible.

Run an ad-hoc Live Discover SQL query against one or more endpoints in real time. Returns a run ID to poll for status and results.

Run a saved Live Discover query (from the query library) by its query ID. Returns a run ID to poll for status and results.

Run a saved XDR query (from the query library) by its query ID. Returns a run ID to poll for status and results.

Run an ad-hoc XDR (Extended Detection and Response) SQL query against the Sophos data lake. Returns a run ID to poll for status and results.

Trigger an on-demand scan on an endpoint. The scan runs asynchronously; this call initiates it.

Search alerts using a POST request body. Equivalent to sophos_list_alerts but filters are sent in a JSON body — useful for filtering by multiple IDs or long lists of categories/products.

Search for specific indicators in a firewall's MDR threat feed by their values.

Search post-delivery quarantine messages (messages that were delivered but later quarantined). Use this for clawback/post-delivery remediation workflows.

Search pre-delivery quarantine messages with structured filters. This is the primary way to list quarantined messages.

Enable or disable tamper protection on an endpoint. When enabled, Sophos agent settings cannot be changed without the tamper protection password. Optionally regenerate the password.

Snooze specific health check findings for endpoint or network device categories. The snooze body mirrors the health-check response structure — specify the categories/sub-categories you want to snooze.

Get a guide to all Sophos MCP tools organized by SOC workflow. Includes purpose, when to use, key output fields, and warnings.

Start an async detection-groups query run. Groups detections by detection rule and device for a summary view. Returns a run ID to poll.

Start an async detections query run. Returns a run ID. Poll sophos_get_detections_query_status until status is 'finished', then retrieve results with sophos_get_detections_query_results.

Start an endpoint migration job on the sending tenant. Generates a migration job token that the receiving tenant uses to accept the migration via sophos_accept_migration.

Strip specific attachments from a pre-delivery quarantined message and release it to specified recipients.

Perform an action on a specific alert. Valid actions depend on the alert type and are listed in the alert's allowedActions field. Common actions include: 'acknowledge', 'cleanPua', 'authPua', 'clearThreat', 'clearHmpa', 'sendMsgPua', 'sendMsgThreat'.

Remove multiple blocked IP address entries by their IDs in a single call.

Update an existing account-level access token. Supports updating the token's label and/or expiry date. At least one of label or expires_at must be provided.

Enable or disable Adaptive Attack Protection (AAP) on an endpoint. When enabled with an expiry duration, AAP automatically disables after that period.

Update the comment/reason on an existing globally allowed item.

Update an existing case (name, type, severity, status, assignee, overview).

Rename a cloud security runtime detection profile.

Update the name and/or description of an existing endpoint group.

Update an existing global scanning exclusion (value, comment, and/or scanMode).

Update exploit mitigation settings for an application. Can update executable paths, toggle overall protection, and enable/disable individual exploit mitigations (ASLR, DEP, SEHOP, etc.).

Update a firewall's attributes (name and/or geolocation). Note: name must be 3–40 characters.

Update a firewall group — rename it and/or add/remove firewalls.

Update an IPS exclusion (direction, remote addresses, ports, or comment).

Update an isolation exclusion (direction, remote addresses, ports, or comment).

Update a mailbox's display name.

Update the MDR threat-feed settings for a specific firewall (enable/disable, action mode).

Update a mobile app group's name or apps list (PATCH — only provided fields are updated).

Update a mobile device's attributes (name, ownership type, group assignment, etc.). This is a full PUT replacement of the device record — all required fields must be supplied.

Update a mobile device group. This is a full PUT replacement — all required fields must be provided.

Update the value of an existing custom device property identified by its key.

Update a partner role's name or description.

Update an existing endpoint policy. You can modify its name, enabled state, priority, and/or settings.

Set or update the user comment for a specific static software package (full replace with PUT).

Update the MAC filter settings for a tenant's managed switches. Provide a list of MAC addresses to allow or block on switch ports. Replaces the existing MAC address list. Maximum 256 entries.

Update a tenant administrator's details (name or email).

Update a tenant-level custom role's name or description.

Update Web Control TLS decryption settings. Pass a JSON array of category objects with id and decryptionEnabled fields.

Add or remove websites from TLS decryption exclusions in a single call. Pass JSON arrays for 'add' and/or 'remove'.

Update a directory user's details.

Update a directory user group's name or description.

Update a Web Control local site override (URL, categoryId, and/or comment).

Update the MAC filter settings for a tenant's managed Wi-Fi access points. Provide a list of MAC addresses to allow or block. Replaces the existing MAC address list. Maximum 256 entries.

Call GET /whoami/v1 to discover the authenticated entity's identity. Returns idType ('partner', 'organization', or 'tenant'), the entity's UUID (id), and regional API hosts (global and dataRegion). Use this to determine which account type is connected and which regional API base URL to use for tenant-scoped calls.