# Posture ## List device posture rules `client.zeroTrust.devices.posture.list(PostureListParamsparams, RequestOptionsoptions?): SinglePage` **get** `/accounts/{account_id}/devices/posture` Fetches device posture rules for a Zero Trust account. ### Parameters - `params: PostureListParams` - `account_id: string` ### Returns - `DevicePostureRule` - `id?: string` API UUID. - `description?: string` The description of the device posture rule. - `enabled?: boolean` Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise. - `expiration?: string` Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `name?: string` The name of the device posture rule. - `schedule?: string` Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. - `type?: "file" | "application" | "tanium" | 20 more` The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const devicePostureRule of client.zeroTrust.devices.posture.list({ account_id: '699d98642c564d2e855e9661899b7252', })) { console.log(devicePostureRule.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "description": "The rule for admin serial numbers", "enabled": true, "expiration": "1h", "input": { "operating_system": "linux", "path": "/bin/cat", "exists": true, "sha256": "https://api.us-2.crowdstrike.com", "thumbprint": "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e" }, "match": [ { "platform": "windows" } ], "name": "Admin Serial Numbers", "schedule": "1h", "type": "file" } ], "success": true, "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ``` ## Get device posture rule details `client.zeroTrust.devices.posture.get(stringruleID, PostureGetParamsparams, RequestOptionsoptions?): DevicePostureRule | null` **get** `/accounts/{account_id}/devices/posture/{rule_id}` Fetches a single device posture rule. ### Parameters - `ruleID: string` API UUID. - `params: PostureGetParams` - `account_id: string` ### Returns - `DevicePostureRule | null` - `id?: string` API UUID. - `description?: string` The description of the device posture rule. - `enabled?: boolean` Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise. - `expiration?: string` Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `name?: string` The name of the device posture rule. - `schedule?: string` Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. - `type?: "file" | "application" | "tanium" | 20 more` The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const devicePostureRule = await client.zeroTrust.devices.posture.get( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252' }, ); console.log(devicePostureRule.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "description": "The rule for admin serial numbers", "enabled": true, "expiration": "1h", "input": { "operating_system": "linux", "path": "/bin/cat", "exists": true, "sha256": "https://api.us-2.crowdstrike.com", "thumbprint": "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e" }, "match": [ { "platform": "windows" } ], "name": "Admin Serial Numbers", "schedule": "1h", "type": "file" }, "success": true } ``` ## Create a device posture rule `client.zeroTrust.devices.posture.create(PostureCreateParamsparams, RequestOptionsoptions?): DevicePostureRule | null` **post** `/accounts/{account_id}/devices/posture` Creates a new device posture rule. ### Parameters - `params: PostureCreateParams` - `account_id: string` Path param - `name: string` Body param: The name of the device posture rule. - `type: "file" | "application" | "tanium" | 20 more` Body param: The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` - `description?: string` Body param: The description of the device posture rule. - `expiration?: string` Body param: Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` Body param: The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` Body param: The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `schedule?: string` Body param: Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. ### Returns - `DevicePostureRule | null` - `id?: string` API UUID. - `description?: string` The description of the device posture rule. - `enabled?: boolean` Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise. - `expiration?: string` Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `name?: string` The name of the device posture rule. - `schedule?: string` Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. - `type?: "file" | "application" | "tanium" | 20 more` The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const devicePostureRule = await client.zeroTrust.devices.posture.create({ account_id: '699d98642c564d2e855e9661899b7252', name: 'Admin Serial Numbers', type: 'file', }); console.log(devicePostureRule.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "description": "The rule for admin serial numbers", "enabled": true, "expiration": "1h", "input": { "operating_system": "linux", "path": "/bin/cat", "exists": true, "sha256": "https://api.us-2.crowdstrike.com", "thumbprint": "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e" }, "match": [ { "platform": "windows" } ], "name": "Admin Serial Numbers", "schedule": "1h", "type": "file" }, "success": true } ``` ## Update a device posture rule `client.zeroTrust.devices.posture.update(stringruleID, PostureUpdateParamsparams, RequestOptionsoptions?): DevicePostureRule | null` **put** `/accounts/{account_id}/devices/posture/{rule_id}` Updates a device posture rule. ### Parameters - `ruleID: string` API UUID. - `params: PostureUpdateParams` - `account_id: string` Path param - `name: string` Body param: The name of the device posture rule. - `type: "file" | "application" | "tanium" | 20 more` Body param: The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` - `description?: string` Body param: The description of the device posture rule. - `expiration?: string` Body param: Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` Body param: The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` Body param: The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `schedule?: string` Body param: Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. ### Returns - `DevicePostureRule | null` - `id?: string` API UUID. - `description?: string` The description of the device posture rule. - `enabled?: boolean` Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise. - `expiration?: string` Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `name?: string` The name of the device posture rule. - `schedule?: string` Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. - `type?: "file" | "application" | "tanium" | 20 more` The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const devicePostureRule = await client.zeroTrust.devices.posture.update( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252', name: 'Admin Serial Numbers', type: 'file', }, ); console.log(devicePostureRule.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "description": "The rule for admin serial numbers", "enabled": true, "expiration": "1h", "input": { "operating_system": "linux", "path": "/bin/cat", "exists": true, "sha256": "https://api.us-2.crowdstrike.com", "thumbprint": "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e" }, "match": [ { "platform": "windows" } ], "name": "Admin Serial Numbers", "schedule": "1h", "type": "file" }, "success": true } ``` ## Delete a device posture rule `client.zeroTrust.devices.posture.delete(stringruleID, PostureDeleteParamsparams, RequestOptionsoptions?): PostureDeleteResponse | null` **delete** `/accounts/{account_id}/devices/posture/{rule_id}` Deletes a device posture rule. ### Parameters - `ruleID: string` API UUID. - `params: PostureDeleteParams` - `account_id: string` ### Returns - `PostureDeleteResponse` - `id?: string` API UUID. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const posture = await client.zeroTrust.devices.posture.delete( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252' }, ); console.log(posture.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415" }, "success": true } ``` ## Domain Types ### Carbonblack Input - `CarbonblackInput = string` ### Client Certificate Input - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. ### Crowdstrike Input - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` ### Device Input - `DeviceInput = FileInput | UniqueClientIDInput | DomainJoinedInput | 17 more` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. ### Device Match - `DeviceMatch` - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` ### Device Posture Rule - `DevicePostureRule` - `id?: string` API UUID. - `description?: string` The description of the device posture rule. - `enabled?: boolean` Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise. - `expiration?: string` Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. - `input?: DeviceInput` The value to be checked against. - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesCarbonblackInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `TeamsDevicesAccessSerialNumberListInputRequest` - `id: string` UUID of Access List. - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. - `TeamsDevicesApplicationInputRequest` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` Path for the application. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. - `ClientCertificateInput` - `certificate_id: string` UUID of Cloudflare managed certificate. - `cn: string` Common Name that is protected by the certificate. - `TeamsDevicesClientCertificateV2InputRequest` - `certificate_id: string` UUID of Cloudflare managed certificate. - `check_private_key: boolean` Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `cn?: string` Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables. - `extended_key_usage?: Array<"clientAuth" | "emailProtection">` List of values indicating purposes for which the certificate public key can be used. - `"clientAuth"` - `"emailProtection"` - `locations?: Locations` - `paths?: Array` List of paths to check for client certificate on linux. - `trust_stores?: Array<"system" | "user">` List of trust stores to check for client certificate. - `"system"` - `"user"` - `subject_alternative_names?: Array` List of certificate Subject Alternative Names. - `TeamsDevicesAntivirusInputRequest` - `update_window_days?: number` Number of days that the antivirus should be updated within. - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. - `CrowdstrikeInput` - `connection_id: string` Posture Integration ID. - `last_seen?: string` For more details on last seen, please refer to the Crowdstrike documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `os?: string` Os Version. - `overall?: string` Overall. - `sensor_config?: string` SensorConfig. - `state?: "online" | "offline" | "unknown"` For more details on state, please refer to the Crowdstrike documentation. - `"online"` - `"offline"` - `"unknown"` - `version?: string` Version. - `versionOperator?: "<" | "<=" | ">" | 2 more` Version Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `TeamsDevicesCustomS2sInputRequest` - `connection_id: string` Posture Integration ID. - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `score: number` A value between 0-100 assigned to devices set by the 3rd party posture provider. - `match?: Array` The conditions that the client must match to run the rule. - `platform?: "windows" | "mac" | "linux" | 3 more` - `"windows"` - `"mac"` - `"linux"` - `"android"` - `"ios"` - `"chromeos"` - `name?: string` The name of the device posture rule. - `schedule?: string` Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`. - `type?: "file" | "application" | "tanium" | 20 more` The type of device posture rule. - `"file"` - `"application"` - `"tanium"` - `"gateway"` - `"warp"` - `"disk_encryption"` - `"serial_number"` - `"sentinelone"` - `"carbonblack"` - `"firewall"` - `"os_version"` - `"domain_joined"` - `"client_certificate"` - `"client_certificate_v2"` - `"antivirus"` - `"unique_client_id"` - `"kolide"` - `"tanium_s2s"` - `"crowdstrike_s2s"` - `"intune"` - `"workspace_one"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Disk Encryption Input - `DiskEncryptionInput` - `checkDisks?: Array` List of volume names to be checked for encryption. - `requireAll?: boolean` Whether to check all disks for encryption. ### Domain Joined Input - `DomainJoinedInput` - `operating_system: "windows"` Operating System. - `"windows"` - `domain?: string` Domain. ### File Input - `FileInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `exists?: boolean` Whether or not file exists. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. ### Firewall Input - `FirewallInput` - `enabled: boolean` Enabled. - `operating_system: "windows" | "mac"` Operating System. - `"windows"` - `"mac"` ### Intune Input - `IntuneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown" | 3 more` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `"notapplicable"` - `"ingraceperiod"` - `"error"` - `connection_id: string` Posture Integration ID. ### Kolide Input - `KolideInput` - `connection_id: string` Posture Integration ID. - `auth_state?: Array<"Good" | "Notified" | "Will Block" | "Blocked">` The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. - `"Good"` - `"Notified"` - `"Will Block"` - `"Blocked"` - `countOperator?: "<" | "<=" | ">" | 2 more` Count Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `issue_count?: string` The Number of Issues. ### OS Version Input - `OSVersionInput` - `operating_system: "windows"` Operating System. - `"windows"` - `operator: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `version: string` Version of OS. - `os_distro_name?: string` Operating System Distribution Name (linux only). - `os_distro_revision?: string` Version of OS Distribution (linux only). - `os_version_extra?: string` Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. ### Sentinelone Input - `SentineloneInput` - `operating_system: "windows" | "linux" | "mac"` Operating system. - `"windows"` - `"linux"` - `"mac"` - `path: string` File path. - `sha256?: string` SHA-256. - `thumbprint?: string` Signing certificate thumbprint. ### Sentinelone S2s Input - `SentineloneS2sInput` - `connection_id: string` Posture Integration ID. - `active_threats?: number` The Number of active threats. - `infected?: boolean` Whether device is infected. - `is_active?: boolean` Whether device is active. - `network_status?: "connected" | "disconnected" | "disconnecting" | "connecting"` Network status of device. - `"connected"` - `"disconnected"` - `"disconnecting"` - `"connecting"` - `operational_state?: "na" | "partially_disabled" | "auto_fully_disabled" | 4 more` Agent operational state. - `"na"` - `"partially_disabled"` - `"auto_fully_disabled"` - `"fully_disabled"` - `"auto_partially_disabled"` - `"disabled_error"` - `"db_corruption"` - `operator?: "<" | "<=" | ">" | 2 more` Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` ### Tanium Input - `TaniumInput` - `connection_id: string` Posture Integration ID. - `eid_last_seen?: string` For more details on eid last seen, refer to the Tanium documentation. - `operator?: "<" | "<=" | ">" | 2 more` Operator to evaluate risk_level or eid_last_seen. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `risk_level?: "low" | "medium" | "high" | "critical"` For more details on risk level, refer to the Tanium documentation. - `"low"` - `"medium"` - `"high"` - `"critical"` - `scoreOperator?: "<" | "<=" | ">" | 2 more` Score Operator. - `"<"` - `"<="` - `">"` - `">="` - `"=="` - `total_score?: number` For more details on total score, refer to the Tanium documentation. ### Unique Client ID Input - `UniqueClientIDInput` - `id: string` List ID. - `operating_system: "android" | "ios" | "chromeos"` Operating System. - `"android"` - `"ios"` - `"chromeos"` ### Workspace One Input - `WorkspaceOneInput` - `compliance_status: "compliant" | "noncompliant" | "unknown"` Compliance Status. - `"compliant"` - `"noncompliant"` - `"unknown"` - `connection_id: string` Posture Integration ID. ### Posture Delete Response - `PostureDeleteResponse` - `id?: string` API UUID. # Integrations ## List your device posture integrations `client.zeroTrust.devices.posture.integrations.list(IntegrationListParamsparams, RequestOptionsoptions?): SinglePage` **get** `/accounts/{account_id}/devices/posture/integration` Fetches the list of device posture integrations for an account. ### Parameters - `params: IntegrationListParams` - `account_id: string` ### Returns - `Integration` - `id?: string` API UUID. - `config?: Config` The configuration object containing third-party integration information. - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `interval?: string` The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const integration of client.zeroTrust.devices.posture.integrations.list({ account_id: '699d98642c564d2e855e9661899b7252', })) { console.log(integration.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "config": { "api_url": "https://as123.awmdm.com/API", "auth_url": "https://na.uemauth.workspaceone.com/connect/token", "client_id": "example client id" }, "interval": "10m", "name": "My Workspace One Integration", "type": "workspace_one" } ], "success": true, "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ``` ## Get device posture integration details `client.zeroTrust.devices.posture.integrations.get(stringintegrationID, IntegrationGetParamsparams, RequestOptionsoptions?): Integration | null` **get** `/accounts/{account_id}/devices/posture/integration/{integration_id}` Fetches details for a single device posture integration. ### Parameters - `integrationID: string` API UUID. - `params: IntegrationGetParams` - `account_id: string` ### Returns - `Integration | null` - `id?: string` API UUID. - `config?: Config` The configuration object containing third-party integration information. - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `interval?: string` The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.devices.posture.integrations.get( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252' }, ); console.log(integration.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "config": { "api_url": "https://as123.awmdm.com/API", "auth_url": "https://na.uemauth.workspaceone.com/connect/token", "client_id": "example client id" }, "interval": "10m", "name": "My Workspace One Integration", "type": "workspace_one" }, "success": true } ``` ## Create a device posture integration `client.zeroTrust.devices.posture.integrations.create(IntegrationCreateParamsparams, RequestOptionsoptions?): Integration | null` **post** `/accounts/{account_id}/devices/posture/integration` Create a new device posture integration. ### Parameters - `params: IntegrationCreateParams` - `account_id: string` Path param - `config: TeamsDevicesWorkspaceOneConfigRequest | TeamsDevicesCrowdstrikeConfigRequest | TeamsDevicesUptycsConfigRequest | 5 more` Body param: The configuration object containing third-party integration information. - `TeamsDevicesWorkspaceOneConfigRequest` - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `client_secret: string` The Workspace One client secret provided in the Workspace One Admin Dashboard. - `TeamsDevicesCrowdstrikeConfigRequest` - `api_url: string` The Crowdstrike API URL. - `client_id: string` The Crowdstrike client ID. - `client_secret: string` The Crowdstrike client secret. - `customer_id: string` The Crowdstrike customer ID. - `TeamsDevicesUptycsConfigRequest` - `api_url: string` The Uptycs API URL. - `client_key: string` The Uptycs client secret. - `client_secret: string` The Uptycs client secret. - `customer_id: string` The Uptycs customer ID. - `TeamsDevicesIntuneConfigRequest` - `client_id: string` The Intune client ID. - `client_secret: string` The Intune client secret. - `customer_id: string` The Intune customer ID. - `TeamsDevicesKolideConfigRequest` - `client_id: string` The Kolide client ID. - `client_secret: string` The Kolide client secret. - `TeamsDevicesTaniumConfigRequest` - `api_url: string` The Tanium API URL. - `client_secret: string` The Tanium client secret. - `access_client_id?: string` If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`. - `access_client_secret?: string` If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`. - `TeamsDevicesSentineloneS2sConfigRequest` - `api_url: string` The SentinelOne S2S API URL. - `client_secret: string` The SentinelOne S2S client secret. - `TeamsDevicesCustomS2sConfigRequest` - `access_client_id: string` This id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`. - `access_client_secret: string` This secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`. - `api_url: string` The Custom Device Posture Integration API URL. - `interval: string` Body param: The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name: string` Body param: The name of the device posture integration. - `type: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` Body param: The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Returns - `Integration | null` - `id?: string` API UUID. - `config?: Config` The configuration object containing third-party integration information. - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `interval?: string` The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.devices.posture.integrations.create({ account_id: '699d98642c564d2e855e9661899b7252', config: { api_url: 'https://as123.awmdm.com/API', auth_url: 'https://na.uemauth.workspaceone.com/connect/token', client_id: 'example client id', client_secret: 'example client secret', }, interval: '10m', name: 'My Workspace One Integration', type: 'workspace_one', }); console.log(integration.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "config": { "api_url": "https://as123.awmdm.com/API", "auth_url": "https://na.uemauth.workspaceone.com/connect/token", "client_id": "example client id" }, "interval": "10m", "name": "My Workspace One Integration", "type": "workspace_one" }, "success": true } ``` ## Update a device posture integration `client.zeroTrust.devices.posture.integrations.edit(stringintegrationID, IntegrationEditParamsparams, RequestOptionsoptions?): Integration | null` **patch** `/accounts/{account_id}/devices/posture/integration/{integration_id}` Updates a configured device posture integration. ### Parameters - `integrationID: string` API UUID. - `params: IntegrationEditParams` - `account_id: string` Path param - `config?: TeamsDevicesWorkspaceOneConfigRequest | TeamsDevicesCrowdstrikeConfigRequest | TeamsDevicesUptycsConfigRequest | 5 more` Body param: The configuration object containing third-party integration information. - `TeamsDevicesWorkspaceOneConfigRequest` - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `client_secret: string` The Workspace One client secret provided in the Workspace One Admin Dashboard. - `TeamsDevicesCrowdstrikeConfigRequest` - `api_url: string` The Crowdstrike API URL. - `client_id: string` The Crowdstrike client ID. - `client_secret: string` The Crowdstrike client secret. - `customer_id: string` The Crowdstrike customer ID. - `TeamsDevicesUptycsConfigRequest` - `api_url: string` The Uptycs API URL. - `client_key: string` The Uptycs client secret. - `client_secret: string` The Uptycs client secret. - `customer_id: string` The Uptycs customer ID. - `TeamsDevicesIntuneConfigRequest` - `client_id: string` The Intune client ID. - `client_secret: string` The Intune client secret. - `customer_id: string` The Intune customer ID. - `TeamsDevicesKolideConfigRequest` - `client_id: string` The Kolide client ID. - `client_secret: string` The Kolide client secret. - `TeamsDevicesTaniumConfigRequest` - `api_url: string` The Tanium API URL. - `client_secret: string` The Tanium client secret. - `access_client_id?: string` If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`. - `access_client_secret?: string` If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`. - `TeamsDevicesSentineloneS2sConfigRequest` - `api_url: string` The SentinelOne S2S API URL. - `client_secret: string` The SentinelOne S2S client secret. - `TeamsDevicesCustomS2sConfigRequest` - `access_client_id: string` This id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`. - `access_client_secret: string` This secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`. - `api_url: string` The Custom Device Posture Integration API URL. - `interval?: string` Body param: The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` Body param: The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` Body param: The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Returns - `Integration | null` - `id?: string` API UUID. - `config?: Config` The configuration object containing third-party integration information. - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `interval?: string` The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.devices.posture.integrations.edit( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252' }, ); console.log(integration.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "config": { "api_url": "https://as123.awmdm.com/API", "auth_url": "https://na.uemauth.workspaceone.com/connect/token", "client_id": "example client id" }, "interval": "10m", "name": "My Workspace One Integration", "type": "workspace_one" }, "success": true } ``` ## Delete a device posture integration `client.zeroTrust.devices.posture.integrations.delete(stringintegrationID, IntegrationDeleteParamsparams, RequestOptionsoptions?): IntegrationDeleteResponse | null` **delete** `/accounts/{account_id}/devices/posture/integration/{integration_id}` Delete a configured device posture integration. ### Parameters - `integrationID: string` API UUID. - `params: IntegrationDeleteParams` - `account_id: string` ### Returns - `IntegrationDeleteResponse = unknown | string | null` - `unknown` - `string` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.devices.posture.integrations.delete( 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415', { account_id: '699d98642c564d2e855e9661899b7252' }, ); console.log(integration); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": {}, "success": true } ``` ## Domain Types ### Integration - `Integration` - `id?: string` API UUID. - `config?: Config` The configuration object containing third-party integration information. - `api_url: string` The Workspace One API URL provided in the Workspace One Admin Dashboard. - `auth_url: string` The Workspace One Authorization URL depending on your region. - `client_id: string` The Workspace One client ID provided in the Workspace One Admin Dashboard. - `interval?: string` The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`). - `name?: string` The name of the device posture integration. - `type?: "workspace_one" | "crowdstrike_s2s" | "uptycs" | 5 more` The type of device posture integration. - `"workspace_one"` - `"crowdstrike_s2s"` - `"uptycs"` - `"intune"` - `"kolide"` - `"tanium_s2s"` - `"sentinelone_s2s"` - `"custom_s2s"` ### Integration Delete Response - `IntegrationDeleteResponse = unknown | string | null` - `unknown` - `string`