Devices

The Sentinel Devices API gives you programmatic control over every enrolled endpoint, query inventory, trigger isolation, and initiate scans, all with a complete audit trail.

List devices

bash

GET /v1/sentinel/devices

Name	Type	Required	Description
filter[platform]	string	No	windows \| macos \| linux \| ios \| android
filter[status]	string	No	online \| offline \| isolated \| decommissioned
filter[compliance_status]	string	No	compliant \| non_compliant \| unknown
filter[label]	string	No	Filter by device label tag.
filter[risk_min]	integer	No	Minimum risk score (0–100).
filter[risk_max]	integer	No	Maximum risk score (0–100).

bash

# Get all high-risk Windows devices
curl https://api.hldgroup.org/v1/sentinel/devices \
  -H "Authorization: Bearer hld_live_xxxx" \
  -H "x-tenant-id: ten_01hxyz" \
  "?filter[platform]=windows&filter[risk_min]=75"

Get a device

bash

GET /v1/sentinel/devices/:id

Isolate a device

bash

POST /v1/sentinel/devices/:id/isolate

Name	Type	Required	Description
reason	string	Yes	Why the device is being isolated. Logged to the audit trail.
incident_id	string	No	Optional incident to associate this action with.

bash

curl -X POST https://api.hldgroup.org/v1/sentinel/devices/dev_01hxyz/isolate \
  -H "Authorization: Bearer hld_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Ransomware staging detected, isolating pending investigation.", "incident_id": "inc_01hxyz"}'

Returns 200 once a signed isolation command has been queued to the device's agent — this acknowledges dispatch, not completion. The device's status updates asynchronously once the agent executes the command and reports back, typically within seconds on a healthy connection.

Warning:Isolation cuts the device from the network once the agent executes the queued command; it is not instantaneous with the API call. The Sentinel agent maintains a management-only channel for de-isolation. Always provide a reason, it is written to the permanent incident timeline.

De-isolate a device

bash

POST /v1/sentinel/devices/:id/deisolate

Same dispatch-not-completion contract as isolation above.

Run a scan

bash

POST /v1/sentinel/devices/:id/scan

Name	Type	Required	Description
scan_type	string	No	full \| quick \| custom \| rootkit \| memory. Defaults to full.

Returns 202 Accepted with a scan job object. Poll GET /v1/sentinel/devices/scans/:scan_id for status.

Live query

Warning:Not yet available. The endpoint exists (POST /v1/sentinel/devices/:id/query) but there is no live-query execution path on the endpoint agent today — the request is accepted and queued, but nothing on the device will ever run it, so it never progresses past a queued state. This section describes the intended shape once agent-side support ships; do not build against it as a working capability yet.

bash

POST /v1/sentinel/devices/:id/query

{
  "query": "SELECT pid, name, path FROM processes WHERE on_disk = 0;"
}

Network & blocking Fleet operations