Skip to content

Getting started

What you will build

  1. Authenticate to the shared Sophos Fusion GraphQL endpoint.
  2. List the first page of AI Defense policies for your tenant.
  3. Request the next page with a cursor.

Prerequisites

Get credentials

Follow the audience guide above to create a service principal. Exchange it for a bearer token with the client_credentials grant.

Queries need permission to read AI Defense policies. Mutations need permission to create, update, or delete them.

First authenticated call

Send a POST request to the GraphQL endpoint. Put the token in the Authorization header and your tenant ID in X-Tenant-ID.

The policies query returns policies in priority order. This call asks for the first 10 policies and selects fields for a policy list.

curl -X POST "https://api.taegis.sophos.com/graphql" \
  -H "Authorization: Bearer <jwt>" \
  -H "X-Tenant-ID: <tenant-id>" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query ListPolicies($first: Int64, $after: String) { policies(first: $first, after: $after) { totalCount pageInfo { hasNextPage endCursor } policies { id name rank state enforcementStatus updatedAt } } }",
    "variables": {
      "first": 10
    }
  }'

A successful response looks like this:

{
  "data": {
    "policies": {
      "totalCount": 12,
      "pageInfo": {
        "hasNextPage": true,
        "endCursor": "<cursor>"
      },
      "policies": [
        {
          "id": "<policy-id>",
          "name": "Block unsanctioned AI chat apps",
          "rank": 1,
          "state": "ENABLED",
          "enforcementStatus": "ENFORCED",
          "updatedAt": "2026-10-13T09:30:00Z"
        }
      ]
    }
  }
}

Verify it worked

Check data.policies.totalCount in the response. It is the number of policies that match your filter on all pages.

A request that fails at the GraphQL layer returns HTTP 200 with an errors array. An expired token or a rate limit returns a non-2xx status before the query reaches the GraphQL layer.

What to do next

  • Browse the AI Defense Policy GraphQL API reference for every query and mutation, or go to its types.
  • Use createPolicy, updatePolicy, and deletePolicy to manage policies. Pass the current version to updatePolicy so that the API can detect a conflicting change.
  • Use movePolicy or reorderPolicies to change the evaluation order. Use enablePolicy and disablePolicy to change the policy state.
  • Use appSanctioning to get the sanctioning status that your policies give each application.
  • Use previewRuleTargets to see which applications each rule acts on before you save it. Use previewPolicyImpact to get the totals for each action.

Get the next page

The policies query uses forward cursor pagination. The default page size is 50 and the maximum is 100.

To get the next page, send the same query again. Set after to the endCursor value from the previous page. Stop when pageInfo.hasNextPage is false.

Use filter to limit the results. For example, set filter.state to ENABLED or set filter.nameSearch to match part of a policy name.

Selection-set cost

Request only the fields you need. Some fields resolve more data on each request.

  • PolicyRule.targetPreview and PolicyRule.targetPreviewV2 resolve the matched applications for each rule. On a large policy list, select them only when you need them.
  • Policy.createdBySubject and Policy.updatedBySubject are resolved by a different service through the federated endpoint. They are null when that lookup fails.

The AI Defense services do not set their own query depth or complexity limit. This guide cannot confirm the limits that the federated GraphQL endpoint applies. Keep nested selections narrow, and request only the pages you need.