Skip to content

Getting started

Overview

Note: This guide provides only a small overview of possible workflows and API requests. See the Mobile API reference for a comprehensive description of this API.

Prerequisites

You must have a set of API credentials (service principal) to be able to call the Mobile API. For more information refer to the appropriate quick start guide:

Terminology

Before you use the Mobile API, here are a few terms you should know:

  • Endpoint: The general term for a device managed in Sophos Central.
  • Mobile device or Device: A device managed by Sophos Mobile. This is a special type of endpoint. The device ID used by Sophos Mobile is identical to the endpoint ID used elsewhere in Sophos Central. For brevity, we're referring to all devices managed by Sophos Mobile as mobile devices, although this can include Windows computers and Macs.
  • IXM: Sophos Intercept X for Mobile.
  • Ownership Type: Who owns the device. For mobile devices, the ownership type is company for devices owned by your organization and personal for devices owned by the user.

Making API requests

The following sections show examples of API requests using the cURL tool. For information on how to install cURL, see the cURL website.

A cURL request to the Mobile API has the following general form:

curl -X <method> -H "Authorization: Bearer <JWT>" -H "X-Tenant-ID: <tenant-id>" <data-region><path>

The command includes the following placeholders:

  • <method>: The HTTP request method. For the Mobile API, this is either GET, POST, PUT, or DELETE.
  • <tenant-id>: The ID of the tenant you want to query.
  • <JWT>: The JWT access token returned when the IDP authenticates the service principal.
  • <data-region>: The regional API host in the data geography where the tenant data is located.
  • <path>: The request path for the API operation, for example /mobile/v1/devices.

The API descriptions in this guide only specify the request method and path. For example:

GET /mobile/v1/devices

To make an actual API request, you must expand this to the full form shown above.

All API requests return HTTP status codes 200 or 201 when successful.

Responses include a different amount of data based on the view parameter. To see the fields a response includes, see the Mobile API reference. That guide has an example for each view value, full, summary, and basic.

You can use the fields parameter to request individual fields. Values are the field names of the response entity.

Note that you can't use the view and fields parameters in the same request.

Device info

GET /mobile/v1/devices?pageTotal=true

Response: A list of mobile devices in paginated form. Contains the total number of items.

{
  "items": [
    {
      "id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //ID of the mobile device
      "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
      },
      "name": "AAA Chrome Work", //Name of the mobile device
      "email": "user@example.com", //Associated email of the mobile device
      "healthState": {
        "state": "amber", //Health statuts of the mobile device
        "mode": "automatic" //Whether the health status is set by Sophos Mobile based on the device's compliance or manually set by the admin.
      },
      "ownershipType": "corporate", //The device owner. "corporate" for devices owned by your organization, "personal" for devices owned by the user.
      "lastSeenAt": "2024-10-24T05:35:30.000Z", //The last timestamp when the device connected to Sophos Mobile
      "ixmAppLastSeenAt": "2024-10-24T05:35:30.000Z", //The last timestamp when the IXM app connected to Sophos Mobile
      "compliance": {
        "compliant": false, //The device isn't compliant
        "severity": "high" //The severity of the compliance violation. Here, "High".
      },
      "managementType": "chromeSecurity", //The device's management mode. Here, Sophos Chrome Security.
      "managedState": "managed", //The device's management status. Here, "Managed".
      "os": {
        "id": "4e880043-3206-4166-ab0b-3d9bf2a60196", //The ID of the device's operating system.
        "name": "Chrome 129", //The name of the device's operating system.
        "platform": "chrome" //The device platform.
      }
    }
  ],
  "pages": {
    "current": 1, //The current page
    "size": 50, //The number of items on a page. You can change this value with the pageSize=<int_value> query parameter.
    "total": 1, //The total number of pages
    "items": 1, //The total number of items on all pages
    "maxSize": 500 //The maximum allowed page size for the pageSize query parameter.
  }
}

Extended device details

GET /mobile/v1/devices/{id}?view=full

Response: A list of mobile devices in paginated form. Contains the total number of items.

{
    "id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //ID of the mobile device
    "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
    },
    "name": "Chromebook 2687", //Name of the mobile device
    "description": "", //A description for the mobile device
    "phoneNumber": "", //The device's phone number configured in Sophos Mobile, if available
    "email": "user@example.com", //Email of the user assigned to the device
    "assignedPerson": {
        "id": "9f059011-84c7-4849-ae2e-d0563743e485", //ID of the assigned user
        "name": "Simon Smith", //Name of the assigned user
        "email": "user@example.com" //Email of the assigned user
    },
    "healthState": {
        "state": "amber", //Health statuts of the mobile device
        "mode": "automatic" //Health statuts mode of the mobile device
    },
    "ownershipType": "corporate", //Ownership Type indicates it's a company issued device
    "createdAt": "2024-10-15T14:18:50.000Z", //Timestamp the mobile device was created in the system
    "updatedAt": "2024-10-15T14:57:15.000Z", //Timestamp the mobile device was updated
    "lastSeenAt": "2024-10-24T05:35:30.000Z", //Timestamp the device connected to the server
    "ixmAppLastSeenAt": "2024-10-24T05:35:30.000Z", //Timestamp the IXM app connected to the server
    "compliance": {
        "compliant": false, //Mobile device isn't compliant
        "severity": "high" //The severity of the compliance violation is high
    },
    "modelName": "Google Chromebook", //The model name of the mobile device
    "managementType": "chromeSecurity", //The mobile device is only managed by the Chrome Security Extension
    "managedState": "managed", //The management state of the mobile device
    "os": {
        "id": "4e880043-3206-4166-ab0b-3d9bf2a60196", //The ID of this OS entry
        "name": "Chrome 129", //Name of the OS entry
        "platform": "chrome" //Platform of the OS entry
    },
    "deviceGroup": {
        "id": "47641750-7f17-461a-84c2-8e94fd705b20", //The device group ID
        "name": "Default" //The device group name
    }
}

Management types

Responses from the device-related resources of the Mobile API include a field named managementType, which contains the current Sophos Mobile management type of the device. These values can also be used as a parameter for the managementType filter. For example:

GET /mobile/v1/devices?managementType=ixm,chromeSecurity,iosUser
Value Meaning
notManaged Device is not managed by server and is inactive
ixm Only the Sophos Intercept X Mobile app is enrolled with the server
fullMdm Device is MDM-managed
androidWorkProfile Android Work Profile
androidDevice Android device owner mode
chromeSecurity Only the Sophos Chrome Security extension on ChromeOS is enrolled with the server
iosUser Device is an iPhone or iPad with Apple User Enrollment

Device properties

The following table shows the device properties managed by the server. You can't modify these properties with the /properties resource. However, you can use these values as parameters for the devicePropertyKeyfilter. For example:

GET /mobile/v1/devices/<uuid>/properties?devicePropertyKey=device.root-status,device.name,device.model
devicePropertyKey Description
app.chrome-extension.last-seen The timestamp of the last server connection of the Chrome Security extension
app.chrome-extension.version The version of the Chrome Security extension
app.ixm.android.accessibility-service.active Whether the Android accessibility service is active
app.ixm.android.usage-access.active Whether Android usage access is active
app.ixm.enrolled The timestamp when Intercept X for Mobile was enrolled with the server
app.ixm.last-seen The timestamp of the last server connection of Intercept X for Mobile
app.ixm.vdl.last-update The timestamp when Intercept X for Mobile updated its virus definitions
app.ixm.version The version of the Intercept X for Mobile app
app.ixm.web-filtering.enabled Whether the Web Filtering feature of Intercept X for Mobile is turned on
app.log-level The configured log level of the mobile security app
app.smc.android.ignore-battery-optimization.active Whether the 'Ignore battery optimization' Android setting is turned on for Sophos Mobile Security
app.smc.android.usage-access.active Whether the 'Usage access' Android setting is turned on for Sophos Mobile Security
app.smc.version The version of Sophos Mobile Control
chrome.profile.user-account The associated user account of the Chrome profile
device.app-side-loading.allowed Whether app side loading is allowed
device.battery.status The device's battery status
device.bluetooth.enabled Whether Bluetooth is turned on on the device
device.encryption.status The device's encryption status
device.enrollment-date The timestamp when the MDM was enrolled with the server
device.factory-reset-protection.deactivated-by-admin For Android, whether the admin has turned off Factory Reset Protection
device.factory-reset-protection.enabled For Android, whether Factory Reset Protection is turned on
device.imei The IMEI
device.imei-or-meid The IMEI or MEID
device.last-compliance-check The timestamp of the last compliance check
device.meid The MEID
device.memory.external.available The amount of available external memory
device.memory.internal.available The amount of available internal memory
device.memory.internal.capacity The capacity of internal memory
device.memory.mass-storage.enabled Whether the USB Mass Storage mode is turned on
device.memory.ram.capacity The capacity of RAM
device.model The device model
device.model-name The device model name
device.name The computer name reported by macOS
device.network.cellular.network-operator The network operator of the cellular network
device.network.cellular.sim-operator The SIM operator of the cellular network
device.network.firewall.enabled Whether the network firewall is turned on
device.network.firewall.status The status of the network firewall
device.network.lan.ip The IP address of the LAN interface
device.network.lan.mac The MAC address of the LAN interface
device.network.wifi.ip The IP address of the Wi-Fi interface
device.network.wifi.ipv4 The IPv4 address of the Wi-Fi interface
device.network.wifi.mac The MAC address of the Wi-Fi interface
device.passcode.policy-applied Whether the passcode policy is applied
device.passcode.present Whether a passcode exists
device.processor.information Information about the processor
device.reported-phone-number The phone number reported by the device
device.roaming.data.active Whether data roaming is currently used
device.roaming.data.enabled Whether data roaming is allowed
device.root-status The root status
device.serial-number The serial number
device.system-integrity-protection.enabled For Macs, whether System Integrity Protection is turned on
device.unlock.code The code to unlock the device after it was locked
google.workspace.device-id The Google Workspace device ID
google.workspace.serial-number The Google Workspace serial number
windows.anti-spyware.signature-status The anti-spyware signature status
windows.anti-spyware.status The anti-spyware status
windows.anti-virus.signature-status The antivirus signature status
windows.anti-virus.status The antivirus status
windows.defender.computer-state The computer status reported by Windows Defender
windows.defender.enabled Whether Windows Defender is turned on
windows.defender.network-protection.running Whether Windows Defender Network Protection is active
windows.defender.real-time-protection.running Whether Windows Defender Real Time Protection is active
windows.defender.signature.out-of-date Whether Windows Defender Signature is out-of-date

Actions

  • scan - Run an IXM antivirus scan. Only available for Android devices and when IXM is enrolled with Sophos Mobile.
  • sync - Trigger the Mobile app on the device to sync with Sophos Mobile.
  • send-message - Show a notification on the device.
  • locate - Find the device.
  • lock - Lock the device.
  • unenroll - Unenroll the device from Sophos Mobile.
  • wipe - Wipe the device or, for Android Enterprise work profile devices, remove the work profile.

Note: Sophos Mobile doesn't track the device location over time. Only the last known location is stored. You can request an update of the device location using the locate action. You can poll the action status subsequently until it's completed. When the action has been completed successfully, the geo-location is available from the device detail location resource.

Here's an example of a scan action creation:

POST /mobile/v1/actions/scan

Request:

{
    "endpoints": [ //A list of endpoints which should execute a scan
        "dd40830b-b103-4f9a-ae02-bbf0d792466d",
        "e7e88612-d9b1-4e2f-b248-f2fad48579e4"
    ]
}

Response: A summary of the command's execution status and any errors.

{
    "created": [
        {
            "id": "ec09add5-a752-4b6e-b1b6-b89000252edb", //The unique ID of the action
            "tenant": {
                "id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
            },
            "device": {
                "id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //The ID of the mobile device
                "name": "My Android Device"
            },
            "type": "scan", //The requested action
            "state": "accepted" //The processing status of the action
        }
    ],
    "errors": {
        "failedToCreate": {
            "endpointNotFound": [ //Endpoints that were unknown to Sophos Mobile and therefore didn't receive the action
                "e7e88612-d9b1-4e2f-b248-f2fad48579e4"
            ]
        }
    }
}

States

The following table shows supported action states. You can use these values as parameters for the actionStatefilter. For example:

GET /mobile/v1/actions?actionState=failed,notStarted
actionState Description
accepted Accepted
commandsSent Commands sent
delayed Delayed
deviceIsLocked Device is locked
failed Completely failed
notStarted Not started
notified Notified
resultsReceived Result evaluation started
retry Will be retried
skipped Skipped
started Started
successful Successful
taskBundleInProgress Task bundle in progress
waitingForExecution Waiting for task completion
waitingForUserInteraction Waiting for user interaction

Types

The following table shows supported action types. You can use these values as parameters for the actionType filter. For example:

GET /mobile/v1/actions?actionType=getLogs,sendMessage

Note: Some of these actionType values are legacy, which means you can't create them with the Mobile API. However, we list them for the sake of completeness.

actionType Description
activationLockBypass Remove Activation Lock
airplay Request AirPlay mirroring
containerLock Knox container: lock
containerRemoveAllSettings Knox container: remove
containerResetPassword Knox container: reset password
containerUnlock Knox container: unlock
decommission Unenroll
disableLostMode Turn off Managed Lost Mode
enableLostMode Turn on Managed Lost Mode
enroll Enrollment
getLogs Get log files
installApp Install app
installProfile Assign policy
locate Locate
lock Lock
migrateDevice Migrate device
openTeamViewerSession Request remote control
reboot Restart
reconfigureSmcApp Reconfigure the SMC app
resetAppProtectionPassword Reset App Protection password
scan Scan for malware
scheduleOsUpdate Schedule OS update
scream Play Lost Mode sound
sendMessage Message
shutdownDevice Shut down
sync Sync
taskbundle Task bundle
unassignIosUserPolicy Unassign iOS user policy
unenroll Unenroll Sophos Intercept X for Mobile
uninstallApp Uninstall app
uninstallProfile Unassign policy
unlock Reset password
wipe Wipe

Errors

The following table shows supported action errors. You can use these values as parameters for the actionError filter. For example:

GET /mobile/v1/actions?actionError=device.localization.failed
actionError Description
access-denied Access denied.
albp.bad-request Web service for Activation Lock bypass returned a bad request error.
albp.connection-failed Connection to web service for Activation Lock bypass failed.
albp.server-error Web service for Activation Lock bypass returned an internal server error.
already-enrolled Device is already enrolled.
android.app-installation-not-allowed Can’t install a personal app onto devices with Android work profile.
android.app-permissions-not-accepted Can’t assign a managed Google Play app because you haven’t accepted the app permissions.
android.device-admin-enrollment-not-supported Devices with Android 10 or later don’t support the device administrator management mode.
android.enrolled-profile-installation-not-allowed Can’t install an Android device profile onto devices with Android work profile.
android.enterprise-not-enrolled Android Enterprise isn’t configured.
android.general-error Can’t install a managed Google Play app because it isn’t available in the device’s country.
android.internal-google-error Android Enterprise request failed.
android.mandatory-enrollment-stage-missing The initial device sync failed because post-enrollment steps didn't run. Please check that the app is up to date.
android.no-device-found-for-id Unapproved managed Google Play app “{0}” used in a task bundle
android.no-google-user-found-for-id An error occured. Can’t find a Google account for the user.
android.no-install-found-for-id An error occurred. No app with the given ID was found.
android.not-enrolled-profile-installation-not-allowed Can’t install a managed Google Play app on devices without Android work profile.
android.product-not-approved Can’t install a managed Google Play app because you haven’t approved it.
android.product-not-available-in-country Can’t install a managed Google Play app because it isn’t available in the device’s country.
android.product-not-compatible Can’t install a managed Google Play app because it isn’t compatible with the device.
android.signed-in-user-not-matching-assigned-user The user signed in to Google Workspace on the device doesn’t match the assigned user.
android.too-many-devices-per-user Can’t enroll device. You’ve reached the maximum number of Android Enterprise devices per user.
android.user-not-found Device has a work profile, but the Google account is unknown.
apns.app-connection-failed Could not connect to the Apple Push Notification service for SMC app.
apns.app-data-unavailable Apple Push Notification service for SMC app not configured.
apns.certificate-expired Your Apple Push Notification service (APNs) certificate has expired. You must renew it to continue managing Apple devices.
apns.certificate-revoked Your Apple Push Notification service (APNs) certificate has been revoked.
apns.configuration-invalid The LDAP directory configuration of the device is invalid.
apns.connection-failed Could not connect to the Apple Push Notification service.
apns.failed Push notification could not be sent.
apns.no-certificate APNs certificate not configured.
apns.push-topic-changed Can’t contact device because the currently configured APNs certificate has the wrong “Push topic” property.
apns.token-missing Could not find the app APNs token of the device.
app-already-installed-and-not-managed An app is already installed by the user and is not managed.
busy Device is processing another task.
busy-processing Device received the command but cannot perform it now. Device will contact the server again.
cancelled Command has been canceled.
config.incomplete Server configuration incomplete.
corrupted-data Command or command data is corrupted.
customer.apns.not-configured Apple Push Notification service not configured for this device.
email.not-sent Email could not be sent.
execution.no-permission App has no permission to process the command.
fcm.notification-failed Google Firebase Cloud Messaging (FCM) push notification failed.
fcm.registration-id.missing Google Firebase Cloud Messaging (FCM) not configured.
feature-not-configured The feature is not configured.
gcm.connection-failed Can’t connect to the Google Firebase Cloud Messaging (FCM) service.
gcm.not-configured Google Firebase Cloud Messaging (FCM) not configured.
gcm.notification-failed Android push notification failed.
general-error A general error occurred.
illegal-export-method Illegal export method for this operation.
imported-app-not-uploaded Can’t install imported app. You must upload the package file.
incompatible-os Device does not meet the operating system requirements for the task.
incomplete-execution Command could not be completed.
internal-error Internal error.
invalid-argument Delivered argument was wrong.
ios.mdm.albp.code-not-found Activation Lock bypass code could not be found.
ios.mdm.albp.not-found-or-code-invalid Device not found, not locked, or invalid Activation Lock bypass code.
ios.mdm.command-error An MDM command could not be executed.
ios.not-supervised Device is not supervised.
knox.container-not-found-or-created Container could not be found or created.
ldap.server-unavailable The LDAP directory is not available at the moment.
localization.failed Failed to locate device
localization.no-permission Permission denied
logs-too-large Can't get log files because they exceed the email attachment size limit of 10 MB.
managed-apple-id-missing Managed Apple ID is missing.
missing-placeholder-value A value referenced by a placeholder does not exist.
multiple-action.failed Command failed multiple times.
no-screen-lock-set No screen lock configured on device.
not-managed Device is not managed.
os.not-matching Device operating system does not match the enrollment platform.
out-of-memory Device ran out of memory while processing the command.
package-not-verified Failed to validate the install package. Please check the hash value.
processing-failed Error during task processing.
related-app.activated The related client app has already been activated.
related-app.unenrolled The related client app has been unenrolled.
resource-not-found Resource could not be found.
resource.duplicate-detected Resource already exists.
resource.locked Resource is locked.
resource.not-ready Resource is not ready.
resource.used Resource is in use.
scep.cache-full No SCEP challenge password available because the password cache of your SCEP server is full. Wait for up to 60 minutes or enlarge the password cache.
scep.connection-failed Can’t connect to your SCEP server.
task-bundle.predecessor-action-not-found Predecessor task not found.
timeout.action Client command timed out.
timeout.execution Timed out while waiting for results.
timeout.internal-error Timeout due to an internal error.
timeout.receiving-data Timeout while waiting for data retrieval.
timeout.results Timeout while waiting for results.
timeout.user-interaction User interaction timed out.
udid.not-found Could not find the UDID of the device.
unknown-command Command unknown.
unsupported-action The client does not support the requested command.
unsupported-enrollment-mode.client The Sophos Mobile app installed on the device doesn’t support the selected enrollment type.
unsupported-enrollment-mode.type The enrollment type of the device doesn’t support the selected action.
user-assignment.missing User assignment is required.
user.cancelled User canceled command processing.
vpp.failed Apple VPP communication failed.
vpp.not-configured Apple VPP isn’t configured.
wns.channel-throttled Push notification channel has been throttled by Microsoft.
wns.device-not-registered Pending WNS registration. Waiting for WNS key.
wns.invalid-credentials Push notification service credentials are invalid.
wns.notification-channel-expired Push notification channel has expired.
wns.notification-channel-uri-invalid Domain of the push notification channel URI is invalid.
wns.notification-dropped Push notification has been dropped.
wns.unknown Push notification could not be sent.
write-protected Could not write data.
wrong-object-type Internal error.

Device groups

GET /mobile/v1/device-groups

Response:

{
  "items": [
    {
      "id": "47641750-7f17-461a-84c2-8e94fd705b20",
      "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
      },
      "name": "Default" //The default device group
    },
    {
      "id": "3ef0a22d-1495-42bc-acdf-1cdb7937175c",
      "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
      },
      "name": "Another group"
    },
    {
      "id": "e5264ac2-545f-45b0-a9d4-c0d6b708ba0c",
      "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
      },
      "name": "My custom device group"
    }
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 500
  }
}

Policies

The Mobile API supports threatDefense policies for the iOS and android platforms. Policy IDs are used when configuring automatic enrollment of Intercept X for Mobile.

List policies

GET /mobile/v1/policies

Response: A paginated list of policies.

{
  "items": [
    {
      "id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2", //The unique ID of the policy
      "tenant": {
        "id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //The tenant the policy belongs to
      },
      "name": "My policy", //The unique name of the policy
      "description": "Some description for the policy", //A description of the policy
      "platform": "android", //The platform this policy applies to. Either "android" or "iOS".
      "type": "threatDefense", //The policy type
      "version": "2" //The current version of the policy
    }
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 500
  }
}

You can filter the list by platform using the platform query parameter. For example:

GET /mobile/v1/policies?platform=android

Create a policy

POST /mobile/v1/policies

Request:

{
  "name": "My policy", //Required. A unique name for the policy. Maximum 255 characters.
  "description": "Some description for the policy", //Optional. A description of the policy. Maximum 500 characters.
  "platform": "android", //Required. The platform this policy applies to. Either "android" or "iOS".
  "type": "threatDefense" //Required. The type of policy. Currently, only "threatDefense" is supported.
}

Response: The newly created policy.

{
  "id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2",
  "tenant": {
    "id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
  },
  "name": "My policy",
  "description": "Some description for the policy",
  "platform": "android",
  "type": "threatDefense",
  "version": "1"
}

Get a policy by ID

GET /mobile/v1/policies/{id}

Response: The policy with the given ID.

{
  "id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2",
  "tenant": {
    "id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
  },
  "name": "My policy",
  "description": "Some description for the policy",
  "platform": "android",
  "type": "threatDefense",
  "version": "1"
}

Settings

Use the settings API to configure automatic enrollment of Intercept X for Mobile. When automatic enrollment of Intercept X for Mobile is enabled, Intercept X for Mobile automatically enrolls with Sophos Mobile using the connection code when a new device is set up. You can optionally assign a security policy for Android and iOS devices separately.

Get settings for automatic enrollment of Intercept X for Mobile

GET /mobile/v1/settings/ixm-auto-enrollment

Note: This resource doesn't support the view or fields query parameters. The response always returns the same fixed set of fields.

Response: The current settings for automatic enrollment of Intercept X for Mobile.

{
  "deviceGroup": {
    "id": "d602034d-a509-4c93-ade0-61f5b496c963", //The device group newly enrolled devices are added to
    "name": "A device group"
  },
  "ownershipType": "corporate", //The ownership type assigned to newly enrolled devices
  "androidPolicy": {
    "id": "ea1735cc-d321-4a39-a61a-7ec4a5975e1d", //The ID of the Android security policy
    "name": "My Android policy",
    "platform": "android",
    "type": "threatDefense",
    "version": "1"
  },
  "iosPolicy": {
    "id": "15539043-4ec1-4525-bf2d-646e4f5d8212", //The ID of the iOS security policy
    "name": "My iOS policy",
    "platform": "iOS",
    "type": "threatDefense",
    "version": "1"
  },
  "connectionCode": "eyJ0b2tlbiI6ImZvb28iLCJjdXN0b21lcmlkIjoiNDgyNzY5IiwidXJsIjoic21jLWRldmljZS1pZi1jbG91ZHN0YXRpb24tZXUtd2VzdC0xLnRlc3QuaHlkcmEuc29waG9zLmNvbSJ9" //The connection code used for automatic enrollment of Intercept X for Mobile
}

If automatic enrollment of Intercept X for Mobile isn't configured, the request returns a 404 with the following details:

{
  "error": "ixmAutoEnrollmentNotConfigured",
  "correlationId": "932d23fa-67d8-4447-8172-c45b2dc5d770",
  "requestId": "e419c347-3bed-4d67-8b42-177970bcf7e5",
  "createdAt": "2026-06-15T12:55:59.972Z",
  "code": "MOBSRV0401",
  "message": "Intercept X auto-enrollment isn't configured for customer ac4738dd-18ff-4428-9532-201725732a5c"
}

Use POST /mobile/v1/settings/ixm-auto-enrollment to set up automatic enrollment first.

Set up automatic enrollment of Intercept X for Mobile

This request creates the configuration for automatic enrollment of Intercept X for Mobile and generates a connection code. Another request with the same values results in an error because the configuration already exists.

POST /mobile/v1/settings/ixm-auto-enrollment

Request:

{
  "deviceGroupId": "d602034d-a509-4c93-ade0-61f5b496c963", //Required. The ID of the device group to add new devices to.
  "ownershipType": "corporate", //Required. The ownership type assigned to newly enrolled devices.
  "androidPolicyId": "8ef59086-c490-4c73-a7ed-6c17e4a417ad", //Optional. The ID of an Android security policy.
  "iosPolicyId": "f78afaa2-91d5-4f1d-8696-399af29a3941" //Optional. The ID of an iOS security policy.
}

Response: The newly created configuration for automatic enrollment of Intercept X for Mobile, including the generated connection code.

Update settings for automatic enrollment of Intercept X for Mobile

This request updates the configuration for automatic enrollment of Intercept X for Mobile. If androidPolicyId or iosPolicyId are omitted, the corresponding policy is removed. The connection code is changed only if rotateConnectionCode is set to true.

PUT /mobile/v1/settings/ixm-auto-enrollment

Request to update the Android policy and rotate the connection code:

{
  "deviceGroupId": "d602034d-a509-4c93-ade0-61f5b496c963", //Required. The ID of the device group.
  "ownershipType": "corporate", //Required. The ownership type for newly enrolled devices.
  "androidPolicyId": "8ef59086-c490-4c73-a7ed-6c17e4a417ad", //Optional. The new Android security policy ID.
  "rotateConnectionCode": true //Optional. Set to true to generate a new connection code, invalidating the previous one.
}

Response: The updated settings for automatic enrollment of Intercept X for Mobile.

Delete settings for automatic enrollment of Intercept X for Mobile

This request deletes the configuration for automatic enrollment of Intercept X for Mobile and revokes the connection code.

DELETE /mobile/v1/settings/ixm-auto-enrollment

Response:

{
  "deleted": true
}

Operating systems

GET /mobile/v1/os

Response:

{
  "items": [
    {
      "id": "bbe29711-209c-44a9-ba74-46de45a063cd",
      "version": "---", //The default Android version
      "name": "Android",
      "platform": "android"
    },
    {
      "id": "12f8dfdd-6921-4ec6-8b59-2257c12cb45a",
      "version": "14",
      "name": "Android 14", //The display name of the operating system
      "platform": "android",
      "majorVersion": "14" //The major version of the operating system
    },
    {
      "id": "d39770b8-2234-4b43-859d-0d59b1e8da95",
      "version": "15",
      "name": "Android 15",
      "platform": "android",
      "majorVersion": "15"
    },
    {
      "id": "13d09c35-eb63-47a1-a2b9-55fd68283748",
      "version": "8.1.0",
      "name": "Android 8.1.0",
      "platform": "android",
      "majorVersion": "8",
      "minorVersion": "1", //The minor version of the operating system
      "patchVersion": "0" //The patch version of the operating system
    },
    {
      "id": "b2a29d71-b159-421c-b567-dbfbf0dafeec",
      "version": "R", //Some Android versions use a letter instead of a number
      "name": "Android R",
      "platform": "android"
    },
    {
      "id": "3dccb022-889d-4fb8-ab9b-eaf35e27560b",
      "version": "120",
      "name": "Chrome 120",
      "platform": "chrome",
      "majorVersion": "120"
    },
    {
      "id": "9852df33-21a7-4173-9f00-976187908658",
      "version": "121",
      "name": "Chrome 121",
      "platform": "chrome",
      "majorVersion": "121"
    }
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 500
  }
}

Conclusion

See the Mobile API reference for a comprehensive description of this API.