Getting started
Overview¶
Note: This guide provides only a small overview of possible workflows and API requests. See the Mobile API reference for a comprehensive description of this API.
Prerequisites¶
You must have a set of API credentials (service principal) to be able to call the Mobile API. For more information refer to the appropriate quick start guide:
- Sophos Partners: Read the Partner Getting Started guide first.
- Enterprise customers: If you use Sophos Enterprise to manage multiple tenants, read the Organization Getting Started guide first.
- Other customers: Read the Tenant Getting Started guide first.
Terminology¶
Before you use the Mobile API, here are a few terms you should know:
- Endpoint: The general term for a device managed in Sophos Central.
- Mobile device or Device: A device managed by Sophos Mobile. This is a special type of endpoint. The device ID used by Sophos Mobile is identical to the endpoint ID used elsewhere in Sophos Central. For brevity, we're referring to all devices managed by Sophos Mobile as mobile devices, although this can include Windows computers and Macs.
- IXM: Sophos Intercept X for Mobile.
- Ownership Type: Who owns the device. For mobile devices, the ownership type is
companyfor devices owned by your organization andpersonalfor devices owned by the user.
Making API requests¶
The following sections show examples of API requests using the cURL tool. For information on how to install cURL, see the cURL website.
A cURL request to the Mobile API has the following general form:
curl -X <method> -H "Authorization: Bearer <JWT>" -H "X-Tenant-ID: <tenant-id>" <data-region><path>
The command includes the following placeholders:
<method>: The HTTP request method. For the Mobile API, this is eitherGET,POST,PUT, orDELETE.<tenant-id>: The ID of the tenant you want to query.<JWT>: The JWT access token returned when the IDP authenticates the service principal.<data-region>: The regional API host in the data geography where the tenant data is located.<path>: The request path for the API operation, for example/mobile/v1/devices.
The API descriptions in this guide only specify the request method and path. For example:
GET /mobile/v1/devices
To make an actual API request, you must expand this to the full form shown above.
All API requests return HTTP status codes 200 or 201 when successful.
Responses include a different amount of data based on the view parameter. To see the fields a response includes, see the Mobile API reference. That guide has an example for each view value, full, summary, and basic.
You can use the fields parameter to request individual fields. Values are the field names of the response entity.
Note that you can't use the view and fields parameters in the same request.
Device info¶
GET /mobile/v1/devices?pageTotal=true
Response: A list of mobile devices in paginated form. Contains the total number of items.
{
"items": [
{
"id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //ID of the mobile device
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
},
"name": "AAA Chrome Work", //Name of the mobile device
"email": "user@example.com", //Associated email of the mobile device
"healthState": {
"state": "amber", //Health statuts of the mobile device
"mode": "automatic" //Whether the health status is set by Sophos Mobile based on the device's compliance or manually set by the admin.
},
"ownershipType": "corporate", //The device owner. "corporate" for devices owned by your organization, "personal" for devices owned by the user.
"lastSeenAt": "2024-10-24T05:35:30.000Z", //The last timestamp when the device connected to Sophos Mobile
"ixmAppLastSeenAt": "2024-10-24T05:35:30.000Z", //The last timestamp when the IXM app connected to Sophos Mobile
"compliance": {
"compliant": false, //The device isn't compliant
"severity": "high" //The severity of the compliance violation. Here, "High".
},
"managementType": "chromeSecurity", //The device's management mode. Here, Sophos Chrome Security.
"managedState": "managed", //The device's management status. Here, "Managed".
"os": {
"id": "4e880043-3206-4166-ab0b-3d9bf2a60196", //The ID of the device's operating system.
"name": "Chrome 129", //The name of the device's operating system.
"platform": "chrome" //The device platform.
}
}
],
"pages": {
"current": 1, //The current page
"size": 50, //The number of items on a page. You can change this value with the pageSize=<int_value> query parameter.
"total": 1, //The total number of pages
"items": 1, //The total number of items on all pages
"maxSize": 500 //The maximum allowed page size for the pageSize query parameter.
}
}
Extended device details¶
GET /mobile/v1/devices/{id}?view=full
Response: A list of mobile devices in paginated form. Contains the total number of items.
{
"id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //ID of the mobile device
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
},
"name": "Chromebook 2687", //Name of the mobile device
"description": "", //A description for the mobile device
"phoneNumber": "", //The device's phone number configured in Sophos Mobile, if available
"email": "user@example.com", //Email of the user assigned to the device
"assignedPerson": {
"id": "9f059011-84c7-4849-ae2e-d0563743e485", //ID of the assigned user
"name": "Simon Smith", //Name of the assigned user
"email": "user@example.com" //Email of the assigned user
},
"healthState": {
"state": "amber", //Health statuts of the mobile device
"mode": "automatic" //Health statuts mode of the mobile device
},
"ownershipType": "corporate", //Ownership Type indicates it's a company issued device
"createdAt": "2024-10-15T14:18:50.000Z", //Timestamp the mobile device was created in the system
"updatedAt": "2024-10-15T14:57:15.000Z", //Timestamp the mobile device was updated
"lastSeenAt": "2024-10-24T05:35:30.000Z", //Timestamp the device connected to the server
"ixmAppLastSeenAt": "2024-10-24T05:35:30.000Z", //Timestamp the IXM app connected to the server
"compliance": {
"compliant": false, //Mobile device isn't compliant
"severity": "high" //The severity of the compliance violation is high
},
"modelName": "Google Chromebook", //The model name of the mobile device
"managementType": "chromeSecurity", //The mobile device is only managed by the Chrome Security Extension
"managedState": "managed", //The management state of the mobile device
"os": {
"id": "4e880043-3206-4166-ab0b-3d9bf2a60196", //The ID of this OS entry
"name": "Chrome 129", //Name of the OS entry
"platform": "chrome" //Platform of the OS entry
},
"deviceGroup": {
"id": "47641750-7f17-461a-84c2-8e94fd705b20", //The device group ID
"name": "Default" //The device group name
}
}
Management types¶
Responses from the device-related resources of the Mobile API include a field named managementType, which contains the current Sophos Mobile management type of the device. These values can also be used as a parameter for the managementType filter. For example:
GET /mobile/v1/devices?managementType=ixm,chromeSecurity,iosUser
| Value | Meaning |
|---|---|
| notManaged | Device is not managed by server and is inactive |
| ixm | Only the Sophos Intercept X Mobile app is enrolled with the server |
| fullMdm | Device is MDM-managed |
| androidWorkProfile | Android Work Profile |
| androidDevice | Android device owner mode |
| chromeSecurity | Only the Sophos Chrome Security extension on ChromeOS is enrolled with the server |
| iosUser | Device is an iPhone or iPad with Apple User Enrollment |
Device properties¶
The following table shows the device properties managed by the server. You can't modify these properties with the /properties resource. However, you can use these values as parameters for the devicePropertyKeyfilter. For example:
GET /mobile/v1/devices/<uuid>/properties?devicePropertyKey=device.root-status,device.name,device.model
| devicePropertyKey | Description |
|---|---|
| app.chrome-extension.last-seen | The timestamp of the last server connection of the Chrome Security extension |
| app.chrome-extension.version | The version of the Chrome Security extension |
| app.ixm.android.accessibility-service.active | Whether the Android accessibility service is active |
| app.ixm.android.usage-access.active | Whether Android usage access is active |
| app.ixm.enrolled | The timestamp when Intercept X for Mobile was enrolled with the server |
| app.ixm.last-seen | The timestamp of the last server connection of Intercept X for Mobile |
| app.ixm.vdl.last-update | The timestamp when Intercept X for Mobile updated its virus definitions |
| app.ixm.version | The version of the Intercept X for Mobile app |
| app.ixm.web-filtering.enabled | Whether the Web Filtering feature of Intercept X for Mobile is turned on |
| app.log-level | The configured log level of the mobile security app |
| app.smc.android.ignore-battery-optimization.active | Whether the 'Ignore battery optimization' Android setting is turned on for Sophos Mobile Security |
| app.smc.android.usage-access.active | Whether the 'Usage access' Android setting is turned on for Sophos Mobile Security |
| app.smc.version | The version of Sophos Mobile Control |
| chrome.profile.user-account | The associated user account of the Chrome profile |
| device.app-side-loading.allowed | Whether app side loading is allowed |
| device.battery.status | The device's battery status |
| device.bluetooth.enabled | Whether Bluetooth is turned on on the device |
| device.encryption.status | The device's encryption status |
| device.enrollment-date | The timestamp when the MDM was enrolled with the server |
| device.factory-reset-protection.deactivated-by-admin | For Android, whether the admin has turned off Factory Reset Protection |
| device.factory-reset-protection.enabled | For Android, whether Factory Reset Protection is turned on |
| device.imei | The IMEI |
| device.imei-or-meid | The IMEI or MEID |
| device.last-compliance-check | The timestamp of the last compliance check |
| device.meid | The MEID |
| device.memory.external.available | The amount of available external memory |
| device.memory.internal.available | The amount of available internal memory |
| device.memory.internal.capacity | The capacity of internal memory |
| device.memory.mass-storage.enabled | Whether the USB Mass Storage mode is turned on |
| device.memory.ram.capacity | The capacity of RAM |
| device.model | The device model |
| device.model-name | The device model name |
| device.name | The computer name reported by macOS |
| device.network.cellular.network-operator | The network operator of the cellular network |
| device.network.cellular.sim-operator | The SIM operator of the cellular network |
| device.network.firewall.enabled | Whether the network firewall is turned on |
| device.network.firewall.status | The status of the network firewall |
| device.network.lan.ip | The IP address of the LAN interface |
| device.network.lan.mac | The MAC address of the LAN interface |
| device.network.wifi.ip | The IP address of the Wi-Fi interface |
| device.network.wifi.ipv4 | The IPv4 address of the Wi-Fi interface |
| device.network.wifi.mac | The MAC address of the Wi-Fi interface |
| device.passcode.policy-applied | Whether the passcode policy is applied |
| device.passcode.present | Whether a passcode exists |
| device.processor.information | Information about the processor |
| device.reported-phone-number | The phone number reported by the device |
| device.roaming.data.active | Whether data roaming is currently used |
| device.roaming.data.enabled | Whether data roaming is allowed |
| device.root-status | The root status |
| device.serial-number | The serial number |
| device.system-integrity-protection.enabled | For Macs, whether System Integrity Protection is turned on |
| device.unlock.code | The code to unlock the device after it was locked |
| google.workspace.device-id | The Google Workspace device ID |
| google.workspace.serial-number | The Google Workspace serial number |
| windows.anti-spyware.signature-status | The anti-spyware signature status |
| windows.anti-spyware.status | The anti-spyware status |
| windows.anti-virus.signature-status | The antivirus signature status |
| windows.anti-virus.status | The antivirus status |
| windows.defender.computer-state | The computer status reported by Windows Defender |
| windows.defender.enabled | Whether Windows Defender is turned on |
| windows.defender.network-protection.running | Whether Windows Defender Network Protection is active |
| windows.defender.real-time-protection.running | Whether Windows Defender Real Time Protection is active |
| windows.defender.signature.out-of-date | Whether Windows Defender Signature is out-of-date |
Actions¶
- scan - Run an IXM antivirus scan. Only available for Android devices and when IXM is enrolled with Sophos Mobile.
- sync - Trigger the Mobile app on the device to sync with Sophos Mobile.
- send-message - Show a notification on the device.
- locate - Find the device.
- lock - Lock the device.
- unenroll - Unenroll the device from Sophos Mobile.
- wipe - Wipe the device or, for Android Enterprise work profile devices, remove the work profile.
Note: Sophos Mobile doesn't track the device location over time. Only the last known location is stored. You can request an update of the device location using the locate action. You can poll the action status subsequently until it's completed. When the action has been completed successfully, the geo-location is available from the device detail location resource.
Here's an example of a scan action creation:
POST /mobile/v1/actions/scan
Request:
{
"endpoints": [ //A list of endpoints which should execute a scan
"dd40830b-b103-4f9a-ae02-bbf0d792466d",
"e7e88612-d9b1-4e2f-b248-f2fad48579e4"
]
}
Response: A summary of the command's execution status and any errors.
{
"created": [
{
"id": "ec09add5-a752-4b6e-b1b6-b89000252edb", //The unique ID of the action
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //Tenant of the mobile device
},
"device": {
"id": "dd40830b-b103-4f9a-ae02-bbf0d792466d", //The ID of the mobile device
"name": "My Android Device"
},
"type": "scan", //The requested action
"state": "accepted" //The processing status of the action
}
],
"errors": {
"failedToCreate": {
"endpointNotFound": [ //Endpoints that were unknown to Sophos Mobile and therefore didn't receive the action
"e7e88612-d9b1-4e2f-b248-f2fad48579e4"
]
}
}
}
States¶
The following table shows supported action states. You can use these values as parameters for the actionStatefilter. For example:
GET /mobile/v1/actions?actionState=failed,notStarted
| actionState | Description |
|---|---|
| accepted | Accepted |
| commandsSent | Commands sent |
| delayed | Delayed |
| deviceIsLocked | Device is locked |
| failed | Completely failed |
| notStarted | Not started |
| notified | Notified |
| resultsReceived | Result evaluation started |
| retry | Will be retried |
| skipped | Skipped |
| started | Started |
| successful | Successful |
| taskBundleInProgress | Task bundle in progress |
| waitingForExecution | Waiting for task completion |
| waitingForUserInteraction | Waiting for user interaction |
Types¶
The following table shows supported action types. You can use these values as parameters for the actionType filter. For example:
GET /mobile/v1/actions?actionType=getLogs,sendMessage
Note: Some of these actionType values are legacy, which means you can't create them with the Mobile API. However, we list them for the sake of completeness.
| actionType | Description |
|---|---|
| activationLockBypass | Remove Activation Lock |
| airplay | Request AirPlay mirroring |
| containerLock | Knox container: lock |
| containerRemoveAllSettings | Knox container: remove |
| containerResetPassword | Knox container: reset password |
| containerUnlock | Knox container: unlock |
| decommission | Unenroll |
| disableLostMode | Turn off Managed Lost Mode |
| enableLostMode | Turn on Managed Lost Mode |
| enroll | Enrollment |
| getLogs | Get log files |
| installApp | Install app |
| installProfile | Assign policy |
| locate | Locate |
| lock | Lock |
| migrateDevice | Migrate device |
| openTeamViewerSession | Request remote control |
| reboot | Restart |
| reconfigureSmcApp | Reconfigure the SMC app |
| resetAppProtectionPassword | Reset App Protection password |
| scan | Scan for malware |
| scheduleOsUpdate | Schedule OS update |
| scream | Play Lost Mode sound |
| sendMessage | Message |
| shutdownDevice | Shut down |
| sync | Sync |
| taskbundle | Task bundle |
| unassignIosUserPolicy | Unassign iOS user policy |
| unenroll | Unenroll Sophos Intercept X for Mobile |
| uninstallApp | Uninstall app |
| uninstallProfile | Unassign policy |
| unlock | Reset password |
| wipe | Wipe |
Errors¶
The following table shows supported action errors. You can use these values as parameters for the actionError filter. For example:
GET /mobile/v1/actions?actionError=device.localization.failed
| actionError | Description |
|---|---|
| access-denied | Access denied. |
| albp.bad-request | Web service for Activation Lock bypass returned a bad request error. |
| albp.connection-failed | Connection to web service for Activation Lock bypass failed. |
| albp.server-error | Web service for Activation Lock bypass returned an internal server error. |
| already-enrolled | Device is already enrolled. |
| android.app-installation-not-allowed | Can’t install a personal app onto devices with Android work profile. |
| android.app-permissions-not-accepted | Can’t assign a managed Google Play app because you haven’t accepted the app permissions. |
| android.device-admin-enrollment-not-supported | Devices with Android 10 or later don’t support the device administrator management mode. |
| android.enrolled-profile-installation-not-allowed | Can’t install an Android device profile onto devices with Android work profile. |
| android.enterprise-not-enrolled | Android Enterprise isn’t configured. |
| android.general-error | Can’t install a managed Google Play app because it isn’t available in the device’s country. |
| android.internal-google-error | Android Enterprise request failed. |
| android.mandatory-enrollment-stage-missing | The initial device sync failed because post-enrollment steps didn't run. Please check that the app is up to date. |
| android.no-device-found-for-id | Unapproved managed Google Play app “{0}” used in a task bundle |
| android.no-google-user-found-for-id | An error occured. Can’t find a Google account for the user. |
| android.no-install-found-for-id | An error occurred. No app with the given ID was found. |
| android.not-enrolled-profile-installation-not-allowed | Can’t install a managed Google Play app on devices without Android work profile. |
| android.product-not-approved | Can’t install a managed Google Play app because you haven’t approved it. |
| android.product-not-available-in-country | Can’t install a managed Google Play app because it isn’t available in the device’s country. |
| android.product-not-compatible | Can’t install a managed Google Play app because it isn’t compatible with the device. |
| android.signed-in-user-not-matching-assigned-user | The user signed in to Google Workspace on the device doesn’t match the assigned user. |
| android.too-many-devices-per-user | Can’t enroll device. You’ve reached the maximum number of Android Enterprise devices per user. |
| android.user-not-found | Device has a work profile, but the Google account is unknown. |
| apns.app-connection-failed | Could not connect to the Apple Push Notification service for SMC app. |
| apns.app-data-unavailable | Apple Push Notification service for SMC app not configured. |
| apns.certificate-expired | Your Apple Push Notification service (APNs) certificate has expired. You must renew it to continue managing Apple devices. |
| apns.certificate-revoked | Your Apple Push Notification service (APNs) certificate has been revoked. |
| apns.configuration-invalid | The LDAP directory configuration of the device is invalid. |
| apns.connection-failed | Could not connect to the Apple Push Notification service. |
| apns.failed | Push notification could not be sent. |
| apns.no-certificate | APNs certificate not configured. |
| apns.push-topic-changed | Can’t contact device because the currently configured APNs certificate has the wrong “Push topic” property. |
| apns.token-missing | Could not find the app APNs token of the device. |
| app-already-installed-and-not-managed | An app is already installed by the user and is not managed. |
| busy | Device is processing another task. |
| busy-processing | Device received the command but cannot perform it now. Device will contact the server again. |
| cancelled | Command has been canceled. |
| config.incomplete | Server configuration incomplete. |
| corrupted-data | Command or command data is corrupted. |
| customer.apns.not-configured | Apple Push Notification service not configured for this device. |
| email.not-sent | Email could not be sent. |
| execution.no-permission | App has no permission to process the command. |
| fcm.notification-failed | Google Firebase Cloud Messaging (FCM) push notification failed. |
| fcm.registration-id.missing | Google Firebase Cloud Messaging (FCM) not configured. |
| feature-not-configured | The feature is not configured. |
| gcm.connection-failed | Can’t connect to the Google Firebase Cloud Messaging (FCM) service. |
| gcm.not-configured | Google Firebase Cloud Messaging (FCM) not configured. |
| gcm.notification-failed | Android push notification failed. |
| general-error | A general error occurred. |
| illegal-export-method | Illegal export method for this operation. |
| imported-app-not-uploaded | Can’t install imported app. You must upload the package file. |
| incompatible-os | Device does not meet the operating system requirements for the task. |
| incomplete-execution | Command could not be completed. |
| internal-error | Internal error. |
| invalid-argument | Delivered argument was wrong. |
| ios.mdm.albp.code-not-found | Activation Lock bypass code could not be found. |
| ios.mdm.albp.not-found-or-code-invalid | Device not found, not locked, or invalid Activation Lock bypass code. |
| ios.mdm.command-error | An MDM command could not be executed. |
| ios.not-supervised | Device is not supervised. |
| knox.container-not-found-or-created | Container could not be found or created. |
| ldap.server-unavailable | The LDAP directory is not available at the moment. |
| localization.failed | Failed to locate device |
| localization.no-permission | Permission denied |
| logs-too-large | Can't get log files because they exceed the email attachment size limit of 10 MB. |
| managed-apple-id-missing | Managed Apple ID is missing. |
| missing-placeholder-value | A value referenced by a placeholder does not exist. |
| multiple-action.failed | Command failed multiple times. |
| no-screen-lock-set | No screen lock configured on device. |
| not-managed | Device is not managed. |
| os.not-matching | Device operating system does not match the enrollment platform. |
| out-of-memory | Device ran out of memory while processing the command. |
| package-not-verified | Failed to validate the install package. Please check the hash value. |
| processing-failed | Error during task processing. |
| related-app.activated | The related client app has already been activated. |
| related-app.unenrolled | The related client app has been unenrolled. |
| resource-not-found | Resource could not be found. |
| resource.duplicate-detected | Resource already exists. |
| resource.locked | Resource is locked. |
| resource.not-ready | Resource is not ready. |
| resource.used | Resource is in use. |
| scep.cache-full | No SCEP challenge password available because the password cache of your SCEP server is full. Wait for up to 60 minutes or enlarge the password cache. |
| scep.connection-failed | Can’t connect to your SCEP server. |
| task-bundle.predecessor-action-not-found | Predecessor task not found. |
| timeout.action | Client command timed out. |
| timeout.execution | Timed out while waiting for results. |
| timeout.internal-error | Timeout due to an internal error. |
| timeout.receiving-data | Timeout while waiting for data retrieval. |
| timeout.results | Timeout while waiting for results. |
| timeout.user-interaction | User interaction timed out. |
| udid.not-found | Could not find the UDID of the device. |
| unknown-command | Command unknown. |
| unsupported-action | The client does not support the requested command. |
| unsupported-enrollment-mode.client | The Sophos Mobile app installed on the device doesn’t support the selected enrollment type. |
| unsupported-enrollment-mode.type | The enrollment type of the device doesn’t support the selected action. |
| user-assignment.missing | User assignment is required. |
| user.cancelled | User canceled command processing. |
| vpp.failed | Apple VPP communication failed. |
| vpp.not-configured | Apple VPP isn’t configured. |
| wns.channel-throttled | Push notification channel has been throttled by Microsoft. |
| wns.device-not-registered | Pending WNS registration. Waiting for WNS key. |
| wns.invalid-credentials | Push notification service credentials are invalid. |
| wns.notification-channel-expired | Push notification channel has expired. |
| wns.notification-channel-uri-invalid | Domain of the push notification channel URI is invalid. |
| wns.notification-dropped | Push notification has been dropped. |
| wns.unknown | Push notification could not be sent. |
| write-protected | Could not write data. |
| wrong-object-type | Internal error. |
Device groups¶
GET /mobile/v1/device-groups
Response:
{
"items": [
{
"id": "47641750-7f17-461a-84c2-8e94fd705b20",
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
},
"name": "Default" //The default device group
},
{
"id": "3ef0a22d-1495-42bc-acdf-1cdb7937175c",
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
},
"name": "Another group"
},
{
"id": "e5264ac2-545f-45b0-a9d4-c0d6b708ba0c",
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
},
"name": "My custom device group"
}
],
"pages": {
"current": 1,
"size": 50,
"maxSize": 500
}
}
Policies¶
The Mobile API supports threatDefense policies for the iOS and android platforms. Policy IDs are used when configuring automatic enrollment of Intercept X for Mobile.
List policies¶
GET /mobile/v1/policies
Response: A paginated list of policies.
{
"items": [
{
"id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2", //The unique ID of the policy
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55" //The tenant the policy belongs to
},
"name": "My policy", //The unique name of the policy
"description": "Some description for the policy", //A description of the policy
"platform": "android", //The platform this policy applies to. Either "android" or "iOS".
"type": "threatDefense", //The policy type
"version": "2" //The current version of the policy
}
],
"pages": {
"current": 1,
"size": 50,
"maxSize": 500
}
}
You can filter the list by platform using the platform query parameter. For example:
GET /mobile/v1/policies?platform=android
Create a policy¶
POST /mobile/v1/policies
Request:
{
"name": "My policy", //Required. A unique name for the policy. Maximum 255 characters.
"description": "Some description for the policy", //Optional. A description of the policy. Maximum 500 characters.
"platform": "android", //Required. The platform this policy applies to. Either "android" or "iOS".
"type": "threatDefense" //Required. The type of policy. Currently, only "threatDefense" is supported.
}
Response: The newly created policy.
{
"id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2",
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
},
"name": "My policy",
"description": "Some description for the policy",
"platform": "android",
"type": "threatDefense",
"version": "1"
}
Get a policy by ID¶
GET /mobile/v1/policies/{id}
Response: The policy with the given ID.
{
"id": "c9c9b03c-5cf7-4fe1-93bb-246afc9044d2",
"tenant": {
"id": "b8a75c7d-7492-4009-9f95-8c815551dc55"
},
"name": "My policy",
"description": "Some description for the policy",
"platform": "android",
"type": "threatDefense",
"version": "1"
}
Settings¶
Use the settings API to configure automatic enrollment of Intercept X for Mobile. When automatic enrollment of Intercept X for Mobile is enabled, Intercept X for Mobile automatically enrolls with Sophos Mobile using the connection code when a new device is set up. You can optionally assign a security policy for Android and iOS devices separately.
Get settings for automatic enrollment of Intercept X for Mobile¶
GET /mobile/v1/settings/ixm-auto-enrollment
Note: This resource doesn't support the view or fields query parameters. The response always returns the same fixed set of fields.
Response: The current settings for automatic enrollment of Intercept X for Mobile.
{
"deviceGroup": {
"id": "d602034d-a509-4c93-ade0-61f5b496c963", //The device group newly enrolled devices are added to
"name": "A device group"
},
"ownershipType": "corporate", //The ownership type assigned to newly enrolled devices
"androidPolicy": {
"id": "ea1735cc-d321-4a39-a61a-7ec4a5975e1d", //The ID of the Android security policy
"name": "My Android policy",
"platform": "android",
"type": "threatDefense",
"version": "1"
},
"iosPolicy": {
"id": "15539043-4ec1-4525-bf2d-646e4f5d8212", //The ID of the iOS security policy
"name": "My iOS policy",
"platform": "iOS",
"type": "threatDefense",
"version": "1"
},
"connectionCode": "eyJ0b2tlbiI6ImZvb28iLCJjdXN0b21lcmlkIjoiNDgyNzY5IiwidXJsIjoic21jLWRldmljZS1pZi1jbG91ZHN0YXRpb24tZXUtd2VzdC0xLnRlc3QuaHlkcmEuc29waG9zLmNvbSJ9" //The connection code used for automatic enrollment of Intercept X for Mobile
}
If automatic enrollment of Intercept X for Mobile isn't configured, the request returns a 404 with the following details:
{
"error": "ixmAutoEnrollmentNotConfigured",
"correlationId": "932d23fa-67d8-4447-8172-c45b2dc5d770",
"requestId": "e419c347-3bed-4d67-8b42-177970bcf7e5",
"createdAt": "2026-06-15T12:55:59.972Z",
"code": "MOBSRV0401",
"message": "Intercept X auto-enrollment isn't configured for customer ac4738dd-18ff-4428-9532-201725732a5c"
}
Use POST /mobile/v1/settings/ixm-auto-enrollment to set up automatic enrollment first.
Set up automatic enrollment of Intercept X for Mobile¶
This request creates the configuration for automatic enrollment of Intercept X for Mobile and generates a connection code. Another request with the same values results in an error because the configuration already exists.
POST /mobile/v1/settings/ixm-auto-enrollment
Request:
{
"deviceGroupId": "d602034d-a509-4c93-ade0-61f5b496c963", //Required. The ID of the device group to add new devices to.
"ownershipType": "corporate", //Required. The ownership type assigned to newly enrolled devices.
"androidPolicyId": "8ef59086-c490-4c73-a7ed-6c17e4a417ad", //Optional. The ID of an Android security policy.
"iosPolicyId": "f78afaa2-91d5-4f1d-8696-399af29a3941" //Optional. The ID of an iOS security policy.
}
Response: The newly created configuration for automatic enrollment of Intercept X for Mobile, including the generated connection code.
Update settings for automatic enrollment of Intercept X for Mobile¶
This request updates the configuration for automatic enrollment of Intercept X for Mobile. If androidPolicyId or iosPolicyId are omitted, the corresponding policy is removed. The connection code is changed only if rotateConnectionCode is set to true.
PUT /mobile/v1/settings/ixm-auto-enrollment
Request to update the Android policy and rotate the connection code:
{
"deviceGroupId": "d602034d-a509-4c93-ade0-61f5b496c963", //Required. The ID of the device group.
"ownershipType": "corporate", //Required. The ownership type for newly enrolled devices.
"androidPolicyId": "8ef59086-c490-4c73-a7ed-6c17e4a417ad", //Optional. The new Android security policy ID.
"rotateConnectionCode": true //Optional. Set to true to generate a new connection code, invalidating the previous one.
}
Response: The updated settings for automatic enrollment of Intercept X for Mobile.
Delete settings for automatic enrollment of Intercept X for Mobile¶
This request deletes the configuration for automatic enrollment of Intercept X for Mobile and revokes the connection code.
DELETE /mobile/v1/settings/ixm-auto-enrollment
Response:
{
"deleted": true
}
Operating systems¶
GET /mobile/v1/os
Response:
{
"items": [
{
"id": "bbe29711-209c-44a9-ba74-46de45a063cd",
"version": "---", //The default Android version
"name": "Android",
"platform": "android"
},
{
"id": "12f8dfdd-6921-4ec6-8b59-2257c12cb45a",
"version": "14",
"name": "Android 14", //The display name of the operating system
"platform": "android",
"majorVersion": "14" //The major version of the operating system
},
{
"id": "d39770b8-2234-4b43-859d-0d59b1e8da95",
"version": "15",
"name": "Android 15",
"platform": "android",
"majorVersion": "15"
},
{
"id": "13d09c35-eb63-47a1-a2b9-55fd68283748",
"version": "8.1.0",
"name": "Android 8.1.0",
"platform": "android",
"majorVersion": "8",
"minorVersion": "1", //The minor version of the operating system
"patchVersion": "0" //The patch version of the operating system
},
{
"id": "b2a29d71-b159-421c-b567-dbfbf0dafeec",
"version": "R", //Some Android versions use a letter instead of a number
"name": "Android R",
"platform": "android"
},
{
"id": "3dccb022-889d-4fb8-ab9b-eaf35e27560b",
"version": "120",
"name": "Chrome 120",
"platform": "chrome",
"majorVersion": "120"
},
{
"id": "9852df33-21a7-4173-9f00-976187908658",
"version": "121",
"name": "Chrome 121",
"platform": "chrome",
"majorVersion": "121"
}
],
"pages": {
"current": 1,
"size": 50,
"maxSize": 500
}
}
Conclusion¶
See the Mobile API reference for a comprehensive description of this API.