Skip to content

Account Health

GET/health-check

Account Health Check API · Account Health Check

Get health.

Required permissionendpoint-state:read OR firewall-state:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
checks query array of string No Health checks to run.
Each item must be one of: protection, policy, exclusions, tamperProtection.
products query array of string No Filter account health check by product.
Each item must be one of: endpoint.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/account-health-check/v1/health-check" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/account-health-check/v1/health-check",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/account-health-check/v1/health-check" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/account-health-check/v1/health-check", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/account-health-check/v1/health-check", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Found Account Health check.

Response fields

tenantobjectrequired
Tenant.
Show child attributesHide child attributes
idstring (uuid)required
The tenant's ID.
namestring
The tenant's name.
endpointobject
Endpoint Health.
Show child attributesHide child attributes
protectionobject
Endpoint Health. Null indicates an unexpected error.
Show child attributesHide child attributes
computerobject
Software check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of endpoints.
notFullyProtectedintegerrequired
Endpoints with missing software.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
serverobject
Software check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of endpoints.
notFullyProtectedintegerrequired
Endpoints with missing software.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
policyobject
Endpoint Policy Health. Null indicates an unexpected error.
Show child attributesHide child attributes
computerobject
Computer policy health for each policy type.
Show child attributesHide child attributes
threat-protectionobject
Policy check for each policy type.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Number of policies of this type.
notOnRecommendedintegerrequired
Number of policies with at least one unrecommended setting.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
policiesarray of object
List of policies with at least one unrecommended setting.
Policy check.
Show child attributesHide child attributes
idstring (uuid)required
Policy ID.
namestringrequired
Policy name.
lockedByManagingAccountbooleanrequired
Whether the policy is managed by a partner or organization, 'true' means yes.
notOnRecommendedintegerrequired
Number of unrecommended settings.
serverobject
Server policy health for each policy type.
Show child attributesHide child attributes
server-threat-protectionobject
Policy check for each policy type.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Number of policies of this type.
notOnRecommendedintegerrequired
Number of policies with at least one unrecommended setting.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
policiesarray of object
List of policies with at least one unrecommended setting.
Policy check.
Show child attributesHide child attributes
idstring (uuid)required
Policy ID.
namestringrequired
Policy name.
lockedByManagingAccountbooleanrequired
Whether the policy is managed by a partner or organization, 'true' means yes.
notOnRecommendedintegerrequired
Number of unrecommended settings.
exclusionsobject
Endpoint Exclusions Health. Null indicates an unexpected error.
Show child attributesHide child attributes
policyobject
Endpoint Policy Exclusions Health.
Show child attributesHide child attributes
computerobjectrequired
Policy exclusions check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of exclusions.
numberOfSecurityRisksintegerrequired
Exclusions that may be risky.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
exclusionsarray of object
List of exclusions that may be risky.
Policy exclusions check.
Show child attributesHide child attributes
policyIdstring (uuid)required
Policy ID.
policyNamestringrequired
Policy name.
lockedByManagingAccountbooleanrequired
Whether the policy is managed by a partner or organization, 'true' means yes.
snoozeCommentstring
Snooze comment.
Must be at most 750 characters long.
scanningExclusionsarray of object
List of scanning exclusions.
Show child attributesHide child attributes
valuestringrequired
Exclusion value.
typestringrequired
Type of scan excluded.
Must be one of: path, posixPath, virtualPath, process, web, pua, detectedExploit, amsi, behavioral, journalHashingProcess, journalHashingPath.
scanModestringrequired
Mode of scan excluded.
Must be one of: onDemand, onAccess, onDemandAndOnAccess.
reasonCodestring
Reason for scanning exclusion being flagged as an issue.
Must be one of: allFilesWithExecutableExtension, commonExecutable, entireDrive, usesWindowsPathVariables, usesWindowsSystemDirectoriesViaSyspath, windowsDirectories, windowsStartupDirectory, windowsSystemDirectories, windowsSystemTools.
serverobjectrequired
Policy exclusions check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of exclusions.
numberOfSecurityRisksintegerrequired
Exclusions that may be risky.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
exclusionsarray of object
List of exclusions that may be risky.
Policy exclusions check.
Show child attributesHide child attributes
policyIdstring (uuid)required
Policy ID.
policyNamestringrequired
Policy name.
lockedByManagingAccountbooleanrequired
Whether the policy is managed by a partner or organization, 'true' means yes.
snoozeCommentstring
Snooze comment.
Must be at most 750 characters long.
scanningExclusionsarray of object
List of scanning exclusions.
Show child attributesHide child attributes
valuestringrequired
Exclusion value.
typestringrequired
Type of scan excluded.
Must be one of: path, posixPath, virtualPath, process, web, pua, detectedExploit, amsi, behavioral, journalHashingProcess, journalHashingPath.
scanModestringrequired
Mode of scan excluded.
Must be one of: onDemand, onAccess, onDemandAndOnAccess.
reasonCodestring
Reason for scanning exclusion being flagged as an issue.
Must be one of: allFilesWithExecutableExtension, commonExecutable, entireDrive, usesWindowsPathVariables, usesWindowsSystemDirectoriesViaSyspath, windowsDirectories, windowsStartupDirectory, windowsSystemDirectories, windowsSystemTools.
globalobject
Global exclusions check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
numberOfSecurityRisksintegerrequired
Exclusions that may be risky.
lockedByManagingAccountbooleanrequired
Whether the settings are managed by a partner or organization, 'true' means yes.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
scanningExclusionsarray of object
List of scanning exclusions.
Show child attributesHide child attributes
idstring (uuid)required
Unique ID for the scanning exclusion.
valuestringrequired
Exclusion value.
typestringrequired
Type of scan excluded.
Must be one of: path, posixPath, virtualPath, process, web, pua, detectedExploit, amsi, behavioral, journalHashingProcess, journalHashingPath.
scanModestringrequired
Mode of scan excluded.
Must be one of: onDemand, onAccess, onDemandAndOnAccess.
reasonCodestring
Reason for scanning exclusion being flagged as an issue.
Must be one of: allFilesWithExecutableExtension, commonExecutable, entireDrive, usesWindowsPathVariables, usesWindowsSystemDirectoriesViaSyspath, windowsDirectories, windowsStartupDirectory, windowsSystemDirectories, windowsSystemTools.
tamperProtectionobject
Tamper Protection Health. Null indicates an unexpected error.
Show child attributesHide child attributes
computerobject
Tamper Protection check for each device.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of endpoints.
disabledintegerrequired
Number of endpoints with Tamper Protection turned off.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
serverobject
Tamper Protection check for each device.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total number of endpoints.
disabledintegerrequired
Number of endpoints with Tamper Protection turned off.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
globalDetailobject
Global Tamper Protection check.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
enabledbooleanrequired
Tamper Protection is turned on globally.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
globalboolean
Tamper Protection is turned on globally. This is deprecated, use globalDetail/enabled instead.
networkDeviceobject
Network device health.
Show child attributesHide child attributes
firewallobject
Network device Firewall health.
Show child attributesHide child attributes
firewallAutomaticBackupobject
Backup check for each firewall.
Show child attributesHide child attributes
scoreinteger
The score.
Must be ≥ 0 and ≤ 100.
totalintegerrequired
Total Number of eligible firewalls of the tenant.
notOnRecommendedinteger
Total Number of firewall for which backup not done.
snoozedbooleanrequired
Health check has been snoozed.
snoozeDetailobject
Snooze information.
Show child attributesHide child attributes
startstring (date-time)required
Time snoozed.
endstring (date-time)
Time the snooze was ended.
expirystring (date-time)
Time the snooze expired or will expire.
expiredbooleanrequired
Whether the snooze has expired.
commentstringrequired
Customer comment.
Must be at most 750 characters long.
scheduleobject
Backup schedule details for the tenant.
Show child attributesHide child attributes
frequencystringrequired
Firewall backup frequency.
Must be one of: never, daily, weekly, monthly.
dayinteger
Day number for the frequency.

Errors

Status Meaning
429 Too many requests.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "tenant": {
    "id": "00000000-0000-0000-0000-000000000000",
    "name": "string"
  },
  "endpoint": {
    "protection": {
      "computer": {
        "score": 0,
        "total": 0,
        "notFullyProtected": 0,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        }
      },
      "server": {
        "score": 0,
        "total": 0,
        "notFullyProtected": 0,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        }
      }
    },
    "policy": {
      "computer": {
        "threat-protection": {
          "score": 0,
          "total": 0,
          "notOnRecommended": 0,
          "snoozed": true,
          "snoozeDetail": {
            "start": "2026-07-28T00:00:00Z",
            "end": "2026-07-28T00:00:00Z",
            "expiry": "2026-07-28T00:00:00Z",
            "expired": true,
            "comment": "string"
          },
          "policies": [
            {
              "id": "00000000-0000-0000-0000-000000000000",
              "name": "string",
              "lockedByManagingAccount": true,
              "notOnRecommended": 0
            }
          ]
        }
      },
      "server": {
        "server-threat-protection": {
          "score": 0,
          "total": 0,
          "notOnRecommended": 0,
          "snoozed": true,
          "snoozeDetail": {
            "start": "2026-07-28T00:00:00Z",
            "end": "2026-07-28T00:00:00Z",
            "expiry": "2026-07-28T00:00:00Z",
            "expired": true,
            "comment": "string"
          },
          "policies": [
            {
              "id": "00000000-0000-0000-0000-000000000000",
              "name": "string",
              "lockedByManagingAccount": true,
              "notOnRecommended": 0
            }
          ]
        }
      }
    },
    "exclusions": {
      "policy": {
        "computer": {
          "score": 0,
          "total": 0,
          "numberOfSecurityRisks": 0,
          "snoozed": true,
          "snoozeDetail": {
            "start": "2026-07-28T00:00:00Z",
            "end": "2026-07-28T00:00:00Z",
            "expiry": "2026-07-28T00:00:00Z",
            "expired": true,
            "comment": "string"
          },
          "exclusions": [
            {
              "policyId": "00000000-0000-0000-0000-000000000000",
              "policyName": "string",
              "lockedByManagingAccount": true,
              "snoozeComment": "string",
              "scanningExclusions": [
                {
                  "value": "string",
                  "type": "path",
                  "scanMode": "onDemand",
                  "reasonCode": "allFilesWithExecutableExtension"
                }
              ]
            }
          ]
        },
        "server": {
          "score": 0,
          "total": 0,
          "numberOfSecurityRisks": 0,
          "snoozed": true,
          "snoozeDetail": {
            "start": "2026-07-28T00:00:00Z",
            "end": "2026-07-28T00:00:00Z",
            "expiry": "2026-07-28T00:00:00Z",
            "expired": true,
            "comment": "string"
          },
          "exclusions": [
            {
              "policyId": "00000000-0000-0000-0000-000000000000",
              "policyName": "string",
              "lockedByManagingAccount": true,
              "snoozeComment": "string",
              "scanningExclusions": [
                {
                  "value": "string",
                  "type": "path",
                  "scanMode": "onDemand",
                  "reasonCode": "allFilesWithExecutableExtension"
                }
              ]
            }
          ]
        }
      },
      "global": {
        "score": 0,
        "numberOfSecurityRisks": 0,
        "lockedByManagingAccount": true,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        },
        "scanningExclusions": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "value": "string",
            "type": "path",
            "scanMode": "onDemand",
            "reasonCode": "allFilesWithExecutableExtension"
          }
        ]
      }
    },
    "tamperProtection": {
      "computer": {
        "score": 0,
        "total": 0,
        "disabled": 0,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        }
      },
      "server": {
        "score": 0,
        "total": 0,
        "disabled": 0,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        }
      },
      "globalDetail": {
        "score": 0,
        "enabled": true,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        }
      },
      "global": true
    }
  },
  "networkDevice": {
    "firewall": {
      "firewallAutomaticBackup": {
        "score": 0,
        "total": 0,
        "notOnRecommended": 0,
        "snoozed": true,
        "snoozeDetail": {
          "start": "2026-07-28T00:00:00Z",
          "end": "2026-07-28T00:00:00Z",
          "expiry": "2026-07-28T00:00:00Z",
          "expired": true,
          "comment": "string"
        },
        "schedule": {
          "frequency": "never",
          "day": 0
        }
      }
    }
  }
}

See the guide for a narrative walkthrough of this API.