Skip to content

Create profile

POST/profiles

Cloud Security API · runtime-detections

Create runtime detection profile or new version of existing profile.

Required permissioncns_runtime_detection:write

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

namestring
Name of the runtime detection profile to create. Only include this parameter when creating a new profile.
profileDescriptionstring
Description of the new runtime detection profile version.
profileIdstring (uuid)
ID of the profile for which to create a new version. Only include this parameter when creating a new version of an existing profile.
contentVersionstringrequired
Version of the default content to be used. Use the default content list API to get a list of supported versions.
settingsobjectrequired
Override settings for runtime detection profile. All settings override the default settings used on an endpoint or agent.
Show child attributesHide child attributes
rulesarray of object
Rule override settings for runtime detection profile.
Settings for a rule in a runtime detection profile.
Show child attributesHide child attributes
namestring
Rule name.
enabledboolean
Whether the rule is enabled.
listsarray of object
Allow/block list override settings for runtime detection profile.
Override settings for a allow/block list.
Show child attributesHide child attributes
namestring
The name of the list.
operationsarray of object
List of override operations.
Override operation details.
Show child attributesHide child attributes
behaviorstring (enum)
Type of override operation.
Must be one of: add, remove.
listarray of string
Allow/block list items included in the operation.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/cloud-security/v1/profiles" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"name\": \"Profile name\",
  \"profileDescription\": \"RTD Profile1 is configured for prod deployments.\",
  \"profileId\": \"7b2d94de-2f89-4433-9901-c65d31195899\",
  \"contentVersion\": \"6.4.8\",
  \"settings\": {
    \"rules\": [
      {
        \"name\": \"Bootloader must be configured\",
        \"enabled\": true
      }
    ],
    \"lists\": [
      {
        \"name\": \"Boot_Files_Modified-programName-allowList\",
        \"operations\": [
          {
            \"behavior\": \"add\",
            \"list\": [
              \"string\"
            ]
          }
        ]
      }
    ]
  }
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/cloud-security/v1/profiles",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'name': 'Profile name',
    'profileDescription': 'RTD Profile1 is configured for prod deployments.',
    'profileId': '7b2d94de-2f89-4433-9901-c65d31195899',
    'contentVersion': '6.4.8',
    'settings': {   'rules': [   {   'name': 'Bootloader must be configured',
                                     'enabled': True}],
                    'lists': [   {   'name': 'Boot_Files_Modified-programName-allowList',
                                     'operations': [   {   'behavior': 'add',
                                                           'list': [   'string']}]}]}},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "name": "Profile name",
  "profileDescription": "RTD Profile1 is configured for prod deployments.",
  "profileId": "7b2d94de-2f89-4433-9901-c65d31195899",
  "contentVersion": "6.4.8",
  "settings": {
    "rules": [
      {
        "name": "Bootloader must be configured",
        "enabled": true
      }
    ],
    "lists": [
      {
        "name": "Boot_Files_Modified-programName-allowList",
        "operations": [
          {
            "behavior": "add",
            "list": [
              "string"
            ]
          }
        ]
      }
    ]
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/cloud-security/v1/profiles" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/cloud-security/v1/profiles", strings.NewReader(`{
  "name": "Profile name",
  "profileDescription": "RTD Profile1 is configured for prod deployments.",
  "profileId": "7b2d94de-2f89-4433-9901-c65d31195899",
  "contentVersion": "6.4.8",
  "settings": {
    "rules": [
      {
        "name": "Bootloader must be configured",
        "enabled": true
      }
    ],
    "lists": [
      {
        "name": "Boot_Files_Modified-programName-allowList",
        "operations": [
          {
            "behavior": "add",
            "list": [
              "string"
            ]
          }
        ]
      }
    ]
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cloud-security/v1/profiles", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "name": "Profile name",
  "profileDescription": "RTD Profile1 is configured for prod deployments.",
  "profileId": "7b2d94de-2f89-4433-9901-c65d31195899",
  "contentVersion": "6.4.8",
  "settings": {
    "rules": [
      {
        "name": "Bootloader must be configured",
        "enabled": true
      }
    ],
    "lists": [
      {
        "name": "Boot_Files_Modified-programName-allowList",
        "operations": [
          {
            "behavior": "add",
            "list": [
              "string"
            ]
          }
        ]
      }
    ]
  }
}),
});
const data = await response.json();
console.log(data);

Responses

201 — Runtime detection profile created successfully.

Response fields

idstring (uuid)required
ID of the runtime detection profile created.
versionintegerrequired
Version of the runtime detection profile created.

Errors

Status Meaning
400 Invalid request for creating runtime detection profile.
401 Authentication failed.
403 Authorization failed.
404 Profile ID doesn't exist.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "id": "d7c15eef-9016-4c67-9a12-0e7a71c63db4",
  "version": 0
}

See the guide for a narrative walkthrough of this API.