Skip to content

Update AAP settings

POST/endpoints/{endpointId}/adaptive-attack-protection

Endpoint API · Adaptive Attack Protection

Update Adaptive Attack Protection settings for an endpoint.

Required permissionendpoint-state:update

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
endpointId path string (uuid) Yes Endpoint ID.

Request body

Content type: application/json

Request body fields

enabledboolean
Whether the endpoint will enter Adaptive Attack Protection.
expiresAfterstring
Duration (in ISO 8601 format) after which the endpoint will leave Adaptive Attack Protection.
Must be at most 6 characters long.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/adaptive-attack-protection" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"enabled\": true,
  \"expiresAfter\": \"P7D\"
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/adaptive-attack-protection",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'enabled': True, 'expiresAfter': 'P7D'},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "enabled": true,
  "expiresAfter": "P7D"
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/adaptive-attack-protection" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/adaptive-attack-protection", strings.NewReader(`{
  "enabled": true,
  "expiresAfter": "P7D"
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/adaptive-attack-protection", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "enabled": true,
  "expiresAfter": "P7D"
}),
});
const data = await response.json();
console.log(data);

Responses

200 — Adaptive Attack Protection settings updated successfully.

Response fields

desiredStateobject
Desired status for Adaptive Attack Protection.
Show child attributesHide child attributes
enabledboolean
Whether Adaptive Attack Protection is turned on for the endpoint.
sourcestring
Whether the change was made automatically by the endpoint or manually by a user in Sophos Central.
Must be one of: user, automatic.
expiresAfterstring
Duration (in ISO 8601 format) after which the endpoint will leave Adaptive Attack Protection. Only present if a user requested the change.
Must be at most 6 characters long.
actualStateobject
Status of Adaptive Attack Protection.
Show child attributesHide child attributes
enabledboolean
Whether Adaptive Attack Protection is turned on for the endpoint.
lastUpdatedAtstring (date-time)
When Adaptive Attack Protection status was last updated.
expiresAtstring (date-time)
When Adaptive Attack Protection will be turned off.

Errors

Status Meaning
400 Bad request.
404 Can't find endpoint.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "desiredState": {
    "enabled": true,
    "expiresAfter": "P7D",
    "source": "user"
  },
  "actualState": {
    "enabled": true,
    "lastUpdatedAt": "2023-11-21T12:55:11.123Z",
    "expiresAt": "2023-11-28T12:55:11.123Z"
  }
}

See the guide for a narrative walkthrough of this API.