Skip to content

Isolation update

POST/endpoints/isolation

Endpoint API · Endpoint Isolation

Turn on or off endpoint isolation for multiple endpoints. We recommend that you wait for a period of time between turning endpoint isolation on and off using this API.

Required permissionendpoint-state:update

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

enabledbooleanrequired
Whether the endpoints should be isolated or not.
commentstring
Reason the endpoints should be isolated or not.
Must be at most 400 characters long.
idsarray of string (uuid)required
List of endpoints IDs.
Must contain 1–500 items.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/isolation" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"enabled\": true,
  \"comment\": \"Isolating endpoints with suspicious health\",
  \"ids\": [
    \"3fa85f64-5717-4562-b3fc-2c963f66afa6\",
    \"9d5d6819-0238-43e6-ba03-815cae0d474d\",
    \"2da8b591-9164-4f7e-a367-ad9b9cb77736\",
    \"66046f6a-bff0-4b51-aa0b-ac18bd363207\"
  ]
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/isolation",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'enabled': True,
    'comment': 'Isolating endpoints with suspicious health',
    'ids': [   '3fa85f64-5717-4562-b3fc-2c963f66afa6',
               '9d5d6819-0238-43e6-ba03-815cae0d474d',
               '2da8b591-9164-4f7e-a367-ad9b9cb77736',
               '66046f6a-bff0-4b51-aa0b-ac18bd363207']},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "enabled": true,
  "comment": "Isolating endpoints with suspicious health",
  "ids": [
    "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "9d5d6819-0238-43e6-ba03-815cae0d474d",
    "2da8b591-9164-4f7e-a367-ad9b9cb77736",
    "66046f6a-bff0-4b51-aa0b-ac18bd363207"
  ]
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/isolation" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/isolation", strings.NewReader(`{
  "enabled": true,
  "comment": "Isolating endpoints with suspicious health",
  "ids": [
    "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "9d5d6819-0238-43e6-ba03-815cae0d474d",
    "2da8b591-9164-4f7e-a367-ad9b9cb77736",
    "66046f6a-bff0-4b51-aa0b-ac18bd363207"
  ]
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/isolation", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "enabled": true,
  "comment": "Isolating endpoints with suspicious health",
  "ids": [
    "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "9d5d6819-0238-43e6-ba03-815cae0d474d",
    "2da8b591-9164-4f7e-a367-ad9b9cb77736",
    "66046f6a-bff0-4b51-aa0b-ac18bd363207"
  ]
}),
});
const data = await response.json();
console.log(data);

Responses

202 — Isolation update requests have been processed. Accepted requests are returned in items, and rejected requests are returned in errors.

Response fields

itemsarray of object
List of endpoint isolation requests that were accepted.
Endpoint ID and corresponding endpoint isolation details.
Show child attributesHide child attributes
idstring (uuid)
Endpoint ID.
isolationobject
Response to a request to set the desired isolation state of an endpoint.
Show child attributesHide child attributes
enabledbooleanrequired
Whether the endpoint should be isolated or not.
lastEnabledAtstring (datetime)
When isolation was last enabled for the endpoint.
lastEnabledByobject
Show child attributesHide child attributes
idstringrequired
Principal Email or clientId.
typestring (enum)required
Principal type.
Must be one of: user, service, system.
namestring
User Principal name.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
lastDisabledAtstring (datetime)
When isolation was last disabled for the endpoint.
lastDisabledByobject
Show child attributesHide child attributes
idstringrequired
Principal Email or clientId.
typestring (enum)required
Principal type.
Must be one of: user, service, system.
namestring
User Principal name.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.
commentstring
Reason endpoint should be isolated or not.
Must be at most 400 characters long.
errorsarray of object
List of endpoint isolation requests that could not be accepted.
Error details for an endpoint action request that could not be accepted for a specific endpoint.
Show child attributesHide child attributes
idstring (uuid)required
The endpoint id.
errorCodestringrequired
Machine-readable error code for an endpoint action request. The errorMessage field of the error response will contain a human-readable description of the error.
Must be one of: notFound, notSupported, conflict, permissionDenied, internalError.
errorMessagestringrequired
A human-readable error message describing the error in more detail.
Must be at most 250 characters long.

Errors

Status Meaning
400 Bad request.
404 No endpoints found.
409 Isolation or removal from isolation in progress.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

202

{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "isolation": {
        "enabled": true,
        "lastEnabledAt": "string",
        "lastEnabledBy": {
          "id": "string",
          "type": "user",
          "name": "string",
          "accountType": "partner",
          "accountId": "00000000-0000-0000-0000-000000000000"
        },
        "lastDisabledAt": "string",
        "lastDisabledBy": {
          "id": "string",
          "type": "user",
          "name": "string",
          "accountType": "partner",
          "accountId": "00000000-0000-0000-0000-000000000000"
        },
        "comment": "string"
      }
    }
  ],
  "errors": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "errorCode": "notFound",
      "errorMessage": "string"
    }
  ]
}

See the guide for a narrative walkthrough of this API.