Skip to content

Update settings

POST/endpoints/{endpointId}/tamper-protection

Endpoint API · Tamper Protection

Turns Tamper Protection on or off on an endpoint. Or generates a new Tamper Protection password. Note that Tamper Protection can be turned on for an endpoint only if it has also been turned on globally.

Required permissionendpoint-state:update

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
endpointId path string (uuid) Yes Endpoint ID.

Request body

Content type: application/json

Request body fields

enabledboolean
Whether Tamper Protection should be turned on for the endpoint.
regeneratePasswordboolean
Whether a new Tamper Protection password should be generated.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/tamper-protection" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"enabled\": true
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/tamper-protection",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'enabled': True},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "enabled": true
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/tamper-protection" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/tamper-protection", strings.NewReader(`{
  "enabled": true
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/endpoints/<endpointId>/tamper-protection", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "enabled": true
}),
});
const data = await response.json();
console.log(data);

Responses

201 — Tamper Protection settings for an endpoint.

Response fields

enabledbooleanrequired
Whether Tamper Protection should be turned on for the endpoint.
passwordstringrequired
Current Tamper Protection password.
previousPasswordsarray of object
Old Tamper Protection passwords.
Show child attributesHide child attributes
passwordstringrequired
The old Tamper Protection password.
invalidatedAtstring (date-time)required
Time when the old Tamper Protection password was changed.

Errors

Status Meaning
404 Can't find endpoint.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "enabled": true,
  "password": "string",
  "previousPasswords": [
    {
      "password": "string",
      "invalidatedAt": "2026-07-28T00:00:00Z"
    }
  ]
}

See the guide for a narrative walkthrough of this API.