Skip to content

List IXM scan results

GET/devices/{id}/scan-results

Mobile API · Devices

Get list of Intercept X for Mobile scan results.

Required permissionmobile.device:read

Parameters

Name In Type Required Description
id path string (uuid) Yes Unique object identifier.
X-Tenant-ID header string (uuid) Yes Tenant ID.
fields query array of string No The fields to return in a partial response.
view query string No Type of view to be returned in response.
Must be one of: basic, summary, full.
sort query array of string No Defines how to sort the data.
Each item must match the pattern (^[^:]+$)|(^[^:]+:(asc|desc)$).
page query integer No The page number to fetch, starting with 1.
pageSize query integer No The size of the page requested.
pageTotal query boolean No Whether the number of pages should be calculated and returned in the response.
search query string No Term to search for in the specified search fields.
Must be at most 200 characters long.
searchFields query array of string No List of fields to search in. Defaults to all applicable fields.
Each item must be one of: name, identifier, threatName.
scanResultType query array of string (enum) No Filter objects by scanResultType.
Each item must be one of: threat, suspicious, pua, lowReputation.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/mobile/v1/devices/<id>/scan-results" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/mobile/v1/devices/<id>/scan-results",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/mobile/v1/devices/<id>/scan-results" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/mobile/v1/devices/<id>/scan-results", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/mobile/v1/devices/<id>/scan-results", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — List of Intercept X for Mobile scan results.

Response fields

itemsarray of objectrequired
List of scan results.
Detection.
Show child attributesHide child attributes
typestring (enum)
The type of a scan result.
Must be one of: threat, suspicious, pua, lowReputation.
namestring
The detection name.
identifierstring
App package name or file path on the device.
versionstring
Version of the scanned app.
threatNamestring
Sophos threat name of the detection.
threatLinkstring
Link to the Sophos search page for the given threat name.
detectedAtstring (date-time)
The time when the detection was added to quarantine.
pagesobjectrequired
Show child attributesHide child attributes
currentintegerrequired
The 1-based page number being returned.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items across all pages.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Invalid request.
401 Unauthorized.
403 Forbidden.
404 Unknown device ID.
429 Too many requests. See Retry-After header.
500 Internal server error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "type": "pua",
      "name": "Potential Unwanted App B",
      "identifier": "com.sophos.smsec.test.app.puaB",
      "version": 1.2,
      "threatName": "App/RemAdmin/Android Killer Mobile",
      "threatLink": "https://www.sophos.com/en-us/search-results#q=Andr~Test-B",
      "detectedAt": "2023-01-01T00:00:00.000Z"
    }
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 500
  }
}

See the guide for a narrative walkthrough of this API.