API Reference

New Fusion XDR GraphQL APIs and Classic XDR API deprecation

Fri, 18 Sep 2026 00:00:00 +0000

Use the new Fusion XDR APIs and migrate from the Classic XDR APIs.

Firewall Management API update

Thu, 16 Jul 2026 00:00:00 +0000

The new firewall configuration import/export APIs allow admins to export configuration from an existing firewall and import it into another firewall, or multiple firewalls, directly through APIs. This helps simplify configuration backup, migration, and reuse across firewall deployments without requiring manual configuration on each firewall.

Mobile API update

Wed, 08 Jul 2026 00:00:00 +0000

The Mobile API now includes basic support for policies as well as settings for the automatic enrollment of the Intercept X for Mobile app. You can create and list threatDefense policies for iOS and Android, and configure automatic enrollment of Intercept X for Mobile.

Endpoint Web Control Enhancements

Tue, 23 Jun 2026 00:00:00 +0000

Web control now includes filtering of Generative AI sites, more flexible control of specific sites, and simplified policy management. A new Web Filtering Profiles model simplifies configuration by allowing administrators to define filtering settings once and apply them consistently across multiple policies, with more granular category controls.

Audit Events API

Tue, 09 Jun 2026 00:00:00 +0000

We are pleased to announce the Audit Events API, which allows you to retrieve a paginated log of administrative and system actions taken within your Sophos Central account.

Partner Admins API update

Mon, 08 Jun 2026 00:00:00 +0000

The Partner Admins API now lets you delete a partner administrator using DELETE /partner/v1/admins/{adminId}.

Organization Admins API

Wed, 03 Jun 2026 00:00:00 +0000

We are pleased to announce the Organization Admins API, which enables you to programmatically manage organization administrators and their role assignments.

DNS Protection Policies & Custom Domains APIs

Mon, 11 May 2026 00:00:00 +0000

We're excited to announce the general availability of two new additions to the Sophos DNS Protection API: the Policies API and the Custom Domains Lists API. Together with the existing Locations API, these complete the V2 management surface for DNS Protection.

Device Software API

Tue, 07 Apr 2026 00:00:00 +0000

We have published the Device Software API. This new API allows you to assign device software to your endpoints in bulk.

Endpoint Tags API

Mon, 16 Mar 2026 00:00:00 +0000

We're excited to announce the general availability of the Sophos Endpoint Tags API. This new API enables you to organize and categorize your endpoints using custom key-value tags, providing greater flexibility in device management.

Business Automation API

Fri, 21 Nov 2025 00:00:00 +0000

We've published a new API that helps our distributors do business with Sophos in an easy, accurate, and efficient manner. The API includes three primary endpoints: one for retrieving all quotes associated with a distributor, one for fetching the details of a specific quote, and another for retrieving a list of partners along with their current levels.

DNS Protection Locations API

Thu, 23 Oct 2025 00:00:00 +0000

We're excited to announce the general availability of the Sophos DNS Protection Locations API. This API lets customers manage their DNS Protection Locations which can use either traditional TCP/UDP or DNS over HTTPS for applied DNS filtering and protection policies.

Firewall API update

Fri, 10 Oct 2025 00:00:00 +0000

We've just added new operations to the Firewall Management API. The MDR threat feed APIs enable the automation of actions MDR analysts can take in Sophos Firewall to block or monitor the threat indicators. When MDR detects any suspicious IP/Domain/URI, MDR Analyst needs to apply threatFeed configuration on a firewall to protect from known IOCs. To do this, MDR shall call Central exposed ThreatFeed APIs.

Data Collection and Investigation API

Tue, 07 Oct 2025 00:00:00 +0000

We’ve introduced a new endpoint and server policy in Sophos Central called 'Data Collection and Investigation'. This policy includes settings for enabling Data Lake Uploads and Live Response, crucial tools for threat investigation and response.

Endpoint API update

Thu, 24 Jul 2025 00:00:00 +0000

Enhancing Threat Investigations: Memory Dump Collection in Forensic Logs {#memory-dump-collection}

Endpoint API update

Wed, 07 May 2025 00:00:00 +0000

Attackers attempt to leverage compromised, unprotected devices to pivot and infiltrate other systems on a network. You can now prevent your Sophos-managed devices from communicating with these devices by specifying the IP addresses of the compromised devices. Doing this helps stop threats from spreading to or between devices in your organization. Administrators can enter the IPv4, IPv6 or address range of compromised devices. Each entry has a default expiration period of 7 days. Once an IP address is added, all Windows and Linux endpoints and servers within the customer's environment will refuse any inbound or outbound communication attempts to that address. Please ensure you don't block addresses that are important for your business operations or security, such as critical servers.

Endpoint API update

Wed, 09 Apr 2025 00:00:00 +0000

We have added support for reporting as well as searching by the following new fields:

Detections API update

Thu, 03 Apr 2025 00:00:00 +0000

We've enhanced the detections and detection groups query APIs by adding additional filters to ensure consistency across all detection-related queries.

Endpoint API update

Thu, 06 Mar 2025 00:00:00 +0000

We've updated the Sophos Endpoint API to support Forensic Log Collection. Forensic Log Collection is a new feature designed to assist customers during threat investigations. It allows customers to retrieve a variety of forensic artifacts from a device, including Sophos logs, Windows Event Logs, and other relevant operating system data. The tool offers three modes - Standard, Full, and Fast - allowing customers to customize the scope and depth of the data collected.

Mobile API update

Thu, 06 Feb 2025 00:00:00 +0000

We've updated the Sophos Mobile API to support mobile device management for devices using the Sophos Mobile Control app. You can now perform additional device actions (lock, unlock, wipe, locate, unenroll, and requesting client logs). These actions require the Sophos Mobile Control app to be installed and enrolled with Sophos Mobile.