Retrieve a paginated list of devices that have not been scanned by EDR

Returns a paginated list of managed devices that have not yet been scanned by the EDR agent. Use the getScannedComponents parameter to toggle between scanned and unscanned device lists. Useful for identifying coverage gaps in EDR deployment.

Endpoints

get /edr/api/view/not_scanned_devices

Copy full URL

Request URL

https://{serverurl}/edr/api/view/not_scanned_devices

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

- Query Parameters

getScannedComponentsbooleanOptional

When true, returns devices that have been scanned. When false or omitted, returns devices that have not yet been scanned.

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/edr/api/view/not_scanned_devices \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/view/not_scanned_devices"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/edr/api/view/not_scanned_devices", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/view/not_scanned_devices"
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/view/not_scanned_devices' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes

limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes

nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual device not scanned item response.

Show Sub-Attributes

resource_name_transformstring

Human-readable display version of the resource_name field.

resource_idstring

Unique resource identifier of the device.

component_idstring

Unique EDR component identifier.

component_status_transformstring

Human-readable display version of the component_status field.
0 = Not enabled,
1 = Active,
8 = Inactive,
11 = Quarantined.

component_version_transformstring

Human-readable display version of the component_version field.

udidstring

Universally unique device identifier.

agent_versionstring

Version of the endpoint management agent running on the device.

os_name_transformstring

Human-readable display version of the os_name field.

os_versionstring

OS build or version number.

os_platformstring

Platform type identifier.

domain_netbios_name_transformstring

Human-readable display version of the domain_netbios_name field.

ip_address_transformstring

Human-readable display version of the ip_address field.

activated_timestring

Unix timestamp (ms) when the EDR agent was first activated on the device.

health_last_contact_time_transformstring

Human-readable display version of the health_last_contact_time field (e.g., 'Jan 15, 2025 12:00 PM').

status_update_timestring

Unix timestamp (ms) of the last status change on the device.

edr_status_update_timestring

Unix timestamp (ms) of the last EDR-specific status update.

agent_last_contact_timestring

Unix timestamp (ms) of the last agent check-in with the management server.

is_suspendedstring

Whether the device is suspended. 'true' or 'false'.

server_osstring

Indicates if the device runs a server OS. '1' = Server OS.

def_file_versionstring

Current definition file version on the device.

ml_versionstring

Machine learning model version installed on the device.

yara_sign_versionstring

YARA signature version installed on the device.

bloom_versionstring

Bloom filter version installed on the device.

clips_versionstring

CLIPS engine version installed on the device.

mc_engine_versionstring

MC engine version installed on the device.

scan_status_transformstring

Human-readable display version of the scan_status field.
0 = Processing,
1 = Completed,
2 = Stopped,
3 = Paused,
4 = Failed,
5 = Cancelled.

scan_end_time_transformstring

Human-readable display version of the scan_end_time field. '--' if not applicable.

scan_start_time_transformstring

Human-readable display version of the scan_start_time field. '--' if not applicable.

last_successful_scan_time_transformstring

Human-readable display version of the last_successful_scan_time field. '--' if not applicable.

last_updated_time_transformstring

Human-readable display version of the last_updated_time field. '--' if not applicable.

status_reason_transformstring

Human-readable display version of the status_reason field. '--' if not applicable.

last_ui_init_scan_timestring

Unix timestamp (ms) of the last scan initiated from the UI. null if not applicable.

ui_initiated_scan_statusstring

Status of the last UI-initiated scan. null if not applicable.

last_sync_timestring

Unix timestamp (ms) of the last sync with the EDR server. null if not synced.

customer_idstring

Customer or tenant identifier this device belongs to.

customer_namestring

Display name of the customer or tenant.

managed_statusstring

Managed status code of the device.

processor_architecturestring

Processor architecture type of the device. '2' = x64.

- HTTP code 400

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the unscanned device list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

400HTTP code

429HTTP code

Sample Response: HTTP 200

Paginated list of devices not yet scanned by EDR

Copied!

  {
    "metadata": {
      "limit": 25,
      "page": 3
    },
    "totalRecords": "51",
    "messageResponse": [
      {
        "resource_name_transform": "DESKTOP-EXAMPLE",
        "managed_status": "61",
        "processor_architecture": "2",
        "agent_last_contact_time": "1700007000000",
        "activated_time": "1700000000000",
        "last_ui_init_scan_time": null,
        "is_suspended": "false",
        "last_updated_time_transform": "--",
        "status_reason_transform": "--",
        "ui_initiated_scan_status": null,
        "ml_version": "",
        "def_file_version": "260101120000",
        "ip_address_transform": "192.168.1.10,10.0.0.5",
        "os_name_transform": "Windows 11 Professional Edition (x64)",
        "server_os": "1",
        "udid": "2000000000000001",
        "domain_netbios_name_transform": "CORP",
        "yara_sign_version": "",
        "status_update_time": "1700012600000",
        "bloom_version": "",
        "health_last_contact_time_transform": "Jan 15, 2025 12:00 PM",
        "component_id": "3000000000000001",
        "scan_end_time_transform": "--",
        "os_version": "10.0.19041",
        "os_platform": "1",
        "last_successful_scan_time_transform": "--",
        "component_status_transform": "1",
        "last_sync_time": null,
        "agent_version": "11.x.xxxx.xx.W",
        "clips_version": "",
        "mc_engine_version": "",
        "edr_status_update_time": "1700007200000",
        "resource_id": "2000000000000001",
        "scan_status_transform": "--",
        "scan_start_time_transform": "--",
        "customer_name": "John Doe",
        "customer_id": "1000000000000001",
        "component_version_transform": "1.0.x.0"
      }
    ],
    "totalPages": 3,
    "Links": {
      "next": "null",
      "prev": "/edr/api/view/not_scanned_devices?page=2&pageLimit=25"
    },
    "status": "success"
  }

▼ Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!

  {
    "errorMessage": "Exception while retrieving unscanned device list",
    "errorCode": "EDRCOMMON001"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/not_scanned_devices",
    "errorMsg": "The URL /edr/api/view/not_scanned_devices was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.