Retrieve a paginated list of all EDR-managed devices

Returns a paginated list of all EDR-managed devices with their component status, agent version, OS details, isolation status, and last contact time. Supports filtering by device status, domain, name, resource ID, OS type, scan status, IP address, and agent version.

Endpoints

get /edr/api/view/devices

Copy full URL

Request URL

https://{serverurl}/edr/api/view/devices

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

- Query Parameters

statusstringOptional

Filter devices by EDR agent status.
0 - Not enabled,
1 - Active,
8 - Inactive,
11 - Quarantined.

domainstringOptional

Filter devices by domain name (exact match, e.g., 'TEST GROUP').

deviceNamestringOptional

Filter devices by device hostname (partial match supported, e.g., 'test-001').

resourceIdlongOptional

Filter by the unique resource ID of a specific device., e.g., '12345'

operatingSystemsstringOptional

Filter devices by OS name (partial match supported, e.g., 'Windows 11').

scanStatusstringOptional

Filter by scan status.
0 - In Progress,
1 - Completed,
2 - Stopped,
3 - Paused,
4 - Failed,
5 - Cancelled.

ipAddressstringOptional

Filter devices by IP address (exact match - e.g., '192.168.1.1').

agentVersionstringOptional

Filter devices by agent version string (partial match supported, e.g., '1.0.66.0').

agentVersionStatusstringOptional

Filter devices by agent version status.
0 - Yet To Contact,
1 - Latest Version,
2 - Oldest Version.

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/edr/api/view/devices \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/view/devices"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/edr/api/view/devices", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/view/devices"
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/view/devices' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes

limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes

nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual device item response.

Show Sub-Attributes

resource_name_transformstring

Human-readable display version of the resource_name field.

resource_idstring

Unique resource identifier of the device.

component_idstring

Unique EDR component (device) identifier.

component_status_transformstring

Human-readable display version of the component_status field.

component_version_transformstring

Human-readable display version of the component_version field.

udidstring

Universally unique device identifier.

agent_versionstring

Version of the endpoint management agent running on the device.

os_name_transformstring

Human-readable display version of the os_name field.

os_versionstring

OS build or version number.

os_platformstring

Platform type identifier.

domain_netbios_name_transformstring

Human-readable display version of the domain_netbios_name field.

ip_address_transformstring

Human-readable display version of the ip_address field.

activated_timestring

Unix timestamp (ms) when the EDR agent was first activated on the device.

health_last_contact_time_transformstring

Human-readable display version of the health_last_contact_time field (e.g., 'Jan 15, 2025 10:29 AM').

status_update_timestring

Unix timestamp (ms) of the last status change on the device.

edr_status_update_timestring

Unix timestamp (ms) of the last EDR-specific status update.

agent_last_contact_timestring

Unix timestamp (ms) of the last agent check-in with the management server.

isolation_statusstring

Current network isolation status of the device. null if the device is not isolated.

is_suspendedstring

Whether the device is suspended. 'true' or 'false'.

server_osstring

Indicates if the device runs a server OS. '1' = Server OS.

device_alerts_count_transformstring

Human-readable display version of the device_alerts_count field.

latest_alert_detection_time_transformstring

Human-readable display version of the latest_alert_detection_time field (e.g., 'Jan 15, 2025 10:30 AM').

def_file_versionstring

Current definition file version on the device.

ml_versionstring

Machine learning model version installed on the device.

yara_sign_versionstring

YARA signature version installed on the device.

bloom_versionstring

Bloom filter version installed on the device.

clips_versionstring

CLIPS engine version installed on the device.

mc_engine_versionstring

MC engine version installed on the device.

scan_status_transformstring

Human-readable display version of the scan_status field.
0 = Processing,
1 = Completed,
2 = Stopped,
3 = Paused,
4 = Failed,
5 = Cancelled.

scan_end_time_transformstring

Human-readable display version of the scan_end_time field. '--' if not applicable.

last_successful_scan_time_transformstring

Human-readable display version of the last_successful_scan_time field. '--' if not applicable.

error_codestring

Error code if the EDR agent has an issue. null if the agent is healthy.

remarks_transformstring

Human-readable display version of the remarks field (e.g., 'Protection Enabled').

customer_idstring

Customer or tenant identifier this device belongs to.

customer_namestring

Display name of the customer or tenant.

managed_statusstring

Managed status code of the device.

processor_architecturestring

Processor architecture type of the device. '2' = x64.

- HTTP code 400

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the EDR device list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

400HTTP code

429HTTP code

Sample Response: HTTP 200

Paginated list of EDR-managed devices

Copied!

  {
    "metadata": {
      "limit": 25,
      "page": 3
    },
    "totalRecords": "51",
    "messageResponse": [
      {
        "resource_name_transform": "DESKTOP-EXAMPLE",
        "managed_status": "61",
        "processor_architecture": "2",
        "agent_last_contact_time": "1700000100000",
        "activated_time": "1700000000000",
        "is_suspended": "false",
        "ml_version": "",
        "def_file_version": "260101120000",
        "isolation_status": null,
        "ip_address_transform": "192.168.1.10,10.0.0.5",
        "os_name_transform": "Windows 11 Professional Edition (x64)",
        "server_os": "1",
        "remarks_transform": "Protection Enabled",
        "udid": "2000000000000001",
        "domain_netbios_name_transform": "CORP",
        "yara_sign_version": "",
        "status_update_time": "1700003600000",
        "bloom_version": "",
        "health_last_contact_time_transform": "Jan 15, 2025 10:29 AM",
        "component_id": "3000000000000001",
        "scan_end_time_transform": "--",
        "os_version": "10.0.19041",
        "os_platform": "1",
        "last_successful_scan_time_transform": "--",
        "component_status_transform": "1",
        "device_alerts_count_transform": "10",
        "agent_version": "11.x.xxxx.xx.W",
        "clips_version": "",
        "latest_alert_detection_time_transform": "Jan 15, 2025 10:30 AM",
        "mc_engine_version": "",
        "edr_status_update_time": "1700000360000",
        "resource_id": "2000000000000001",
        "scan_status_transform": "--",
        "error_code": null,
        "customer_name": "John Doe",
        "customer_id": "1000000000000001",
        "component_version_transform": "1.0.x.0"
      }
    ],
    "totalPages": 3,
    "Links": {
      "next": "null",
      "prev": "/edr/api/view/devices?page=2&pageLimit=25"
    },
    "status": "success"
  }

▼ Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!

  {
    "errorMessage": "Exception while retrieving EDR device list",
    "errorCode": "EDRCOMMON001"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/devices",
    "errorMsg": "The URL /edr/api/view/devices was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.