Retrieve the full configuration details of a Defender payload item

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Get Windows Defender policy payload details

Request URL

https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}

Scope

MDMDeviceMgmt.READCopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory
application/jsonapplication/jsonCopied!

- Path Parameters

profile_idstringMandatory

Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response

payload_idstringMandatory

Unique identifier of the payload item. Obtain from the Get Payload Item IDs response

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52'

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
payload_idlong

Unique identifier of the payload item

allow_archive_scanningboolean

Allow Archive Scanning. Default: true

allow_behavior_monitoringboolean

Allow Behavior Monitoring. Default: true

allow_cloud_protectionboolean

Allow Cloud Protection. Default: true

allow_email_scanningboolean

Allow Email Scanning. Default: false

allow_full_scan_on_mapped_networkdrivesboolean

Allow Full Scan On Mapped Networkdrives. Default: false

allow_full_scan_removable_drive_scanningboolean

Allow Full Scan Removable Drive Scanning. Default: true

allow_intrusion_prevention_systemboolean

Allow Intrusion Prevention System. Default: true

allow_ioav_protectionboolean

Allow Ioav Protection. Default: true

cloud_block_levelinteger

Cloud Block Level. Default: 0

allow_onaccess_protectionboolean

Allow Onaccess Protection. Default: true

allow_realtime_monitoringboolean

Allow Realtime Monitoring. Default: true

allow_scanning_network_filesboolean

Allow Scanning Network Files. Default: false

allow_script_scanningboolean

Allow Script Scanning. Default: true

allow_user_ui_accessboolean

Allow User Ui Access. Default: true

check_for_signatures_before_runningscanboolean

Check For Signatures Before Runningscan. Default: false

pua_protectioninteger

Pua Protection. Default: 0

realtime_scan_directioninteger

Realtime Scan Direction. Default: 0

scan_parameterinteger

Scan Parameter. Default: 1

allow_switch_to_async_inspectionboolean

Allow Switch To Async Inspection. Default: false

disable_cpu_throttle_on_idle_scansboolean

Disable Cpu Throttle On Idle Scans. Default: true

disable_network_protection_perf_telemetryboolean

Disable Network Protection Perf Telemetry. Default: false

enable_filehash_computationboolean

Enable Filehash Computation. Default: false

hide_exclusions_from_local_adminsboolean

Hide Exclusions From Local Admins. Default: false

hide_exclusions_from_local_usersboolean

Hide Exclusions From Local Users. Default: false

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Full configuration details of Defender payload item

Copied!
  {
    "allow_behavior_monitoring": true,
    "disable_cpu_throttle_on_idle_scans": true,
    "allow_switch_to_async_inspection": false,
    "hide_exclusions_from_local_admins": false,
    "allow_scanning_network_files": false,
    "scan_parameter": "2",
    "allow_realtime_monitoring": true,
    "disable_network_protection_perf_telemetry": false,
    "allow_email_scanning": false,
    "hide_exclusions_from_local_users": false,
    "allow_onaccess_protection": true,
    "allow_archive_scanning": true,
    "allow_ioav_protection": true,
    "allow_full_scan_on_mapped_networkdrives": false,
    "allow_cloud_protection": true,
    "pua_protection": "1",
    "allow_script_scanning": true,
    "cloud_block_level": "2",
    "check_for_signatures_before_runningscan": false,
    "payload_id": "9007199254741295",
    "allow_full_scan_removable_drive_scanning": true,
    "allow_user_ui_access": true,
    "enable_filehash_computation": false,
    "allow_intrusion_prevention_system": true,
    "realtime_scan_direction": "1"
  }
                
Show full

Duration: 1 minute | Threshold: 120 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.