Sensor Update Services API
Overview
This API lets you batch sensor updates automatically across your organization and provides visibility into the update jobs progress. This API can update large quantities of devices — up to 250k — without putting your network at risk
If you require the earlier v2 Sensor Update Services API documentation, it will be available here until the API is deactivated, no earlier than August 2024.
Requirements
- Any Carbon Black Cloud product
- API Key with appropriate permissions
Guides and Resources
- Carbon Black Cloud User Guide - Inventory
- Carbon Black Cloud Console Release Notes
- Carbon Black Postman Workspace
Quick Setup
Typical use of the API follows this sequence:
- Create a Sensor Update Job using
https://{cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs
- Receive the job ID
- Call
https://{cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}
route to get job progress - If needed call DELETE
https://{cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}
to cancel an in progress job
Authentication
Determine whether you use Carbon Black Cloud or VMware Cloud Services Platform to manage identity and authorization, or see the Carbon Black Cloud API Access Guide for complete instructions.Carbon Black Cloud Managed Identity and Authentication
Customize your access to the Carbon Black Cloud APIs with Role-Based Access Control; All APIs and Services authenticate via API Keys. To access the data in Carbon Black Cloud via API, you must set up a key with the correct permissions for the calls you want to make and pass it in the HTTP Headers.
Environment
Available on majority of environments; Use the Carbon Black Cloud Console URL, as described here.
API Route
Replace the {cbc-hostname} and {org_key} with the URL of your Environment and the org_key for your specific Org.
- Sensor jobs: {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs
Access Level
Before you create your API Key, you need to create a "Custom" Access Level including each category:
- Device > Sensor kits > org.kits, allow permission to
EXECUTE
- Device > General information > device, allow permission to
READ
API Key
When creating your API Key, use the Access Level Type of "Custom" and select the Access Level you created. Details on constructing and passing the API Key in your requests are available here.
Cloud Services Platform Managed Identity and Authentication
Customize your access to the Carbon Black Cloud APIs with OAuth Access Control; API access is controlled using OAuth apps or User API Tokens. This is currently limited to the UK Point of Presence and AWS GovCloud (US).
Environment
Available on
Prod UK
and AWS GovCloud (US)
. Full list of environments is available here; Use the Carbon Black Cloud Console URL from Cloud Services Platform, as described here.
API Route
Replace the {cbc-hostname} and {org_key} with the URL of your Environment and the org_key for your specific Org.
- Sensor jobs: {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs
Access Level
Before you create your OAuth App, you need to create a custom Role with the following permissions under IDENTITY & ACCESS MANAGEMENT > Roles > VMware Carbon Black Cloud:
- _API.Device:org.kits, allow permission to
EXECUTE
- _API.Device:device, allow permission to
READ
API Authentication
The Cloud Services Platform supports several authentication options, Access Token, API Token, and for backward compatibility, X-Auth-Token. To learn about the differences or how to use the authentication methods see the Authentication Guide.
API Calls
Create Sensor Update Job
Create a job that will update all sensors that match either the search_definition or a list of device_ids. Only one of these criteria may be used.
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | org.kits |
EXECUTE |
Majority of environments |
VMware Cloud Services Platform | _API.Device:org.Kits:execute |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
POST {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs
Request Body - application/json
{
"job_type": "<string>",
"name": "<string>",
"options": {
"sensor_version": {
"WINDOWS": "<string>",
"MAC": "<string>"
}
},
"search_definition": {
"criteria": <object>,
"query": "<string>"
}
}
Body Schema
Field | Description | Values | Default |
---|---|---|---|
job_type REQUIRED
|
The type of sensor update job. | String | Default: ENDPOINT
Options: ENDPOINT , WORKLOAD , VDI , AWS |
name REQUIRED
|
The name of the sensor update job. | String | |
options.sensor_version REQUIRED
|
A map between sensor kit types such as WINDOWS, UBUNTU, etc. to the desired sensor version. The sensor version is the version that the sensor will be updated to. Options: XP , WINDOWS , MAC , RHEL , UBUNTU , SUSE , AMAZON_LINUX , MAC_OSX , OTHER |
Object |
|
search_definition REQUIRED
|
A device search to apply a sensor update to matching devices. | Object | See below properties. |
search_definition.criteria |
A map of searchable device properties to limit the which sensors will be updated. See Device Search for supported criteria. | Object |
|
search_definition.query |
A plaintext search query | String | N/A |
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | The job was successfully created. | application/json | See Examples |
400 | The job failed to be created due to a bad request. | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
POST https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
Content-Type: "application/json"
{
"job_type": "ENDPOINT",
"name": "MAC Upgrade",
"options": {
"sensor_version": {
"MAC": "3.7.2.81"
}
},
"search_definition": {
"criteria": {
"deployment_type": [
"ENDPOINT"
],
"os": [
"mac"
],
"status": [
"SENSOR_OUTOFDATE"
],
"sensor_version": [
"3.5.3.82"
],
"policy_id": [
"6525"
]
},
"query": "Machost"
}
}
{
"id": "d90fd23a-3587-4a30-9d25-fe0b24c51ab4",
"org_key": "ABCD1234",
"name": "MAC Upgrade",
"login_name": "ABCD123456",
"client_ip": "107.2.139.95",
"create_time": "2023-05-25T21:28:28.252733Z",
"start_time": null,
"end_time": null,
"status": "PENDING",
"percent_complete": 100,
"targeted": 0,
"updated": 0,
"pending": 0,
"processing": 0,
"failed": 0,
"failed_sensor_counts": {
"FAILURE_UNKNOWN": 0,
"FAILURE_JOB_INITIALIZATION": 0,
"FAILURE_STOPPED": 0,
"FAILURE_EXPIRED": 0,
"FAILURE_NO_DATA_FOUND": 0,
"FAILURE_EJECTED": 0
},
"sensor_versions": {
"MAC": "3.7.2.81"
},
"current_sensor_versions": {},
"job_type": "ENDPOINT"
}
Search Sensor Update Jobs
Search through sensor update jobs by job type and job name
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | device |
READ |
Majority of environments |
VMware Cloud Services Platform | _API.Device:device:read |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
POST {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/_search
Request Body - application/json
{
"criteria": {
"job_type": "<string>"
},
"query": "<string>",
"rows": <integer>,
"start": <integer>
}
Body Schema
Field | Description | Values | Default |
---|---|---|---|
criteria |
Criteria is an object that represents values that must be in the results. | Object | Supported fields: job_type
job_type supported ENDPOINT , WORKLOAD , VDI , AWS |
query |
Partial matching string for job names | String | |
rows |
Maximum number of rows to return | Integer | Default: 200
Max: 1000 |
start |
What row to begin returning results from | Integer | Default: 0 |
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | OK | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
POST https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/_search
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
Content-Type: "application/json"
{
"criteria": {
"job_type": "ENDPOINT"
},
"query": "MAC",
"rows": 10,
"start": 0
}
{
"num_found": 1,
"results": [
{
"id": "d90fd23a-3587-4a30-9d25-fe0b24c51ab4",
"org_key": "ABCD1234",
"name": "Mac Upgrade - In Progress",
"login_name": "ABCD123456",
"client_ip": "107.2.139.95",
"create_time": "2023-05-25T21:28:28.252733Z",
"start_time": "2023-05-25T21:28:29.675315Z",
"end_time": null,
"status": "IN_PROGRESS",
"percent_complete": 0,
"targeted": 1,
"updated": 0,
"pending": 1,
"processing": 0,
"failed": 0,
"failed_sensor_counts": {
"FAILURE_EXPIRED": 0,
"FAILURE_JOB_INITIALIZATION": 0,
"FAILURE_NO_DATA_FOUND": 0,
"FAILURE_EJECTED": 0,
"FAILURE_UNKNOWN": 0,
"FAILURE_STOPPED": 0
},
"sensor_versions": {
"MAC": "3.7.2.81"
},
"current_sensor_versions": {
"MAC": {
"3.5.3.82": 1
}
},
"job_type": "ENDPOINT"
}
]
}
Get Sensor Update Job
Get the latest details of a sensor update service job
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | device" |
READ |
Majority of environments |
VMware Cloud Services Platform | _API.Device:device:read |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
GET {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | OK | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
GET https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/d90fd23a-3587-4a30-9d25-fe0b24c51ab4
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
{
"id": "d90fd23a-3587-4a30-9d25-fe0b24c51ab4",
"org_key": "ABCD1234",
"name": "MAC Upgrade",
"login_name": "ABCD123456",
"client_ip": "107.2.139.95",
"create_time": "2023-05-25T21:28:28.252733Z",
"start_time": "2023-05-25T21:28:29.675315Z",
"end_time": null,
"status": "IN_PROGRESS",
"percent_complete": 0,
"targeted": 1,
"updated": 0,
"pending": 1,
"processing": 0,
"failed": 0,
"failed_sensor_counts": {
"FAILURE_EXPIRED": 0,
"FAILURE_JOB_INITIALIZATION": 0,
"FAILURE_NO_DATA_FOUND": 0,
"FAILURE_EJECTED": 0,
"FAILURE_UNKNOWN": 0,
"FAILURE_STOPPED": 0
},
"sensor_versions": {
"MAC": "3.7.2.81"
},
"current_sensor_versions": {
"MAC": {
"3.5.3.82": 1
}
},
"job_type": "ENDPOINT"
}
Update Sensor Update Job Name
Modify the name of the sensor update job.
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | org.kits |
EXECUTE |
Majority of environments |
VMware Cloud Services Platform | _API.Device:org.Kits:execute |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
PUT {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}
Request Body - application/json
{
"name": "<string>"
}
Body Schema
Field | Required | Description | Values | Default |
---|---|---|---|---|
name REQUIRED
|
The name of the sensor update job. | String |
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | OK | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
PUT https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/d90fd23a-3587-4a30-9d25-fe0b24c51ab4
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
Content-Type: "application/json"
{
"name": "Mac Upgrade - In Progress"
}
{
"id": "d90fd23a-3587-4a30-9d25-fe0b24c51ab4",
"org_key": "ABCD1234",
"name": "Mac Upgrade - In Progress",
"login_name": "ABCD123456",
"client_ip": "107.2.139.95",
"create_time": "2023-05-25T21:28:28.252733Z",
"start_time": "2023-05-25T21:28:29.675315Z",
"end_time": null,
"status": "IN_PROGRESS",
"percent_complete": 0,
"targeted": 1,
"updated": 0,
"pending": 1,
"processing": 0,
"failed": 0,
"failed_sensor_counts": {
"FAILURE_EXPIRED": 0,
"FAILURE_JOB_INITIALIZATION": 0,
"FAILURE_NO_DATA_FOUND": 0,
"FAILURE_EJECTED": 0,
"FAILURE_UNKNOWN": 0,
"FAILURE_STOPPED": 0
},
"sensor_versions": {
"MAC": "3.7.2.81"
},
"current_sensor_versions": {
"MAC": {
"3.5.3.82": 1
}
},
"job_type": "ENDPOINT"
}
Stop Sensor Update Job
Cancels a sensor update job that is in progress. Any sensors which are in progress updating will attempt to complete upgrade while all non started sensors will be canceled.
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | org.kits |
EXECUTE |
Majority of environments |
VMware Cloud Services Platform | _API.Device:org.Kits:execute |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
DELETE {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | OK | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
DELETE https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/d90fd23a-3587-4a30-9d25-fe0b24c51ab4
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
204 No Content
Search Sensors in Sensor Update Job
Search the sensors associated with the sensor update job.
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | device |
READ |
Majority of environments |
VMware Cloud Services Platform | _API.Device:device:read |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
POST {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}/sensors/_search
Request Body - application/json
{
"criteria": {
"sensor_kit_type": ["<string>", "<string>"],
"status": ["<string>", "<string>"],
"version": ["<string>", "<string>"]
},
"format": "<string>",
"query": "<string>",
"rows": <integer>,
"sort": [
{
"field": "<string>",
"order": "<string>"
}
],
"start": <integer>
}
Body Schema
Field | Description | Values | Default | |
---|---|---|---|---|
criteria |
Criteria is an object that represents values that must be in the results. | Object | Supported fields: sensor_kit_type , status , version
sensor_kit_type supported XP , WINDOWS , MAC , OTHER , RHEL , UBUNTU , SUSE , AMAZON_LINUX , MAC_OSX
status supported PENDING , IN_PROGRESS , SUCCESSFUL , FAILURE_UNKNOWN , FAILURE_EXPIRED , FAILURE_NO_DATA_FOUND , FAILURE_STOPPED , FAILURE_JOB_INITIALIZATION , FAILURE_EJECTED |
|
format |
The format for the response | String | Default: json
Options: csv or json |
|
query |
Partial match string for device_name | String | ||
rows |
Maximum number of rows to return | Integer | Default: 200
Max: 1000 |
|
start |
What row to begin returning results from | Integer | Default: 0 |
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
200 | OK | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
POST https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/d90fd23a-3587-4a30-9d25-fe0b24c51ab4/sensors/_search
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
Content-Type: "application/json"
{
"criteria": {
"sensor_kit_type": ["MAC"],
"status": ["PENDING"]
},
"format": "JSON",
"rows": 10,
"query": "Mac",
"sort": [
{
"field": "DEVICE_NAME",
"order": "ASC"
}
],
"start": 0
}
{
"num_found": 1,
"results": [
{
"device_id": 4802823,
"device_name": "Machost1-MAD",
"status": "PENDING",
"reason": "",
"current_version": "3.5.3.82",
"update_version": "",
"start_time": "-999999999-01-01T00:00:00.000Z",
"update_time": "-999999999-01-01T00:00:00.000Z",
"sensor_kit_type": "MAC"
}
]
}
Export Sensors in Sensor Update Job
Export the sensors associated with the sensor update job.
You can use the Job Service API to download large sets of query results without experiencing timeout errors or receiving corrupt files.
API Permissions Required
Identity Manager | Permission (.notation name) | Operation(s) | Environment |
---|---|---|---|
Carbon Black Cloud | device |
READ |
Majority of environments |
VMware Cloud Services Platform | _API.Device:device:read |
N/A - included in permission name | Prod UK and AWS GovCloud (US) |
Request
POST {cbc-hostname}/sensor_update_service/v3/orgs/{org_key}/jobs/{job_id}/sensors/_export
Request Body - application/json
{
"criteria": {
"sensor_kit_type": "<string>",
"status": "<string>",
"version": "<string>"
},
"format": "<string>",
"query": "<string>"
"sort": [
{
"field": "<string>",
"order": "<string>"
}
]
}
Body Schema
Field | Description | Values | Default | |
---|---|---|---|---|
criteria |
Criteria is an object that represents values that must be in the results. | Object | Supported fields: sensor_kit_type , status , version
sensor_kit_type supported XP , WINDOWS , MAC , OTHER , RHEL , UBUNTU , SUSE , AMAZON_LINUX , MAC_OSX
status supported PENDING , IN_PROGRESS , SUCCESSFUL , FAILURE_UNKNOWN , FAILURE_EXPIRED , FAILURE_NO_DATA_FOUND , FAILURE_STOPPED , FAILURE_JOB_INITIALIZATION , FAILURE_EJECTED |
|
format |
The format for the response | String | Default: json
Options: csv or json |
|
query |
Partial match string for device_name | String |
Response Codes
Code | Description | Content-Type | Content |
---|---|---|---|
202 | Accepted | application/json | See Examples |
400 | Bad Request | application/json |
|
401 | Unauthorized | application/json | See error message above. |
403 | Forbidden | application/json | See error message above. |
404 | Not Found | application/json | See error message above. |
500 | Internal Server Error | application/json | See error message above. |
Examples
POST https://defense.conferdeploy.net/sensor_update_service/v3/orgs/ABCD1234/jobs/d90fd23a-3587-4a30-9d25-fe0b24c51ab4/sensors/_export
X-AUTH-TOKEN: "ABCDEFGHIJKLMNO123456789/ABCD123456"
Content-Type: "application/json"
{
"criteria": {
"sensor_kit_type": ["MAC"],
"status": ["PENDING"]
},
"format": "JSON",
"rows": 10,
"query": "Mac",
"sort": [
{
"field": "DEVICE_NAME",
"order": "ASC"
}
],
"start": 0
}
{
"job_service_id": 7212552
}
Field Definitions
Job
Field | Definition | Data Type | Values |
---|---|---|---|
id |
The identifier for the job. | String | |
org_key |
The organization’s key identifier. | String | |
name |
The name of the job. | String | |
login_name |
The user or API ID that created the Sensor Job. | String | |
client_ip |
The IP of the client creating the job. | String | |
status |
The state of the job. | String | PENDING , IN_PROGRESS , CANCELLED , or COMPLETED |
create_time |
The time at which the job was created as an ISO 8601 UTC timestamp. | String | Example: 2023-04-07T17:49:58.792Z |
start_time |
The time at which the job was started as an ISO 8601 UTC timestamp. | String | Example: 2023-04-07T17:49:58.792Z |
end_time |
The time at which the job completed or was cancelled as an ISO 8601 UTC timestamp. | String | Example: 2023-04-07T17:49:58.792Z |
percent_complete |
A percentage number indicating the sensors that have failed or updated. | Integer | [ 0 - 100 ] |
targeted |
The number of sensors which are being targeted for update. | Integer | N/A |
updated |
The number of sensors that have successfully updated. | Integer | N/A |
pending |
The number of sensors which are pending the update. | Integer | N/A |
processing |
The number of sensors which are currently updating. | Integer | N/A |
failed |
The number of sensors which failed to update. | Integer | N/A |
failed_sensor_counts |
The counts of sensors that have failed grouped by reason. | Object |
|
sensor_versions |
The versions that the sensor will be updated to based on OS. | Object |
|
current_sensor_versions |
The current versions of the sensors by operating system and count. | Object |
|
job_type |
The type of sensor job. | String | ENDPOINT , WORKLOAD , VDI , AWS |
Sensor
Field | Definition | Data Type | Values |
---|---|---|---|
current_version |
The current version of the sensor before the update. | String | "#.#.#.#" |
device_id |
The id of the device. | Integer | |
device_name |
The name of the device. | String | |
reason |
The description behind the current sensor state. | String | N/A |
sensor_kit_type |
The sensor’s type based on OS. | String | XP , WINDOWS , MAC , RHEL , UBUNTU , SUSE , AMAZON_LINUX , MAC_OSX , OTHER |
start_time |
The time at which the sensor started updating as an ISO 8601 UTC timestamp. | String | Example: 2023-04-07T17:49:58.792Z |
status |
The state of the update on the sensor. | String | PENDING , IN_PROGRESS , SUCCESSFUL , FAILURE_UNKNOWN , FAILURE_EXPIRED , FAILURE_NO_DATA_FOUND , FAILURE_STOPPED , FAILURE_JOB_INITIALIZATION , FAILURE_EJECTED |
update_time |
The time at which the sensor updated as an ISO 8601 UTC timestamp. | String | Example: 2023-04-07T17:49:58.792Z |
update_version |
The version to update the sensor to. | String | "#.#.#.#" |
Last modified on August 16, 2023