All Collections
APIs
[APIs] Device and evidence retrieval
[APIs] Device and evidence retrieval
Updated over a week ago

On the settings page, you can retrieve your organization API token to pull Swif data into 3rd party platform.

Device and evidence retrieval

CURL request

curl --location 'https://api.swifteam.com/restful/organization/devices?q=angelo&offset=0&limit=100' \
--header 'Authorization: Bearer {TOKEN}'

Sample JSON response and its type.

{  # [Device!]!
isAntiVirusAppInstalled
isPasswordManagerAppInstalled
isActive
owners {
user {
firstName
lastName
emails
}
}
deviceInfo { # DeviceInfo!
deviceName # String
description # String
status # DeviceStatus! // ARCHIVED_STOLEN, ARCHIVED, ACTIVE
osVersion # String
osName # String // macOS, Windows, Accessories, iOS, and Android
osBuildVersion # String
modelName # String, “MacBook Pro”, “iPhone”,
"Mac Mini",
"Macbook Air"
modelId # String
modelNumber # String
orderNumber # String
productName # String
deviceType # String,
"Laptop",
"Desktop",
"Monitor",
"Keyboard",
"Trackpad",
"Mouse",
"Headphones",
"Cables"
manufacturer # String
serialNumber # String
deviceCapacity # Long
availableDeviceCapacity # Long
}
mdmDeviceInfo {
mdm_LastEnrolledAt
mdm_LastPingAt
encryption {
encryptionStatus
encryptionEnabled
}
}
osQueryDeviceInfo { # OSQueryDeviceInfo
os { # OS
arch # String
build # String
major # String
minor # String
name # String
patch # String
version # String
}
hardware { # OSHardware
chipType # String
cpuType # String
currentProcessorSpeed # String
l2CacheCore # String
l3Cache # String
machineModel # String
machineName # String
modelNumber # String
modelSpec { # OSHardwareModelSpec
colors # [String!
]
fullName # String
imageURL # String
modelIdentifier # [String!
]
newestOperatingSystem # String
partNumbers # [String!
]
productYear # String
productYearInt # Int
screenSize # String
techSpecsURL # String
userGuideURL # String
}
numberProcessors # String
physicalMemory # String
}
applicationInfo { # [OSApplicationInfo!
]
appName # String
bundleName # String
displayName # String
executable # String
identifier # String
info # String
lastOpenedTime # String
minimumSystemVersion # String
path # String
shortVersion # String
version # String
status # String
installedDate # String
}
windowsSecurityCenter {
antivirus
autoupdate
firewall
internet_settings
user_account_control
windows_security_center_service
}
windowsSecurityProducts {
name
remediation_path
signatures_up_to_date
state
state_timestamp
type
}
}
policyInfos {
policyId
policyType
}
}
Did this answer your question?