API Access
The API lets your own systems read your Device Inventory Manager data: Power BI reports, a SIEM, inventory scripts. Access is read-only and limited to your tenant.
Required: the API add-on, enabled by your CyberGuard sales representative.
The API add-on is available from the Advanced plan.
What you can read
Each connection (client) is granted one or more data scopes. A scope is available only if the matching feature is included in your license.
| Scope | Data | Status |
|---|---|---|
devices.read |
Devices: hardware, operating system, primary user, compliance state, encryption, lifecycle | Available |
compliance.read |
Compliance state and encryption per device, compliance summary | Available |
audit.read |
Audit log: activity of your users and of your API clients | Available |
apps.read |
Installed applications | Coming soon |
updates.read |
Windows Update, drivers, BIOS | Coming soon |
warranty.read |
Warranties and rentals | Coming soon |
assets.read |
Assets, extra devices, inventory | Coming soon |
network.read |
Network devices and IPAM | Coming soon |
The API never returns BitLocker recovery keys or LAPS passwords.
A client sees all the devices of the tenant. Visibility groups apply to portal users, not to the API.
Create a connection
- Open Tenants → Edit → API in the portal.
- Under New client, enter a name (for example
Power BI) and select the data the client can read. - Click Create client.
- Copy the Client ID and the Client secret.
The secret is shown only once. It is not stored in readable form and cannot be recovered. If you lose it, renew it.
Grant only the scopes the connected system needs. If a secret is exposed, the damage stays limited to that data.
The same page shows the API address to use. Copy it from there: it depends on the region where your data is hosted.
Up to 3 active clients per tenant.
Manage connections
The Credentials table lists every connection with its status, data scopes, secret expiry, creation and last use.
| Action | Effect |
|---|---|
| Renew secret | Creates a new secret. The previous one stays valid, so the connected system keeps working while you update it. |
| Revoke previous secret | Shown only while two secrets are valid. Use it once the system uses the new secret. |
| Revoke | Disables the client and all its secrets. Calls are rejected within a few minutes. |
| Delete | Removes a revoked client from the list. It remains recorded in the audit log. |
Secrets are valid for 12 months. Renew them before they expire.
Every operation on clients, and every token issued or denied, is recorded in the Audit log with date, user and IP address.
Limits
Your API package sets three limits:
| Limit | Applies to |
|---|---|
| Requests per minute | Each client |
| Calls per day | The whole tenant, resets at midnight in your time zone |
| Calls per month | The whole tenant |
One request counts as one call, regardless of the number of records returned. The API page shows the calls used this month and today.
When a limit is reached the API answers 429 Too Many Requests with a Retry-After header. The Endpoints page describes the response headers.
Next steps
- Authentication: how to get a token and call the API
- Endpoints: available data, filters, pagination, errors
- Power BI: ready-to-use query for Power BI reports