# Adaptive Shield (CrowdStrike Falcon Shield)

> Adaptive Shield is a SaaS Security Posture Management (SSPM) platform that continuously monitors,
> remediates and governs SaaS application security configurations and identity risks across 200+ SaaS
> integrations with 3,500+ built-in security checks. It was acquired by CrowdStrike and rebranded to
> Falcon Shield; adaptive-shield.com now redirects to the CrowdStrike product page.

Generated: 2026-08-30
Method: generated — assembled by API Evangelist from this repository's apis.yml and artifacts.
Not published by the provider. Adaptive Shield serves no llms.txt of its own.

## Status of the API

- The Adaptive Shield REST API v1 is DEPRECATED. Integrator documentation records the endpoints as
  deprecated on 2026-01-11 for organizations on legacy Adaptive Shield credentials.
- The successor surface is the CrowdStrike Falcon platform API, published at
  https://developer.crowdstrike.com/api-reference/ under CrowdStrike's own developer program.
- The API hosts are still live but answer 403 to every unauthenticated request.
- No OpenAPI, AsyncAPI, GraphQL SDL, WSDL, protobuf, MCP server or A2A agent card is published on any
  Adaptive Shield host. The developer portal (developer.adaptive-shield.com) no longer resolves in DNS
  and the help centre carrying the API reference is closed.

## API

- [Adaptive Shield REST API v1](https://www.crowdstrike.com/en-us/platform/falcon-shield/): Account-scoped
  read API over HTTPS returning JSON. Base URLs https://api.adaptive-shield.com (US) and
  https://eu.api.adaptive-shield.com (EU).

Observed operations (from integrator connectors, not from a provider-published spec):

- GET /api/v1/accounts — list accounts available to the key
- GET /api/v1/accounts/{accountId}/alerts — SaaS security alerts; filter by from date, to date, type
- GET /api/v1/accounts/{accountId}/integrations — connected SaaS integrations
- GET /api/v1/accounts/{accountId}/security_checks — security check results
- GET /api/v1/accounts/{accountId}/user_inventory — user inventory
- GET /api/v1/accounts/{accountId}/device_inventory — device inventory

## Authentication

- Per-user API key generated in the Adaptive Shield dashboard: user profile -> API tab -> Generate a
  new key. The key inherits the scope and permissions of the user account that created it.
- The header carrying the key is not published by any surviving source and is not guessed here.
- No OAuth, no OIDC, no scopes. SAML SSO exists for console login only.

## Runtime semantics

- Transport: HTTPS only, JSON responses, conventional HTTP status codes.
- Pagination: not documented.
- Rate limits: none published; no rate-limit headers observable anonymously.
- Errors: no problem-type catalogue, no RFC 9457.
- Idempotency, dry-run and reversibility: not applicable — every documented operation is a read.

## Plans and pricing

- No published plans or prices. Falcon Shield is sold through a sales motion and does not appear on
  CrowdStrike's public pricing page. The API is a platform feature, not a separately priced product.

## Security and compliance

- Vulnerability disclosure: https://www.crowdstrike.com/report-a-security-bug/ (csirt@crowdstrike.com),
  declared in https://www.crowdstrike.com/.well-known/security.txt
- Trust center: https://trust.crowdstrike.com/ — SOC 2, ISO 27001, ISO 27017, PCI DSS, FedRAMP, GDPR, CSA STAR
- EU data residency via the eu.api.adaptive-shield.com regional host.

## Repository artifacts

- authentication/adaptive-shield-authentication.yml — auth profile
- conventions/adaptive-shield-conventions.yml — cross-cutting semantics and reversibility
- lifecycle/adaptive-shield-lifecycle.yml — deprecation, successor, retired surfaces
- rate-limits/adaptive-shield-rate-limits.yml — recorded absence of published limits
- plans/adaptive-shield-plans-pricing.yml — recorded absence of published plans
- packages/adaptive-shield-packages.yml — Splunk add-on 1.0.9 (2024-08-29); no client SDKs
- conformance/adaptive-shield-conformance.yml — standards posture
- well-known/adaptive-shield-well-known.yml — /.well-known/ probe record
- security/ — domain security, vulnerability disclosure, trust center
- mcp/adaptive-shield-mcp.yml — recorded absence of an MCP server

## Links

- Product: https://www.crowdstrike.com/en-us/platform/falcon-shield/
- Integrations: https://www.crowdstrike.com/en-us/platform/falcon-shield/integrations/
- Blog: https://www.crowdstrike.com/en-us/blog/
- Support: https://supportportal.crowdstrike.com/
- Successor API reference: https://developer.crowdstrike.com/api-reference/