openapi: 3.1.0
info:
  title: Trellix EDR Action History Epo API
  description: Endpoint Detection and Response API for advanced threat hunting, investigation, and automated response capabilities. The EDR API supports querying threat data, searching devices, retrieving action history, and executing real-time search and response actions across managed endpoints. Authentication uses OAuth 2.0 client credentials with the soc.act.tg scope.
  version: '2.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
  termsOfService: https://www.trellix.com/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.manage.trellix.com
  description: Trellix Cloud Management Platform
security:
- bearerAuth: []
tags:
- name: Epo
paths:
  /epo/v2/tags:
    get:
      operationId: listTags
      summary: List tags
      description: Retrieve all tags configured in ePO SaaS. Tags are used to organize and group managed devices for policy assignment and reporting purposes.
      tags:
      - Epo
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      responses:
        '200':
          description: List of configured tags
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Tag'
                  meta:
                    $ref: '#/components/schemas/PaginationMeta'
        '401':
          description: Unauthorized - invalid or expired access token
    post:
      operationId: createTag
      summary: Create a tag
      description: Create a new tag in ePO SaaS for organizing managed devices. Tags can be applied to devices manually or through automated criteria-based assignment rules.
      tags:
      - Epo
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TagCreate'
      responses:
        '201':
          description: Tag created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Tag'
        '400':
          description: Invalid tag data
        '401':
          description: Unauthorized - invalid or expired access token
  /epo/v2/tags/{tagId}:
    get:
      operationId: getTag
      summary: Get tag details
      description: Retrieve details of a specific tag including its name, description, and the criteria used for automatic device assignment.
      tags:
      - Epo
      parameters:
      - $ref: '#/components/parameters/tagId'
      responses:
        '200':
          description: Tag details returned
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Tag'
        '401':
          description: Unauthorized - invalid or expired access token
        '404':
          description: Tag not found
    delete:
      operationId: deleteTag
      summary: Delete a tag
      description: Delete a tag from ePO SaaS. Removing a tag also removes the tag assignment from all associated devices.
      tags:
      - Epo
      parameters:
      - $ref: '#/components/parameters/tagId'
      responses:
        '204':
          description: Tag deleted successfully
        '401':
          description: Unauthorized - invalid or expired access token
        '404':
          description: Tag not found
components:
  parameters:
    limit:
      name: limit
      in: query
      description: Maximum number of items to return per page
      schema:
        type: integer
        default: 25
        minimum: 1
        maximum: 100
    tagId:
      name: tagId
      in: path
      required: true
      description: Unique identifier of the tag
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Number of items to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
  schemas:
    Tag:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the tag
        name:
          type: string
          description: Display name of the tag
        description:
          type: string
          description: Description of the tag purpose
        criteria:
          type: string
          description: Criteria expression for automatic tag assignment to matching devices
    TagCreate:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Display name for the new tag
        description:
          type: string
          description: Description of the tag purpose
        criteria:
          type: string
          description: Optional criteria expression for automatic tag assignment to matching devices
    PaginationMeta:
      type: object
      properties:
        totalItems:
          type: integer
          description: Total number of items matching the query
        limit:
          type: integer
          description: Number of items per page
        offset:
          type: integer
          description: Number of items skipped
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token obtained through the client credentials flow with soc.act.tg scope. Credentials are generated through the Trellix EDR Credential Generator.
externalDocs:
  description: Trellix EDR Product Guide
  url: https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide