Skip to main content
Prisma Browser

Devices

A device is an endpoint observed in your tenant: a machine or mobile device that has connected through the Prisma Browser. Like users, you do not create devices through this API. Devices are observed as they enroll and report posture, and the API lets you list them, read one, filter by posture, and act on them (archive, suspend, delete, force re-authentication). Each device carries a rich posture snapshot (OS, disk encryption, firewall, screen lock, endpoint protection) and an embedded user.

On this page: what you can and cannot do, list and filter by posture, get one, key fields, lifecycle actions, endpoint reference, tips and gotchas.

What you can and cannot do​

OperationSupported?How
List / getYesGET /devices, GET /devices/{id}
Create / updateNoDevices are observed, not authored here
Archive / restore / suspend / resume / delete / force re-authYes, immediatelyDirect actions (no draft, no publish)
note

Devices are not part of the draft. Reads return live state and the lifecycle actions below take effect at once. The draft and publish model does not apply to devices. To govern devices with policy, use device groups, which are draft-gated.

List and filter by posture​

GET /seb-api/v1/devices
# macOS devices with disk encryption disabled, most recently seen first
curl -sS -G "$PB_API_BASE/devices" \
  -H "Authorization: Bearer $PB_TOKEN" \
  --data-urlencode "device.os_type=macOS" \
  --data-urlencode "device.disk_encryption_status=DiskEncryptionStatusDisabled" \
  --data-urlencode "sort=device.last_seen" \
  --data-urlencode "order=desc" \
  --data-urlencode "limit=50"

Response (200):

{
  "pageInfo": { "hasNextPage": false, "cursor": "", "totalCount": 1 },
  "data": [
    {
      "id": "0DEEXAMPLEDEVICEXXXXXXXXXXX",
      "externalId": "e3ad0cea-9dba-4d59-afd9-ae4e65b026ba",
      "status": "active",
      "hostname": "M-EXAMPLE01",
      "serialNumber": "C02EXAMPLE01",
      "osType": "macOS",
      "osVersion": "26.4.0",
      "osDisplayName": "macOS 26.4",
      "deviceType": "laptop",
      "platform": "Desktop Browser",
      "screenLockStatus": "ScreenLockStatusEnabled",
      "diskEncryptionStatus": "DiskEncryptionStatusEnabled",
      "firewallStatus": "FireWallStatusEnabled",
      "browserVersion": "150.41.0.46",
      "ip": "203.0.113.10",
      "macAddresses": [ "22:fe:8a:2b:33:b1" ],
      "firstSeen": "2025-11-01T09:00:00Z",
      "lastSeen": "2026-01-15T10:00:00Z"
      // ... posture details: diskEncryptionDetails, firewallDetails, deviceEPP, embedded user
    }
    // ... more devices
  ]
}

You get a paginated envelope: pageInfo plus a data array of Device objects. Page through large tenants with the cursor (see Pagination).

Query parameters​

ParameterTypeNotes
device.hostnamestringFilter by hostname.
device.os_typestringwindows, macOS, linux, ios, android, unknown.
device.typestringdesktop, laptop, vm, smartphone, tablet, chromebook, unknown.
device.firewall_statusstringFirewall posture.
device.screen_lock_statusstringScreen lock posture.
device.disk_encryption_statusstringDisk encryption posture.
user.namestringFilter by the device owner's name.
device.first_seen_gtedate-timeFirst seen at or after.
device.last_seen_gtedate-timeLast seen at or after.
device.last_seen_ltedate-timeLast seen at or before.
sortenumdevice.hostname, device.os_type, device.browser_version, device.first_seen, device.last_seen, user.name.
orderenumasc or desc.
cursorstringOpaque pagination cursor.
limitintegerPage size.

Get one​

GET /seb-api/v1/devices/{id}
curl -sS "$PB_API_BASE/devices/0DEEXAMPLEDEVICEXXXXXXXXXXX" \
  -H "Authorization: Bearer $PB_TOKEN"

Response (200):

{
  "id": "0DEEXAMPLEDEVICEXXXXXXXXXXX",
  "externalId": "e3ad0cea-9dba-4d59-afd9-ae4e65b026ba",
  "status": "active",
  "hostname": "M-EXAMPLE01",
  "serialNumber": "C02EXAMPLE01",
  "osType": "macOS",
  "osVersion": "26.4.0",
  "deviceType": "laptop",
  "platform": "Desktop Browser",
  "screenLockStatus": "ScreenLockStatusEnabled",
  "diskEncryptionStatus": "DiskEncryptionStatusEnabled",
  "firewallStatus": "FireWallStatusEnabled",
  "diskEncryptionDetails": { "products": [ { "vendorName": "Apple Inc.", "productName": "FileVault" } ] },
  "browserVersion": "150.41.0.46",
  "ip": "203.0.113.10",
  "macAddresses": [ "22:fe:8a:2b:33:b1" ],
  "firstSeen": "2025-11-01T09:00:00Z",
  "lastSeen": "2026-01-15T10:00:00Z",
  "user": {
    "id": "0UREXAMPLEUSERXXXXXXXXXXXXX",
    "email": "alice@example.com",
    "name": "Alice Example"
    // ...
  }
  // ... firewallDetails, deviceEPP, and other posture fields
}

A missing ID returns 404.

Key fields​

FieldTypeNotes
idstringUnique identifier (0DE...).
statusenumactive, archived, or suspended.
hostnamestringDevice hostname.
serialNumberstringSerial number. This is what device groups pin.
osTypeenumwindows, macOS, linux, ios, android, unknown.
osVersionstringOS version.
deviceTypeenumdesktop, laptop, vm, smartphone, tablet, chromebook, unknown.
platformobjectDevice platform.
screenLockStatusenumScreenLockStatusUnknown / Disabled / Enabled.
diskEncryptionStatusenumDiskEncryptionStatusUnknown / Disabled / Enabled.
firewallStatusenumFireWallStatusUnknown / Disabled / Enabled.
deviceEPPobjectEndpoint protection posture.
crowdstrikeZTAobjectCrowdStrike Zero Trust Assessment posture.
browserVersionstringThe Prisma Browser version.
ipstringLast known IP (nullable).
macAddressesarrayMAC addresses.
userobjectThe embedded user associated with the device.
firstSeen / lastSeendate-timeObservation timestamps (read-only).

Mobile devices also report mobileVendor, mobileHardware, and mobileIsRooted.

Lifecycle actions​

These are direct actions: they act on the live device immediately, with no draft or publish, and return 200.

GoalEndpointEffect
Suspend the devicePOST /seb-api/v1/devices/suspendSuspends the device.
Resume the devicePOST /seb-api/v1/devices/resumeResumes a suspended device.
Archive the devicePOST /seb-api/v1/devices/archiveMoves the device to archived state.
Restore the devicePOST /seb-api/v1/devices/restoreRestores an archived device.
Remove permanentlyPOST /seb-api/v1/devices/deletePermanently deletes the device.
Invalidate sessionsPOST /seb-api/v1/devices/force-reauthForces re-authentication on the device.
curl -sS -X POST "$PB_API_BASE/devices/suspend" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "deviceIds": ["0DEEXAMPLEDEVICEXXXXXXXXXXX"] }'

Response (200):

{
  "suspendedDeviceIds": [ "0DEEXAMPLEDEVICEXXXXXXXXXXX" ],
  "message": "1 devices suspended successfully"
}

For the full lost/compromised-device walkthrough, see Quarantine a lost or compromised device.

caution

A suspended device must be resumed before it can be deleted, and delete is permanent.

Endpoint reference​

MethodPathPurpose
GET/devicesList devices (filter, paginate)
GET/devices/{id}Read one device
POST/devices/suspendSuspend devices (direct action)
POST/devices/resumeResume devices (direct action)
POST/devices/archiveArchive devices (direct action)
POST/devices/restoreRestore archived devices (direct action)
POST/devices/deletePermanently delete devices (direct action)
POST/devices/force-reauthForce re-authentication (direct action)

All paths are under the /seb-api/v1 base.

Tips and gotchas​

note

Filter by posture, then group by posture. Use the list filters above to find devices in a given posture (for example disk encryption disabled), then govern them with a posture-based device group. List filters are read-only diagnostics; device groups are what a rule references.

note

Reverse with the pair, not a rollback. Undo suspend with resume and archive with restore; there is no configuration version to revert because these actions bypass the draft.

Previous
Users
Next
Applications