API reference

Account

Your WeGuard account: plan, license usage, enabled platforms and the labels of the device tag slots.

Import the whole API:OpenAPI 3.1 Postman collection

Every API key belongs to exactly one account, so this endpoint always returns the account that owns the calling key. If you only need to know which account a key belongs to, call GET /v1/me. It needs no scope.

The account object

AttributeDescription

id string: Account id.
object string: Always account.
name stringnullable: Company name of the account.
state stringnullable: Subscription state. null for internal test accounts and states not listed here.
One oflivetrialdemo
plan stringnullable: Name of the feature plan as shown in the console, for example Enterprise. This is free text, not a fixed set. null if no plan is assigned.
licenses object: License usage.
licenses.purchased integernullable: Number of device licenses purchased. null when no purchased count is recorded for the account.
licenses.provisionedDevices integernullable: Number of enrolled devices. This counter is refreshed periodically, so it is not a live count.
licenses.unprovisionedDevices integernullable: Number of device records created but not yet enrolled. This counter is refreshed periodically, so it is not a live count.
licenseValidFrom timestampnullable: Start of the license period.
licenseValidUntil timestampnullable: End of the license period.
trialEndsAt timestampnullable: End of the trial period. null unless state is trial.
platforms array of strings: Device platforms enabled for the account. ios means Apple device management is enabled, which also covers Macs (macos) and Apple TVs (tvos).
Each item is one ofandroidiosmacostvoswindows
mfaRequired boolean: true when multi-factor sign-in is enforced for the account’s console users.
tagLabels object: The names the account gave its device tag slots in the console, for example {"tag6": "Region"}. Use them to label the values in a device’s tags. Admins can label slots tag6 to tag9 in the console. Slots without a label, or still showing the console’s “Tag N” placeholder, are omitted, so the object can be empty.
createdAt timestamp: When the account was created.

Example

{
  "id": "5f1d7c0e9b1e8a3f2c4d6e8a",
  "object": "account",
  "name": "Acme Logistics",
  "state": "live",
  "plan": "Enterprise",
  "licenses": {
    "purchased": 500,
    "provisionedDevices": 312,
    "unprovisionedDevices": 14
  },
  "licenseValidFrom": "2026-01-01T00:00:00Z",
  "licenseValidUntil": "2026-12-31T23:59:59Z",
  "trialEndsAt": null,
  "platforms": [
    "android",
    "ios",
    "windows"
  ],
  "mfaRequired": true,
  "tagLabels": {
    "tag6": "Region",
    "tag7": "Cost centre"
  },
  "createdAt": "2024-05-02T10:11:12Z"
}

Retrieve the account

GET/v1/account

Requiresaccount:read

Returns the account that owns the API key. This endpoint takes no parameters.

Example request

curl https://api-gw.weguard.ai/core/v1/account \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/account", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/account",
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

Returns an account object.

200 OK

{
  "id": "5f1d7c0e9b1e8a3f2c4d6e8a",
  "object": "account",
  "name": "Acme Logistics",
  "state": "live",
  "plan": "Enterprise",
  "licenses": {
    "purchased": 500,
    "provisionedDevices": 312,
    "unprovisionedDevices": 14
  },
  "licenseValidFrom": "2026-01-01T00:00:00Z",
  "licenseValidUntil": "2026-12-31T23:59:59Z",
  "trialEndsAt": null,
  "platforms": [
    "android",
    "ios",
    "windows"
  ],
  "mfaRequired": true,
  "tagLabels": {
    "tag6": "Region",
    "tag7": "Cost centre"
  },
  "createdAt": "2024-05-02T10:11:12Z"
}

Errors

400unknown_parameter
The request includes a query parameter. This endpoint takes none.
403insufficient_scope
The key lacks account:read.

Common errors

Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.

401missing_credentials
The request has no Authorization header.
401invalid_authorization_header
The Authorization header does not use the Bearer scheme, or has no key after it. The WWW-Authenticate header carries error="invalid_request".
401invalid_api_key
The key is malformed, does not exist, or its secret does not match. The WWW-Authenticate header carries error="invalid_token".
401api_key_expired
The key is past its expiresAt.
401api_key_revoked
An account admin revoked the key. Revocation takes effect immediately and cannot be undone.
403account_inactive
The WeGuard account that owns the key has been deleted or disabled.
406not_acceptable
The Accept header excludes JSON.
429rate_limit_exceeded
The key has used up its request budget. See Rate limits.
500internal_error
An unexpected error occurred on our side.
503service_unavailable
A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries Retry-After.