API reference

Devices

Inventory, enrollment, policy, compliance, security state, connectivity and status of your managed Android, Apple (iOS, iPadOS, macOS, tvOS) and Windows devices.

Import the whole API:OpenAPI 3.1 Postman collection

A device is any phone, tablet, computer or other hardware managed in your WeGuard account. This includes devices whose enrollment is pending and devices that were unenrolled (see enrollment.status). Common attributes are normalized across platforms and always present. When a platform does not report one, its value is null. Platform-specific attributes are in details.

Windows Update compliance, hardware health and disk encryption are not part of the device object, so device lists stay fast. Call Retrieve a device’s status to read them for one device. The status also gives the battery as a percentage on every platform, while details.batteryLevel keeps the form each platform reports.

For the apps on a device, its past positions and how it is used, see Installed apps, Location history and Screen time and app usage.

The device object

AttributeDescription

id string: Unique device id.
object string: Always device.
platform string: Device platform. ios covers iPhone, iPad and iPod touch. Macs are macos and Apple TVs are tvos.
One ofandroidiosmacostvoswindows
name string: Display name of the device. WeGuard uses the first of these that is set: the name an admin assigned in the console, the name the device reports, its model (Android and Apple), or the device’s identifier. On Windows the order is the device name, the DNS computer name, then the device identifier.
model stringnullable: Model as reported by the device, for example SM-T505.
manufacturer stringnullable: Manufacturer as reported by the device, for example samsung. Always Apple for Apple devices.
osVersion stringnullable: Operating system version. On Windows it can lag behind an in-place upgrade. For the current Windows build, see updates.osBuild in the device status.
serialNumber stringnullable: Hardware serial number.
imei stringnullable: IMEI of devices with a cellular modem. Always null on Windows.
phoneNumber stringnullable: Phone number of the SIM, when known. On Windows, the number the device reads from its SIM, so null on devices without one.
agentVersion stringnullable: Version of the WeGuard agent on the device. Reported by Android and Windows devices. Always null on Apple devices.
policy objectnullable: The policy assigned to the device, or null if it has none. For the full policy, call Retrieve a policy.
policy.id string: Policy id.
policy.name stringnullable: Policy name.
enrollment object: Enrollment state of the device.
enrollment.status string: Enrollment status. pending means the device record exists but enrollment has not completed.
One ofenrolledpendingunenrolled
enrollment.enrolledAt timestampnullable: When the device enrolled. On Windows, when WeGuard created the device record, which is the date the console shows. null when unknown.
state object: Security-relevant flags.
state.lost boolean: true when lost or stolen mode is on. Always false on Windows, which has no lost mode.
state.compromised booleannullable: true when root or a jailbreak was detected on the device. null when the device has not reported it. Always null on Windows.
state.locked booleannullable: true when an admin locked the device. Android only. null on other platforms or when not reported.
compliance object: Result of the last compliance evaluation. Only Android devices are evaluated today.
compliance.policyCompliant booleannullable: true when the device complies with its policy. null when not evaluated.
compliance.appsCompliant booleannullable: true when all apps required by the policy are installed. null when not evaluated.
tags object: Values of the console tag slots tag1 to tag9, for example {"tag1": "Dock 4"}. Empty slots are omitted, so the object can be empty. For the name your account gave each slot, such as "Region" for tag6, read tagLabels on the account.
lastSeenAt timestampnullable: When the device last contacted WeGuard, on any channel. On Windows that is the agent’s sync (about once a minute), an MDM session, a health or location report, or an answer to a check from the console. The value does not tell these apart. null when the device has never checked in.
connectivity object: Whether the device checked in recently. WeGuard works it out from lastSeenAt when it builds the response, with the same rule on every platform.
connectivity.status string: online when lastSeenAt is at most thresholdMinutes old, offline when it is older, and unknown when the device has never checked in (lastSeenAt is null). A lastSeenAt in the future, caused by clock skew, counts as online.
One ofonlineofflineunknown
connectivity.thresholdMinutes integer: Minutes after lastSeenAt at which the device counts as offline. Currently 1440 (24 hours). Read it from the response instead of hard-coding it.
createdAt timestamp: When the device record was created.
details object: Platform-specific attributes. The keys depend on platform. Values are strings, numbers, booleans or null, never nested objects. See Android, Apple and Windows details.

Example

{
  "id": "6523f1c2a7b9d40012345678",
  "object": "device",
  "platform": "android",
  "name": "Warehouse Scanner 12",
  "model": "SM-T505",
  "manufacturer": "samsung",
  "osVersion": "13",
  "serialNumber": "R9JN30ABCDE",
  "imei": "356938035643809",
  "phoneNumber": null,
  "agentVersion": "6.4.2",
  "policy": {
    "id": "64ff0a1b2c3d4e5f60718293",
    "name": "Kiosk: Scanners"
  },
  "enrollment": {
    "status": "enrolled",
    "enrolledAt": "2026-03-14T08:12:44Z"
  },
  "state": {
    "lost": false,
    "compromised": false,
    "locked": false
  },
  "compliance": {
    "policyCompliant": true,
    "appsCompliant": false
  },
  "tags": {
    "tag1": "Dock 4",
    "tag3": "Night shift"
  },
  "lastSeenAt": "2026-10-07T09:29:51Z",
  "connectivity": {
    "status": "online",
    "thresholdMinutes": 1440
  },
  "createdAt": "2026-03-14T08:10:02Z",
  "details": {
    "deviceIdType": "IMEI",
    "suspended": false,
    "wiped": false,
    "enterpriseEnrolled": true,
    "appliedPolicyVersion": 42,
    "mobileDataUsageBytes": 1288490188,
    "wifiDataUsageBytes": 9663676416,
    "batteryLevel": 87
  }
}

Android details

details when platform is android.

AttributeDescription

deviceIdType stringnullable: Kind of hardware identifier the agent reported as the device id.
suspended boolean: true when the device is suspended.
wiped boolean: true when the device has been wiped.
enterpriseEnrolled boolean: true when the device is enrolled with Android Enterprise.
appliedPolicyVersion integernullable: Version of the policy last applied on the device.
mobileDataUsageBytes integernullable: Mobile data used, in bytes, as reported by the agent.
wifiDataUsageBytes integernullable: Wi-Fi data used, in bytes, as reported by the agent.
batteryLevel integernullable: Battery level in percent, exactly as the agent reports it. Not range-checked. The device status battery leaves out a value outside 0 to 100.

Apple details

details when platform is ios, macos or tvos. Capacity and battery values are strings exactly as reported by the device.

AttributeDescription

udid stringnullable: Apple unique device identifier.
supervised boolean: true when the device is supervised.
modelName stringnullable: Model name, for example iPad.
productName stringnullable: Product identifier, for example iPad13,18.
buildVersion stringnullable: OS build number.
deviceCapacity stringnullable: Total storage capacity as reported by the device.
availableDeviceCapacity stringnullable: Available storage as reported by the device.
batteryLevel stringnullable: Battery level as the device reports it: a fraction from 0 to 1, as a string, for example "0.85". The device status battery.level gives it as a percentage.
wifiMac stringnullable: Wi-Fi MAC address.
bluetoothMac stringnullable: Bluetooth MAC address.
iccid stringnullable: ICCID of the SIM card.
carrier stringnullable: Current carrier network.
roaming boolean: true when the device is roaming.
deviceFamily stringnullable: Device family, for example iPad.

details (ios)

{
  "details": {
    "udid": "00008103-001A2B3C4D5E6F70",
    "supervised": true,
    "modelName": "iPad",
    "productName": "iPad13,18",
    "buildVersion": "22A3354",
    "deviceCapacity": "64.0",
    "availableDeviceCapacity": "41.7",
    "batteryLevel": "0.85",
    "wifiMac": "a4:83:e7:12:34:56",
    "bluetoothMac": "a4:83:e7:12:34:57",
    "iccid": null,
    "carrier": null,
    "roaming": false,
    "deviceFamily": "iPad"
  }
}

Windows details

details when platform is windows. Inventory values such as storage and memory are strings, exactly as the device reports them.

AttributeDescription

deviceId stringnullable: Windows device identifier the device registered with WeGuard.
hardwareDeviceId stringnullable: Hardware identifier the device reports.
osEdition stringnullable: Windows edition, as the numeric edition id the device reports, for example 48 (Pro), 4 (Enterprise), 121 (Education) or 101 (Home).
dnsComputerName stringnullable: DNS computer name.
processorArchitecture stringnullable: Processor architecture as the device reports it, usually the numeric Windows value: 9 (x64), 12 (ARM64) or 0 (x86). Devices managed only through the WeGuard agent do not report it.
totalStorage stringnullable: Size of the first internal drive in mebibytes (MiB), as a decimal string, for example "242935" (about 237 GiB). For every drive and its free space in bytes, see device status.
totalRam stringnullable: Installed memory in mebibytes (MiB), as a decimal string, for example "16384" (16 GiB).
wlanMacAddress stringnullable: Wireless LAN MAC address, for example 3C-22-FB-12-34-56.
wlanIpv4Address stringnullable: Wireless LAN IPv4 address.
weshieldInstalled boolean: true when WeShield is installed.
weshieldVersion stringnullable: Installed WeShield version.
wesupportVersion stringnullable: Installed WeSupport version.
weguardRmmVersion stringnullable: Installed WeGuard RMM version.
batteryLevel integernullable: Battery charge in percent, from 0 to 100. null when the device has not reported a level or has no battery. Desktops and virtual machines report no battery.
batteryCharging booleannullable: true when the device is on external power, whether or not the battery is still charging. null when batteryLevel is null.
batteryReportedAt timestampnullable: When the device last reported its battery level. null when batteryLevel is null.
managementMode stringnullable: How WeGuard manages the device. mdm: through Windows MDM (OMA-DM). Devices enrolled before agent mode existed are all mdm. agent: only through the WeGuard agent, for example on Windows Home. null when the device record is incomplete.
One ofmdmagent
enrollmentType stringnullable: How the device enrolled. enrollment_code: from Windows Settings with a WeGuard enrollment code address. entra_id: through Microsoft Entra ID, including Entra join and Windows Autopilot. provisioning_package: bulk enrollment with a provisioning package. agent: registered by the WeGuard agent without MDM. WeGuard records the value at enrollment. For devices that enrolled before WeGuard recorded it, the value was filled in later from other enrollment data and can be wrong. null when no value was recorded.
One ofenrollment_codeentra_idprovisioning_packageagent
lastMdmSessionAt timestampnullable: When the device last had an MDM session with WeGuard. For agent devices, when the agent last checked for commands.
kioskStatus stringnullable: Where kiosk delivery stands. It describes what WeGuard sent, not what the device did. none: WeGuard currently sends no kiosk configuration. The policy has no kiosk, the kiosk is paused or was removed, WeGuard cannot build one for the device yet, or a configuration waits to be sent again. sent: WeGuard queued or delivered a kiosk configuration and the device has not rejected it. This does not confirm that the device applied it: an offline device reads sent too, and while the agent removes an agent-enforced kiosk, the value stays sent until the agent reports the removal done. rejected: the device rejected the current configuration 3 times in a row, and WeGuard stopped sending it until the kiosk policy changes. null when the device record is incomplete.
One ofnonesentrejected
kioskPaused booleannullable: true while kiosk maintenance mode is on: the kiosk is taken down on the device while the policy keeps it. false when never set. null when the device record is incomplete.
kioskLastVerifiedAt timestampnullable: When the device last confirmed that it holds a kiosk configuration: a read-back that matched what WeGuard sent (MDM-enforced kiosks) or the agent’s completion report (agent-enforced kiosks). WeGuard does not reset it when it sends a new configuration or removes the kiosk, so it can belong to an earlier configuration. null when the device has never confirmed one.

details (windows)

{
  "details": {
    "deviceId": "A4C123B1612DD272D1371C17149D4395",
    "hardwareDeviceId": "36B3216FDAEEB975729FAE923D5A4FD12AABFE228F219E9CB0EB53F16947CCF2",
    "osEdition": "48",
    "dnsComputerName": "FRONTDESK-07",
    "processorArchitecture": "9",
    "totalStorage": "242935",
    "totalRam": "24576",
    "wlanMacAddress": "3C-22-FB-12-34-56",
    "wlanIpv4Address": "10.20.4.117",
    "weshieldInstalled": true,
    "weshieldVersion": "2.3.1",
    "wesupportVersion": "1.8.0",
    "weguardRmmVersion": "1.2.4",
    "batteryLevel": 87,
    "batteryCharging": true,
    "batteryReportedAt": "2026-10-07T09:29:51Z",
    "managementMode": "mdm",
    "enrollmentType": "entra_id",
    "lastMdmSessionAt": "2026-10-07T09:12:30Z",
    "kioskStatus": "none",
    "kioskPaused": false,
    "kioskLastVerifiedAt": null
  }
}

The device status object

Operational status of one device. Sections the platform does not report are null. Today updates, hardware, encryption and secureBoot are reported by Windows devices only. Antivirus, firewall and lock state are not reported.

AttributeDescription

object string: Always device_status.
deviceId string: Id of the device.
platform string: Platform of the device.
One ofandroidiosmacostvoswindows
lastSeenAt timestampnullable: When the device last contacted WeGuard. Always the same value as lastSeenAt on the device object.
connectivity object: Whether the device checked in recently. WeGuard works it out from lastSeenAt when it builds the response, with the same rule on every platform. Always the same value as connectivity on the device object.
connectivity.status string: online when lastSeenAt is at most thresholdMinutes old, offline when it is older, and unknown when the device has never checked in (lastSeenAt is null). A lastSeenAt in the future, caused by clock skew, counts as online.
One ofonlineofflineunknown
connectivity.thresholdMinutes integer: Minutes after lastSeenAt at which the device counts as offline. Currently 1440 (24 hours). Read it from the response instead of hard-coding it.
battery objectnullable: The device’s last battery report. null when the device has not reported a level or has no battery, such as a Windows desktop or virtual machine. On Windows it matches batteryLevel, batteryCharging and batteryReportedAt in Windows details. On Apple devices, details.batteryLevel stays the fraction the device reports, such as "0.56", while level is the percentage, 56. On Android, details.batteryLevel is passed through as reported, while battery is null for a value outside 0 to 100.
battery.level integer: Charge in percent, from 0 to 100.
battery.charging booleannullable: true when the device is on external power, whether or not the battery is still charging. Windows only. null on other platforms.
battery.reportedAt timestampnullable: When WeGuard last received the level. null on Apple devices, which do not record it.
updates objectnullable: Windows Update compliance, as computed by WeGuard patch management. null unless patch management has produced data for the device, which needs patch management turned on for both the account and the device’s policy. If the account later turns patch management off, the data stays available with the state last computed.
updates.complianceState string: stale: the last scan is 7 or more days old. WeGuard checks this when it builds the response, whatever state it stored. unknown: the device has not scanned yet, or its last scan failed. non_compliant: a critical or important update that is missing or failed was released more than the account’s service level ago (14 days unless configured), or a restart has been pending for 7 or more days. For an update without a release date, WeGuard counts from when it first detected the update. compliant: none of the above. Apart from stale, this is the state WeGuard last computed: on every scan the device uploads, and every hour while the account has patch management on.
One ofcompliantnon_compliantstaleunknown
updates.missingCriticalCount integer: Applicable critical updates that are not installed.
updates.missingImportantCount integer: Applicable important updates that are not installed.
updates.missingOtherCount integer: Other applicable updates that are not installed.
updates.failedCount integer: Updates whose installation failed.
updates.pendingRebootCount integer: Installed updates that wait for a restart.
updates.pendingRebootSince timestampnullable: Since when a restart has been pending. null when none is.
updates.lastScanAt timestampnullable: When the device last scanned for updates.
updates.osBuild stringnullable: Windows build and update revision from the last scan, for example 26200.9445. The agent scans about every 22 hours, so this is usually more current than osVersion on the device object.
updates.osDisplayVersion stringnullable: Windows feature release from the last scan, for example 25H2.
hardware objectnullable: The newest hardware health sample, as the device reported it. WeGuard does not verify these values. The WeGuard agent takes a sample every 15 minutes by default while the device’s policy has health checks turned on. null when the device sent no sample in the last 60 days, which is how long samples are kept.
hardware.sampledAt timestamp: When the device took the sample, by the device’s own clock. WeGuard ignores samples dated more than 5 minutes ahead of its own clock.
hardware.cpuUtilizationPercent numbernullable: Total CPU use in percent, from 0 to 100.
hardware.memory object: Physical memory. The device reports it in steps of 0.1 GiB, which WeGuard converts to bytes.
hardware.memory.totalBytes integernullable: Installed memory, in bytes.
hardware.memory.availableBytes integernullable: Memory available for use, in bytes.
hardware.drives array of objects: Volumes with a drive letter, in the order the device reported them. The device reports sizes in whole GiB, rounded down, which WeGuard converts to bytes.
hardware.drives.name string: Drive letter, for example C:.
hardware.drives.type stringnullable: Kind of volume. null when the device reported no type it could classify.
One offixedremovablenetworkoptical
hardware.drives.totalBytes integernullable: Size of the volume, in bytes.
hardware.drives.freeBytes integernullable: Free space, in bytes. A removable drive without media reports 0.
encryption objectnullable: BitLocker and TPM state as the WeGuard agent last reported it. WeGuard does not verify these values. The agent reports them only for devices whose policy configures BitLocker. null when the agent has never reported them. Recovery keys and key protectors are never returned.
encryption.reportedAt timestamp: When the device last reported a change. The agent reports on change and after each restart, so this time does not tell you how current the data is. WeGuard ignores reports dated more than 5 minutes in the future.
encryption.drives array of objects: BitLocker state of each volume. A value the device did not report, or that WeGuard does not recognize, reads unknown.
encryption.drives.mountPoint string: Drive letter, for example C:.
encryption.drives.protectionStatus string: Whether BitLocker protection is on.
One ofonoffunknown
encryption.drives.encryptionStatus string: Encryption state of the volume.
One offully_decryptedfully_encryptedencryption_in_progressdecryption_in_progressencryption_pauseddecryption_pausedunknown
encryption.drives.encryptionPercentage integernullable: Share of the volume that is encrypted, in percent. null when the device did not report it.
encryption.drives.lockStatus string: Whether the volume is locked.
One oflockedunlockedunknown
encryption.tpm objectnullable: The Trusted Platform Module. null when the report included no TPM data.
encryption.tpm.present boolean: false when the agent found no TPM. The other members are then null.
encryption.tpm.enabled booleannullable: Whether the TPM is enabled.
encryption.tpm.activated booleannullable: Whether the TPM is activated.
encryption.tpm.specVersion stringnullable: Version of the TPM specification the chip implements, for example 2.0 or 1.2.
secureBoot booleannullable: true when UEFI Secure Boot is on. Only Windows 10 devices that run the WeGuard agent with patch management on report it, as part of the Windows 11 readiness check. null otherwise.

The device location object

The last location a device reported, in WGS 84 decimal degrees.

AttributeDescription

object string: Always device_location.
deviceId string: Id of the device.
latitude number: Latitude in decimal degrees.
longitude number: Longitude in decimal degrees.
accuracyMeters numbernullable: Horizontal accuracy radius in meters. Reported by Apple devices. null on Android and Windows, or when not reported.
recordedAt timestampnullable: When the device captured the location.

Example

{
  "object": "device_location",
  "deviceId": "6523f1c2a7b9d40012345679",
  "latitude": 17.4474,
  "longitude": 78.3762,
  "accuracyMeters": 12.5,
  "recordedAt": "2026-10-07T09:20:00Z"
}

List devices

GET/v1/devices

Requiresdevices:read

Returns the devices in your account, ordered by id (creation order), as a paginated list.

Query parameters

ParameterDescription

platform stringoptionaldefault all platforms: Only return items for these platforms. Pass a comma-separated list, for example android,ios. Values are case-insensitive. ios covers iPhone, iPad and iPod touch.
One or more ofandroidiosmacostvoswindows
policyId stringoptional: Only return devices assigned to this policy. Case-insensitive. A well-formed id that matches no policy returns an empty list.
limit integeroptionaldefault 25: Maximum number of items to return, from 1 to 100.
cursor stringoptional: The nextCursor from the previous page. Send it unchanged, together with the same filters. See Pagination.
includeTotal booleanoptionaldefault false: Set to true to also return totalCount. It runs an extra count, so request it only when you need it.

Example request

curl "https://api-gw.weguard.ai/core/v1/devices?platform=android&limit=1" \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/devices?platform=android&limit=1", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/devices",
    params={"platform": "android", "limit": 1},
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

A list object whose data holds device objects.

200 OK

{
  "object": "list",
  "data": [
    {
      "id": "6523f1c2a7b9d40012345678",
      "object": "device",
      "platform": "android",
      "name": "Warehouse Scanner 12",
      "model": "SM-T505",
      "manufacturer": "samsung",
      "osVersion": "13",
      "serialNumber": "R9JN30ABCDE",
      "imei": "356938035643809",
      "phoneNumber": null,
      "agentVersion": "6.4.2",
      "policy": {
        "id": "64ff0a1b2c3d4e5f60718293",
        "name": "Kiosk: Scanners"
      },
      "enrollment": {
        "status": "enrolled",
        "enrolledAt": "2026-03-14T08:12:44Z"
      },
      "state": {
        "lost": false,
        "compromised": false,
        "locked": false
      },
      "compliance": {
        "policyCompliant": true,
        "appsCompliant": false
      },
      "tags": {
        "tag1": "Dock 4",
        "tag3": "Night shift"
      },
      "lastSeenAt": "2026-10-07T09:29:51Z",
      "connectivity": {
        "status": "online",
        "thresholdMinutes": 1440
      },
      "createdAt": "2026-03-14T08:10:02Z",
      "details": {
        "deviceIdType": "IMEI",
        "suspended": false,
        "wiped": false,
        "enterpriseEnrolled": true,
        "appliedPolicyVersion": 42,
        "mobileDataUsageBytes": 1288490188,
        "wifiDataUsageBytes": 9663676416,
        "batteryLevel": 87
      }
    }
  ],
  "hasMore": true,
  "nextCursor": "YzE6NjUyM2YxYzJhN2I5ZDQwMDEyMzQ1Njc4"
}

Errors

400invalid_parameter
platform has an unsupported value, policyId is malformed, limit or includeTotal is invalid, or a parameter was sent twice.
400unknown_parameter
The request includes a query parameter this endpoint does not accept.
400invalid_cursor
The cursor is malformed or was issued for different filters.
403insufficient_scope
The key lacks devices:read.

Retrieve a device

GET/v1/devices/{deviceId}

Requiresdevices:read

Returns a single device by id.

Path parameters

ParameterDescription

deviceId stringrequired: Id of the device. Case-insensitive.

Example request

curl https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678 \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678",
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

Returns a device object.

200 OK

{
  "id": "6523f1c2a7b9d40012345678",
  "object": "device",
  "platform": "android",
  "name": "Warehouse Scanner 12",
  "model": "SM-T505",
  "manufacturer": "samsung",
  "osVersion": "13",
  "serialNumber": "R9JN30ABCDE",
  "imei": "356938035643809",
  "phoneNumber": null,
  "agentVersion": "6.4.2",
  "policy": {
    "id": "64ff0a1b2c3d4e5f60718293",
    "name": "Kiosk: Scanners"
  },
  "enrollment": {
    "status": "enrolled",
    "enrolledAt": "2026-03-14T08:12:44Z"
  },
  "state": {
    "lost": false,
    "compromised": false,
    "locked": false
  },
  "compliance": {
    "policyCompliant": true,
    "appsCompliant": false
  },
  "tags": {
    "tag1": "Dock 4",
    "tag3": "Night shift"
  },
  "lastSeenAt": "2026-10-07T09:29:51Z",
  "connectivity": {
    "status": "online",
    "thresholdMinutes": 1440
  },
  "createdAt": "2026-03-14T08:10:02Z",
  "details": {
    "deviceIdType": "IMEI",
    "suspended": false,
    "wiped": false,
    "enterpriseEnrolled": true,
    "appliedPolicyVersion": 42,
    "mobileDataUsageBytes": 1288490188,
    "wifiDataUsageBytes": 9663676416,
    "batteryLevel": 87
  }
}

Errors

404resource_not_found
No device with this id exists in your account.
400unknown_parameter
The request includes a query parameter. This endpoint takes none.
403insufficient_scope
The key lacks devices:read.

Retrieve a device’s status

GET/v1/devices/{deviceId}/status

Requiresdevices:read

Returns the operational status of a device: connectivity and battery, and for Windows devices also Windows Update compliance, the latest hardware health sample, BitLocker and TPM state, and Secure Boot. The API reads what WeGuard has stored and does not contact the device.

The hardware and encryption sections are reported by the device and not verified by WeGuard. Use them for inventory and monitoring, not as proof of compliance.

Path parameters

ParameterDescription

deviceId stringrequired: Id of the device. Case-insensitive.

Example request

curl https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d4001234567a/status \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d4001234567a/status", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d4001234567a/status",
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

Returns a device status object.

200 OK

{
  "object": "device_status",
  "deviceId": "6523f1c2a7b9d4001234567a",
  "platform": "windows",
  "lastSeenAt": "2026-10-07T09:29:51Z",
  "connectivity": {
    "status": "online",
    "thresholdMinutes": 1440
  },
  "battery": {
    "level": 87,
    "charging": true,
    "reportedAt": "2026-10-07T09:29:51Z"
  },
  "updates": {
    "complianceState": "non_compliant",
    "missingCriticalCount": 1,
    "missingImportantCount": 0,
    "missingOtherCount": 3,
    "failedCount": 0,
    "pendingRebootCount": 1,
    "pendingRebootSince": "2026-09-28T06:10:00Z",
    "lastScanAt": "2026-10-07T03:12:44Z",
    "osBuild": "26200.9445",
    "osDisplayVersion": "25H2"
  },
  "hardware": {
    "sampledAt": "2026-10-07T09:15:00Z",
    "cpuUtilizationPercent": 7,
    "memory": {
      "totalBytes": 25555055411,
      "availableBytes": 18253611008
    },
    "drives": [
      {
        "name": "C:",
        "type": "fixed",
        "totalBytes": 254476812288,
        "freeBytes": 179314884608
      },
      {
        "name": "F:",
        "type": "removable",
        "totalBytes": 61203283968,
        "freeBytes": 0
      }
    ]
  },
  "encryption": {
    "reportedAt": "2026-10-01T08:15:00Z",
    "drives": [
      {
        "mountPoint": "C:",
        "protectionStatus": "on",
        "encryptionStatus": "fully_encrypted",
        "encryptionPercentage": 100,
        "lockStatus": "unlocked"
      }
    ],
    "tpm": {
      "present": true,
      "enabled": true,
      "activated": true,
      "specVersion": "2.0"
    }
  },
  "secureBoot": null
}

Errors

404resource_not_found
No device with this id exists in your account.
400unknown_parameter
The request includes a query parameter. This endpoint takes none.
403insufficient_scope
The key lacks devices:read.

Retrieve a device’s location

GET/v1/devices/{deviceId}/location

Requireslocations:read

Returns the last location the device reported. The API reads the stored location and does not ask the device for a new fix. Only locations:read is required. For earlier positions, use location history.

Locations are personal data about the people who use your devices. Grant locations:read only to integrations that need it, and handle the data according to your privacy obligations.

Path parameters

ParameterDescription

deviceId stringrequired: Id of the device. Case-insensitive.

Example request

curl https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345679/location \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345679/location", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345679/location",
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

Returns a device location object.

200 OK

{
  "object": "device_location",
  "deviceId": "6523f1c2a7b9d40012345679",
  "latitude": 17.4474,
  "longitude": 78.3762,
  "accuracyMeters": 12.5,
  "recordedAt": "2026-10-07T09:20:00Z"
}

Errors

404resource_not_found
No device with this id exists in your account.
404location_unavailable
The device has never reported a valid location.
400unknown_parameter
The request includes a query parameter. This endpoint takes none.
403insufficient_scope
The key lacks locations:read.

Common errors

Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.

401missing_credentials
The request has no Authorization header.
401invalid_authorization_header
The Authorization header does not use the Bearer scheme, or has no key after it. The WWW-Authenticate header carries error="invalid_request".
401invalid_api_key
The key is malformed, does not exist, or its secret does not match. The WWW-Authenticate header carries error="invalid_token".
401api_key_expired
The key is past its expiresAt.
401api_key_revoked
An account admin revoked the key. Revocation takes effect immediately and cannot be undone.
403account_inactive
The WeGuard account that owns the key has been deleted or disabled.
406not_acceptable
The Accept header excludes JSON.
429rate_limit_exceeded
The key has used up its request budget. See Rate limits.
500internal_error
An unexpected error occurred on our side.
503service_unavailable
A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries Retry-After.

The device object

Android details

Apple details

Windows details

The device status object

The device location object

List devices

Query parameters

Example request

Response

Errors

Retrieve a device

Path parameters

Example request

Response

Errors

Retrieve a device’s status

Path parameters

Example request

Response

Errors

Retrieve a device’s location

Path parameters

Example request

Response

Errors

Common errors

We use cookies