Updated Documentation: all ‘/subscriptions’ endpoints combined to a single List Subscriptions endpoint with filter parameters


We’ve updated the documentation presentation for the following Commercial API endpoints to align with OpenAPI 3 specification requirements:

• Get subscription by buyer assigned account id
• Get subscription by reseller account id

Both endpoints share the same base URL but differ only by query parameters.
To comply with OpenAPI 3 YAML standards, they are now documented as a single endpoint:
List Subscriptions.

What changed:

• The above endpoints are now combined under List Subscriptions in the documentation
• Query parameters (buyer_assigned_account_id, reseller_account_id) are available as filters within the same endpoint
• Documentation structure updated to meet OpenAPI 3 requirements and improve compatibility with API tools

What did NOT change:

• No changes to endpoint logic or behavior
• No changes to request/response formats
• Existing integrations using:
  • GET /subscriptions?buyer_assigned_account_id={buyer_assigned_account_id}
  • GET /subscriptions?reseller_account_id={reseller_account_id}
    
    continue to work exactly as before

This update is documentation-only and ensures consistent representation of the API without impacting functionality.

We’ve introduced a new endpoint to manage licensee positioning within the Elements Security Center hierarchy:

Change Elements Security Center Hierarchy

POST /hierarchy?buyer_assigned_account_id={buyer_assigned_account_id}

This endpoint is available for Direct Resellers only and allows you to update how a licensee is organized within the hierarchy by assigning it under a specific SEP or SOP in the Elements Security Center only.

Key capabilities:

• Assign a licensee to a specific SEP (if currently under an SOP)
• Assign a licensee to a specific SOP (if currently under an SEP belonging to that SOP)
• Update hierarchy structure without impacting commercial or contractual relationships

Important notes:

• Changes are restricted within the same buyer party
• Cannot be used to move a licensee to another reseller
• SEP and SOP entities must already exist (no creation supported)
• This operation only affects hierarchy structure and display in Elements Security Center and can not be used to move licensee under the new reseller

For full request/response details, refer to the API documentation.

The descriptions for the Create New Subscription and Change Subscription API endpoints were updated to better reflect their purpose and supported operations. No changes were made to request or response parameters.

Documentation-Only Updates to Endpoint Descriptions:

Create New Subscription:

Provision a new Total Volume subscription for a new or existing licensee. This endpoint may also be used to grant access to an admin user in the Elements Security Center or to change the licensee (company) name. Granting access and changing the name can only be completed as part of a subscription creation request.

Change Subscription:

Make changes to an existing Total Volume subscription. This endpoint may also be used to grant access to an admin user in the Elements Security Center as part of a subscription change request.

The latest Elements API release brings new device operations for helping in categorization of devices.

The following new device operations are now supported:

• Set a custom alias name for a device. This allows you to assign a human-readable name to a device for easier identification
• Set the importance level of devices. This helps prioritize devices based on their criticality to your organization
• Set business context information for a device. This allows you to associate devices with specific business units, departments, or purposes to help with organization and reporting
• Set device labels. This allows to you to caregorize devices with custom labels

See the full Element API specification from here.

The latest Elements API release brings new (WithSecure) Product Security Events.

The following new events are now supported:

• Product has been uninstalled successfully
• Product uninstallation has been canceled
• Product uninstallation has failed due to incorrect uninstallation password
• Product uninstallation has failed due to unknown reason
• Product uninstallation is not allowed

More information with examples is available in the Security Events reference page.

Release Update: New API Endpoints for Managing Elements API Credentials

We’ve introduced new endpoints to automate the management of API keys for the Elements API:

1. Create API Key
POST /api-keys/v1/create

• Generate a new API key for accessing the Elements API.
• Keys can be created at the organisation or Service Organisation Partner (SOP) level.
• By default, keys are read-only for security. Optionally, set readOnly to false for write access.
• Important: clientSecret is returned only once during creation—store it securely.

2. Delete API Key
DELETE /api-keys/v1/api-keys/{clientId}

• Permanently remove an API key by its ID.
• Deleted keys cannot be recovered or used for authentication.

3. List API Keys
GET /api-keys/v1/api-keys

• Retrieve all API keys for the current organisation or specify an organizationId when querying from SOP level.

For full details, including request/response formats and examples, refer to the API documentation.

Elements Connector

A new release of Elements Connector 25.44 for both Windows and Linux is now available. This release includes the following changes:

Event forwarding:

• Language option for forwarded events
  A new setting in the Elements Connector profile allows localization of forwarded event messages.
• Support for Exposure Management (XM) events
  XM events are now supported, enhancing visibility into exposure-related data.

Vulnerability fixes:

• Java 17 update to (17.0.15 → 17.0.17)
  Addressed vulnerabilities: CVE-2025-53066, CVE-2025-53057.
• Spring Framework 6.2 update (6.2.3 → 6.2.11)
  Addressed vulnerabilities: CVE-2025-41248, CVE-2025-41249.

Other fixes and improvements

• Early-access group support
  Elements Connector now correctly supports early-access group updates, aligning behavior with public channel versions.
• Linux uninstallation Fix
  Fixed an issue where the update service was not properly removed during uninstallation on Linux systems

Release schedule:

• First-Time Installers: Available on our Software download page today, November 4th 2025.
• Automatic Channel Upgrade: Scheduled for Wednesday, November 5th 2025.

New response actions to enable new workflows

We’ve added new response action endpoints under POST /response-actions/v1/execute/<name> to expand remote execution capabilities for both device and identity management.

This allows you to automate new workflows that involve acting on the target devices and identities.

This release increases the number of API supported response actions from 8 to 32.

Device response actions

The following device response actions are available:

• Create full memory dump – Uploads a full memory dump from the device
• Delete registry key or value – Deletes a specified Windows registry key or value
• Delete scheduled task – Deletes a specified Windows scheduled task
• Delete Windows service – Deletes a specified Windows service
• Delete WMI persistence objects – Deletes Windows Management Instrumentation (WMI) persistence objects
• Enumerate running processes – Enumerates running processes on the device
• Enumerate WMI persistence mechanisms – Enumerates WMI persistence mechanisms, including event consumers, filters, and bindings
• List file system structure – Lists the file system structure based on path matching patterns
• List registry keys and values – Lists Windows registry keys and values based on path matching patterns
• List scheduled tasks – Lists all Windows scheduled tasks on the device
• Retrieve amcache files – Retrieves the application compatibility cache file from the device
• Retrieve antivirus logs – Retrieves antivirus software log files for security analysis
• Retrieve browser artifacts – Retrieves the browser history from the device
• Retrieve event log tracing files – Retrieves .etl event log tracing files with records of system activities
• Retrieve files from device – Retrieves files from the device based on path matching patterns
• Retrieve jump list files – Retrieves jump lists stored in the AutomaticDestinations and CustomDestinations subfolders
• Retrieve master boot record – Retrieves the master boot record (MBR) from a specified drive
• Retrieve master file table – Retrieves the master file table (MFT) from a specified drive
• Retrieve network connections – Retrieves network connections, routing tables, interface statistics, and related process information
• Retrieve prefetch files – Retrieves Windows prefetch files with evidence of program execution
• Retrieve process memory dump – Retrieves a memory dump of a specific process
• Retrieve RDP cache files – Retrieves remote desktop protocol (RDP) bitmap cache files
• Retrieve recently accessed files – Retrieves information about recently accessed files and folders from user activity artefacts
• Retrieve registry hive files – Retrieves Windows registry hive files
• Retrieve SRUM database – Retrieves the system resource usage monitor (SRUM) database
• Retrieve Windows event log entries – Retrieves Windows event log entries based on specified filters
• Retrieve Windows event log files – Retrieves Windows event log files
• Terminate process – Terminates processes matching the specified patterns
• Terminate thread – Terminates a thread

Identity response actions

The following identity response actions are available for Microsoft Entra:

• Block user access in Microsoft Entra – Blocks access for a user to all resources inside the Microsoft Entra ecosystem
• End Microsoft Entra session – Ends the Microsoft Entra session of a user
• Reset Microsoft Entra password – Resets the Microsoft Entra password of a user

Response action results and attachments

Response actions are processed asynchronously: once triggered, you can monitor their progress.A new endpoint is available for retrieving the actual results of response actions that return data (for example, memory dumps or other files):

GET /response-actions/v1/responses/tasks

By using this endpoint, you can download any files or attachments produced by completed response actions. To determine when your action has finished, first poll the state via GET /response-actions/v1/responses. When the action is marked as finished, your attachments are ready for download from the tasks endpoint.

Start building

Full API documentation is available at

https://connect.withsecure.com/api-reference/elements/

New API Endpoint: Get Incident Updates

We have added a new endpoint to the Elements API that provides programmatic access to incident update history.

Endpoint Details

GET /incidents/v1/updates

Description

This endpoint retrieves the complete history of changes made to a specific incident (Broad Context Detection). Each update represents a modification to the incident over its lifecycle, including status changes, detection additions, comments, and other modifications.

Key Capabilities

Update Types Tracked

• Status changes (patch)
• Detection additions, removals, and modifications
• User comments
• Response actions
• Incident merges
• Risk level adjustments
• Category changes
• Threat investigation and validation results

State Tracking

Each update includes stateBefore and stateAfter objects, allowing you to see exactly what changed. This includes status, resolution, risk level, and categories.

Origin Information

Updates include source information indicating whether the change was made by:

• A user (with display name)
• An automated engine
• A response action

Pagination Support

Results can be paginated using anchor-based navigation, with a configurable limit of 1-100 updates per request (default 50).

Filtering

Filter updates by type to retrieve only relevant changes (e.g., only comments or only status changes).

Customer Benefits

1. Complete Audit Trail: Access the full history of incident modifications for compliance and reporting purposes.
2. Accountability: Identify who made specific changes to incidents through origin tracking.
3. Integration Support: Build automated workflows that respond to specific types of incident updates.
4. Change Analysis: Compare before and after states to understand the evolution of an incident.
5. Efficient Data Retrieval: Use type filtering to retrieve only relevant updates, reducing unnecessary data transfer.
6. Scalability: Pagination support allows handling incidents with extensive update histories.

Read more from the Elements API specification page under “Get Incident Updates”.

Elements API: new “restart” remote operations

We have added two new remote operations to the Elements API device operations endpoint that enable programmatic system and agent restarts.

Operations Overview

The new operations “restartSystem” and “restartProduct” are available via the POST /devices/v1/operations endpoint.

New Operations

restartProduct

Restarts the WithSecure agent software on a device without restarting the entire system.

restartSystem

Restarts the entire device (full system reboot).

Batch Capability

Both operations support batch execution on up to 5 devices per request.

Benefits

1. Agent Troubleshooting: Restart the WithSecure agent without disrupting the user’s work by avoiding a full system reboot.
2. Maintenance Automation: Integrate system restarts into automated maintenance workflows following software updates or configuration changes.
3. User Communication: Provide advance notice to users with custom messages before system restarts, improving user experience.
4. Efficient Remediation: Quickly restart multiple devices as part of incident response or troubleshooting procedures.
5. Granular Control: Choose between agent-only or full system restarts based on the specific troubleshooting or maintenance requirement.
6. Operation Tracking: Track restart operations using returned operation IDs to verify execution on remote hosts.

Read more from the Elements API specification under “Trigger remote operations on devices”.