{"id":4758,"date":"2026-10-19T11:36:26","date_gmt":"2026-10-19T08:36:26","guid":{"rendered":"https:\/\/support.withsecure.com\/?page_id=4758"},"modified":"2026-10-19T11:36:26","modified_gmt":"2026-10-19T08:36:26","slug":"elements-api","status":"publish","type":"page","link":"https:\/\/support.withsecure.com\/en\/changelogs\/products\/elements-api\/","title":{"rendered":"Elements API"},"content":{"rendered":"<section\n    class=\"wp-block-support-banner edwp-block wp-block-support-banner--bg-light-gray layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n            <div class=\"wp-block-support-banner__container\">\n        <div class=\"wp-block-support-banner__content-wrapper\">\n                        <div class=\"wp-component-content wp-component-content--default wp-block-support-banner__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Changelogs<\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <h4>Elements API<\/h4>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div class=\"wp-block-support-banner__searchbar\">\n                    <div class=\"addsearch-standalone-searchbar-container\" data-addsearch-results-url=\"\/en\/search\"><\/div>\n                <\/div>\n                                <\/div>\n    <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-content-list edwp-block layout--spacing-l-top layout--spacing-l-bottom\"\n    >\n    <div class=\"wp-block-content-list__container\">\n        \n        <div class=\"wp-block-content-list__main\">\n                    <ul class=\"wp-block-content-list__list\">\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-07-08T00:00:00+00:00\">July 8, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2026-07-08-new-fields-in-invitations-responses\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2026-07-08: New fields in invitations responses<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>The latest Elements API release adds new fields to the invitations object returned by the\u00a0<strong>Send new device invitations<\/strong>\u00a0and <strong>List invitations <\/strong>endpoints (POST and GET \/invitations\/v1\/invitations). These fields provide the caller with the urls sent with the invite.<\/p>\n<p>This is an additive, backward-compatible change. Existing integrations continue to work without modification. New fields are populated when they are present in the invitation. The actual urls are invite specific.<\/p>\n<h5 data-id=\"new-top-level-fields\">New top-level fields<\/h5>\n<p><strong><\/strong><\/p>\n<p>In both service\u2019s responses:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">androidLink\u00a0<\/code>(string): Link to the android installer<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">iosLink\u00a0<\/code>(string): Link to the iOS installer<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">windowsLink\u00a0<\/code>(string): Link to the Windows installer<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">macLink\u00a0<\/code>(string): Link to the Mac installer<\/li>\n<\/ul>\n<p>See the full Elements API specification for details:\u00a0<span class=\"js-embed embedResponsive inlineEmbed\"><br \/>\n    <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%23get-%2Finvitations%2Fv1%2Finvitations\" rel=\"nofollow noopener ugc\" target=\"_blank\"><br \/>\n        https:\/\/connect.withsecure.com\/api-reference\/elements#get-\/invitations\/v1\/invitations<br \/>\n    <\/a><br \/>\n<\/span><\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-07-08T00:00:00+00:00\">July 8, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2026-07-08-new-audit-logs-listing-service\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2026-07-08: New audit-logs listing service<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>The latest Elements API release brings a new <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%23get-%2Faudit-logs%2Fv1%2Faudit-logs%29\" rel=\"nofollow noopener ugc\" target=\"_blank\">audit log listing operation<\/a>. <\/p>\n<p>This service exports the same data as you see in the elements UI when you go to the audit logs section. The data can be localized to all the languages our portal supports.<\/p>\n<p>See the full Elements API specification from <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%29\" rel=\"nofollow noopener ugc\" target=\"_blank\">here<\/a><\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-06-09T00:00:00+00:00\">June 9, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2026-06-09-new-device-fields-in-devices-query-response\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2026-06-09: New device fields in devices query response<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>The latest Elements API release adds new fields to the computer device object returned by the <strong>Query devices<\/strong> endpoint (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET \/devices\/v1\/devices<\/code>). These fields provide richer visibility into device security posture, BitLocker encryption status, and policy configuration.<\/p>\n<p>This is an additive, backward-compatible change. Existing integrations continue to work without modification. New fields are populated when reported by the agent on the device and may be absent on older agents or non-applicable platforms.<\/p>\n<h5 data-id=\"new-top-level-fields\">New top-level fields<\/h5>\n<p><strong>Security policy and tamper protection<\/strong> (reported by the Windows agent):<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">allowUsersToTurnOffSecurityFeatures<\/code> (boolean): Whether users are allowed to turn off security features on the device<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">allowUsersToUninstallProduct<\/code> (boolean): Whether local users are allowed to uninstall the security product<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">tamperProtectionEnabled<\/code> (boolean): Whether tamper protection is enabled<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">uninstallationPasswordSet<\/code> (boolean): Whether an uninstallation password has been configured<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">uninstallationPasswordEmpty<\/code> (boolean): Whether the uninstallation password is empty (not configured or blank)<\/li>\n<\/ul>\n<p><strong>BitLocker and disk encryption<\/strong> (reported by the Windows agent):<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">bitlockerOverallProtectionStatus<\/code> (string): Overall BitLocker protection status (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">all<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">some<\/code>, or <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">none<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">bitlockerRecoveryKeysCollectionEnabled<\/code> (boolean): Whether BitLocker recovery key collection is enabled in the device\u2019s policy<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">bitlockerRecoveryKeysCollectionSuccess<\/code> (boolean): Whether the most recent BitLocker recovery key collection completed successfully<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">diskEncryptionPolicy<\/code> (string): Disk encryption policy (profile protection setting) applied to the device<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">policyUseTpm<\/code> (string): Policy setting for using the Trusted Platform Module (TPM)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">policyUseTpmWithStartupPin<\/code> (string): Policy setting for using TPM with a startup PIN<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">tpmAvailable<\/code> (boolean): Whether a TPM chip is available on the device<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptedDrives<\/code> (array): List of drives and their BitLocker encryption status (see below)<\/li>\n<\/ul>\n<p><strong>Device lifecycle<\/strong> (reported by the agent):<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">lastRestartTime<\/code> (string, date-time): Date and time of the last device restart (ISO 8601 format)<\/li>\n<\/ul>\n<h5 data-id=\"new-fields-in-encrypteddrives-items\">New fields in <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptedDrives<\/code> items<\/h5>\n<p>Each entry in the <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptedDrives<\/code> array includes:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">drive<\/code> (string): Drive letter designation (for example <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">c:<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">driveType<\/code> (string): Drive type (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">system<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">fixed<\/code>, or <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">removable<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">systemDrive<\/code> (boolean): Whether this is the system drive<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptionStatus<\/code> (string): Current status (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">fully_decrypted<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">fully_encrypted<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryption_in_progress<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">decryption_in_progress<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryption_paused<\/code>, or <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">decryption_paused<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptionPercentage<\/code> (integer): Percentage of the drive that is encrypted (0\u2013100)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">encryptionMethod<\/code> (string): Encryption algorithm and key size (for example <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">xts_aes_256<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">aes_128<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">hardware_encryption<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">protectionStatus<\/code> (boolean): Whether BitLocker protection is active on the drive<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">protectors<\/code> (array of strings): Key protector types configured (for example <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">tpm<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">numeric_password<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">tpm_and_pin<\/code>)<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">bitlockerRecoveryKeyId<\/code> (string): BitLocker recovery key identifier in Windows GUID format<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">autounlock<\/code> (boolean): Whether auto-unlock is enabled for this drive<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">autounlockStored<\/code> (boolean): Whether an auto-unlock key for another drive is stored on this drive<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">pinRequested<\/code> (boolean): Whether a BitLocker PIN has been requested<\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">pinPostponed<\/code> (boolean): Whether the user has postponed setting a BitLocker PIN<\/li>\n<\/ul>\n<p>See the full Elements API specification for details: <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%23get-%2Fdevices%2Fv1%2Fdevices\" target=\"_blank\" rel=\"nofollow noopener ugc\">Query devices<\/a><\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-01-27T00:00:00+00:00\">January 27, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2026-01-27-new-device-operations-for-categorization\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2026-01-27: New device operations for categorization<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>The latest Elements API release brings new device operations for helping in categorization of devices.<\/p>\n<p>The following new device operations are now supported:<\/p>\n<ul>\n<li><a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%23alias-update\" rel=\"nofollow noopener ugc\" target=\"_blank\">Set a custom alias<\/a> name for a device. This allows you to assign a human-readable name to a device for easier identification<\/li>\n<li><a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%23importance-update\" rel=\"nofollow noopener ugc\" target=\"_blank\">Set the importance level of devices<\/a>. This helps prioritize devices based on their criticality to your organization<\/li>\n<li><a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%23business-context-update\" rel=\"nofollow noopener ugc\" target=\"_blank\">Set business context information for a device<\/a>. This allows you to associate devices with specific business units, departments, or purposes to help with organization and reporting<\/li>\n<li><a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%23labels-update\" rel=\"nofollow noopener ugc\" target=\"_blank\">Set device labels<\/a>. This allows to you to caregorize devices with custom labels<\/li>\n<\/ul>\n<p>See the full Element API specification from <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">here<\/a>.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-01-07T00:00:00+00:00\">January 7, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2026-01-07-product-related-security-events\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2026-01-07: Product related Security Events<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>The latest Elements API release brings new (WithSecure) Product Security Events.<\/p>\n<p>The following new events are now supported:<\/p>\n<ul>\n<li>Product has been uninstalled successfully<\/li>\n<li>Product uninstallation has been canceled<\/li>\n<li>Product uninstallation has failed due to incorrect uninstallation password<\/li>\n<li>Product uninstallation has failed due to unknown reason<\/li>\n<li>Product uninstallation is not allowed<\/li>\n<\/ul>\n<p>More information with examples is available in the <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect-ci.fsxt.net%2Fapi-reference%2Fsecurity-events%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">Security Events reference page<\/a>.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-12-10T00:00:00+00:00\">December 10, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-12-10-update\/\">\n                <p class=\"wp-block-content-list__title\">Elements API 2025-12-10 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <h4 data-id=\"release-update-new-api-endpoints-for-managing-elements-api-credentials\"><strong>Release Update: New API Endpoints for Managing Elements API Credentials<\/strong><\/h4>\n<p>We\u2019ve introduced new endpoints to automate the management of API keys for the Elements API:<\/p>\n<p><strong>1. Create API Key<\/strong><br \/><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">POST \/api-keys\/v1\/create<\/code><\/p>\n<ul>\n<li>Generate a new API key for accessing the Elements API.<\/li>\n<li>Keys can be created at the organisation or Service Organisation Partner (SOP) level.<\/li>\n<li>By default, keys are read-only for security. Optionally, set <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">readOnly<\/code> to <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">false<\/code> for write access.<\/li>\n<li><strong>Important:<\/strong> <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">clientSecret<\/code> is returned only once during creation\u2014store it securely.<\/li>\n<\/ul>\n<p><strong>2. Delete API Key<\/strong><br \/><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">DELETE \/api-keys\/v1\/api-keys\/{clientId}<\/code><\/p>\n<ul>\n<li>Permanently remove an API key by its ID.<\/li>\n<li>Deleted keys cannot be recovered or used for authentication.<\/li>\n<\/ul>\n<p><strong>3. List API Keys<\/strong><br \/><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET \/api-keys\/v1\/api-keys<\/code><\/p>\n<ul>\n<li>Retrieve all API keys for the current organisation or specify an <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">organizationId<\/code> when querying from SOP level.<\/li>\n<\/ul>\n<p>For full details, including request\/response formats and examples, refer to the <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">API documentation<\/a>.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-10-30T00:00:00+00:00\">October 30, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-10-30-update\/\">\n                <p class=\"wp-block-content-list__title\">Elements API &#8211; 2025-10-30 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <h4 data-id=\"new-response-actions-to-enable-new-workflows\">New response actions to enable new workflows<\/h4>\n<p>We&#8217;ve added new response action endpoints under <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">POST \/response-actions\/v1\/execute\/&lt;name&gt;<\/code> to expand remote execution capabilities for both device and identity management.<\/p>\n<p>This allows you to automate new workflows that involve acting on the target devices and identities.<\/p>\n<p>This release increases the number of API supported response actions from 8 to 32.<\/p>\n<h5 data-id=\"device-response-actions\">Device response actions<\/h5>\n<p>The following device response actions are available:<\/p>\n<ul>\n<li><strong>Create full memory dump<\/strong> &#8211; Uploads a full memory dump from the device<\/li>\n<li><strong>Delete registry key or value<\/strong> &#8211; Deletes a specified Windows registry key or value<\/li>\n<li><strong>Delete scheduled task<\/strong> &#8211; Deletes a specified Windows scheduled task<\/li>\n<li><strong>Delete Windows service<\/strong> &#8211; Deletes a specified Windows service<\/li>\n<li><strong>Delete WMI persistence objects<\/strong> &#8211; Deletes Windows Management Instrumentation (WMI) persistence objects<\/li>\n<li><strong>Enumerate running processes<\/strong> &#8211; Enumerates running processes on the device<\/li>\n<li><strong>Enumerate WMI persistence mechanisms<\/strong> &#8211; Enumerates WMI persistence mechanisms, including event consumers, filters, and bindings<\/li>\n<li><strong>List file system structure<\/strong> &#8211; Lists the file system structure based on path matching patterns<\/li>\n<li><strong>List registry keys and values<\/strong> &#8211; Lists Windows registry keys and values based on path matching patterns<\/li>\n<li><strong>List scheduled tasks<\/strong> &#8211; Lists all Windows scheduled tasks on the device<\/li>\n<li><strong>Retrieve amcache files<\/strong> &#8211; Retrieves the application compatibility cache file from the device<\/li>\n<li><strong>Retrieve antivirus logs<\/strong> &#8211; Retrieves antivirus software log files for security analysis<\/li>\n<li><strong>Retrieve browser artifacts<\/strong> &#8211; Retrieves the browser history from the device<\/li>\n<li><strong>Retrieve event log tracing files<\/strong> &#8211; Retrieves .etl event log tracing files with records of system activities<\/li>\n<li><strong>Retrieve files from device<\/strong> &#8211; Retrieves files from the device based on path matching patterns<\/li>\n<li><strong>Retrieve jump list files<\/strong> &#8211; Retrieves jump lists stored in the AutomaticDestinations and CustomDestinations subfolders<\/li>\n<li><strong>Retrieve master boot record<\/strong> &#8211; Retrieves the master boot record (MBR) from a specified drive<\/li>\n<li><strong>Retrieve master file table<\/strong> &#8211; Retrieves the master file table (MFT) from a specified drive<\/li>\n<li><strong>Retrieve network connections<\/strong> &#8211; Retrieves network connections, routing tables, interface statistics, and related process information<\/li>\n<li><strong>Retrieve prefetch files<\/strong> &#8211; Retrieves Windows prefetch files with evidence of program execution<\/li>\n<li><strong>Retrieve process memory dump<\/strong> &#8211; Retrieves a memory dump of a specific process<\/li>\n<li><strong>Retrieve RDP cache files<\/strong> &#8211; Retrieves remote desktop protocol (RDP) bitmap cache files<\/li>\n<li><strong>Retrieve recently accessed files<\/strong> &#8211; Retrieves information about recently accessed files and folders from user activity artefacts<\/li>\n<li><strong>Retrieve registry hive files<\/strong> &#8211; Retrieves Windows registry hive files<\/li>\n<li><strong>Retrieve SRUM database<\/strong> &#8211; Retrieves the system resource usage monitor (SRUM) database<\/li>\n<li><strong>Retrieve Windows event log entries<\/strong> &#8211; Retrieves Windows event log entries based on specified filters<\/li>\n<li><strong>Retrieve Windows event log files<\/strong> &#8211; Retrieves Windows event log files<\/li>\n<li><strong>Terminate process<\/strong> &#8211; Terminates processes matching the specified patterns<\/li>\n<li><strong>Terminate thread<\/strong> &#8211; Terminates a thread<\/li>\n<\/ul>\n<h5 data-id=\"identity-response-actions\">Identity response actions<\/h5>\n<p>The following identity response actions are available for Microsoft Entra:<\/p>\n<ul>\n<li><strong>Block user access in Microsoft Entra<\/strong> &#8211; Blocks access for a user to all resources inside the Microsoft Entra ecosystem<\/li>\n<li><strong>End Microsoft Entra session<\/strong> &#8211; Ends the Microsoft Entra session of a user<\/li>\n<li><strong>Reset Microsoft Entra password<\/strong> &#8211; Resets the Microsoft Entra password of a user<\/li>\n<\/ul>\n<h5 data-id=\"response-action-results-and-attachments\">Response action results and attachments<\/h5>\n<p>Response actions are processed asynchronously: once triggered, you can monitor their progress.A new endpoint is available for retrieving the actual results of response actions that return data (for example, memory dumps or other files):<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET\u00a0\/response-actions\/v1\/responses\/tasks<\/code><\/p>\n<p>By using this endpoint, you can download any files or attachments produced by completed response actions. To determine when your action has finished, first poll the state via <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET\u00a0\/response-actions\/v1\/responses<\/code>. When the action is marked as finished, your attachments are ready for download from the tasks endpoint.<\/p>\n<h5 data-id=\"start-building\">Start building<\/h5>\n<p>Full API documentation is available at <span class=\"js-embed embedResponsive inlineEmbed\"><br \/>\n    <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\"><br \/>\n        https:\/\/connect.withsecure.com\/api-reference\/elements\/<br \/>\n    <\/a><br \/>\n<\/span><\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-10-10T00:00:00+00:00\">October 10, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-10-10-update\/\">\n                <p class=\"wp-block-content-list__title\">Elements API &#8211; 2025-10-10 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <h4 data-id=\"new-api-endpoint-get-incident-updates\">New API Endpoint: Get Incident Updates<\/h4>\n<p>We have added a new endpoint to\u00a0the Elements API that provides programmatic access to incident update\u00a0history.<\/p>\n<h5 data-id=\"endpoint-details\">Endpoint Details<\/h5>\n<p><strong>GET<\/strong>\u00a0\/incidents\/v1\/updates<\/p>\n<h5 data-id=\"description\">Description<\/h5>\n<p>This endpoint retrieves the\u00a0complete history of changes made to a specific incident\u00a0(Broad Context Detection). Each\u00a0update represents a modification\u00a0to the incident over its\u00a0lifecycle, including status changes, detection\u00a0additions, comments, and other\u00a0modifications.<\/p>\n<h5 data-id=\"key-capabilities\">Key Capabilities<\/h5>\n<h6 data-id=\"update-types-tracked\"><strong>Update Types Tracked<\/strong><\/h6>\n<ul>\n<li>Status\u00a0changes (patch)<\/li>\n<li>Detection additions, removals, and modifications<\/li>\n<li>User\u00a0comments<\/li>\n<li>Response actions<\/li>\n<li>Incident merges<\/li>\n<li>Risk\u00a0level adjustments<\/li>\n<li>Category\u00a0changes<\/li>\n<li>Threat investigation and validation results<\/li>\n<\/ul>\n<h6 data-id=\"state-tracking\"><strong>State Tracking<\/strong><\/h6>\n<p>Each\u00a0update includes\u00a0stateBefore\u00a0and\u00a0stateAfter\u00a0objects, allowing you to see\u00a0exactly what changed. This includes status, resolution, risk\u00a0level, and categories.<\/p>\n<h6 data-id=\"origin-information\"><strong>Origin Information<\/strong><\/h6>\n<p>Updates\u00a0include source information indicating whether the change was made by:<\/p>\n<ul>\n<li>A user (with display name)<\/li>\n<li>An automated engine<\/li>\n<li>A response action<\/li>\n<\/ul>\n<h6 data-id=\"pagination-support\"><strong>Pagination Support<\/strong><\/h6>\n<p>Results can\u00a0be paginated using anchor-based navigation, with a configurable limit of 1-100\u00a0updates per request (default 50).<\/p>\n<h6 data-id=\"filtering\"><strong>Filtering<\/strong><\/h6>\n<p>Filter\u00a0updates by type to retrieve only relevant changes (e.g., only\u00a0comments or only status changes).<\/p>\n<h5 data-id=\"customer-benefits\">Customer Benefits<\/h5>\n<ol>\n<li><strong>Complete Audit Trail<\/strong>: Access\u00a0the full history of incident modifications for compliance\u00a0and reporting purposes.<\/li>\n<li><strong>Accountability<\/strong>: Identify who made specific changes to\u00a0incidents through origin tracking.<\/li>\n<li><strong>Integration\u00a0Support<\/strong>: Build automated workflows that respond to specific\u00a0types of incident updates.<\/li>\n<li><strong>Change\u00a0Analysis<\/strong>: Compare before and after states to understand the\u00a0evolution of an incident.<\/li>\n<li><strong>Efficient\u00a0Data Retrieval<\/strong>: Use type\u00a0filtering to retrieve only relevant updates, reducing unnecessary data transfer.<\/li>\n<li><strong>Scalability<\/strong>: Pagination support allows handling incidents with extensive update histories.<\/li>\n<\/ol>\n<p>Read more from the <a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">Elements API specification<\/a> page under &#8220;Get Incident Updates&#8221;.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-10-10T00:00:00+00:00\">October 10, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-10-10-update-2\/\">\n                <p class=\"wp-block-content-list__title\">Elements API &#8211; 2025-10-10 Update #2<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <h4 data-id=\"elements-api-new-restart-remote-operations\">Elements API: new &#8220;restart&#8221; remote operations<\/h4>\n<p>We have added two new remote operations to the Elements API device\u00a0operations endpoint that enable programmatic system\u00a0and agent restarts.<\/p>\n<h5 data-id=\"operations-overview\">Operations Overview<\/h5>\n<p>The new operations &#8220;restartSystem&#8221; and &#8220;restartProduct&#8221; are available via the <strong>POST<\/strong>\u00a0\/devices\/v1\/operations endpoint.<\/p>\n<h5 data-id=\"new-operations\">New Operations<\/h5>\n<h6 data-id=\"restartproduct\">restartProduct<\/h6>\n<p>Restarts the WithSecure agent software\u00a0on a device without restarting the entire system.<\/p>\n<h6 data-id=\"restartsystem\">restartSystem<\/h6>\n<p>Restarts the entire\u00a0device (full system reboot).<\/p>\n<h5 data-id=\"batch-capability\">Batch\u00a0Capability<\/h5>\n<p>Both operations support batch execution on up to\u00a05 devices per request. <\/p>\n<h5 data-id=\"benefits\">Benefits<\/h5>\n<ol>\n<li>Agent Troubleshooting: Restart\u00a0the WithSecure agent without disrupting the user&#8217;s work by avoiding a full system reboot.<\/li>\n<li>Maintenance\u00a0Automation: Integrate system restarts into automated maintenance workflows\u00a0following software updates or configuration changes.<\/li>\n<li>User\u00a0Communication: Provide advance notice to users with custom messages before system restarts, improving user experience.<\/li>\n<li>Efficient Remediation: Quickly restart multiple devices as part of incident\u00a0response or troubleshooting procedures.<\/li>\n<li>Granular Control: Choose between agent-only or full system restarts based on the specific troubleshooting or maintenance requirement.<\/li>\n<li>Operation Tracking: Track restart operations using returned operation IDs to\u00a0verify execution on remote hosts.<\/li>\n<\/ol>\n<p>Read more from the <a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">Elements API specification<\/a> under &#8220;Trigger remote operations on devices&#8221;.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-10-02T00:00:00+00:00\">October 2, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-10-02-update\/\">\n                <p class=\"wp-block-content-list__title\">Elements API &#8211; 2025-10-02 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <h4 data-id=\"new-remote-operation-send-full-status\">New remote operation (Send Full Status)<\/h4>\n<p>We have added API support for the\u00a0<strong>sendFullStatus<\/strong>\u00a0remote operation, allowing administrators to request\u00a0a full status report from devices. This operation is available for both computer and mobile devices\u00a0and\u00a0requires no additional parameters. After the operation is sent, the target device(s) will asynchronously send their status to the Elements Cloud.<\/p>\n<p>Read more from the <a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\">api specification page<\/a> under <strong>POST<\/strong>\u00a0\/devices\/v1\/operations endpoint.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n    <\/ul>\n\n                            <nav class=\"wp-block-content-list__pagination\" aria-label=\"Pagination\">\n                    \n                                                                        <span class=\"wp-block-content-list__pagination-link wp-block-content-list__pagination-link--current\" aria-current=\"page\">1<\/span>\n                                                                                                <a class=\"wp-block-content-list__pagination-link\" href=\"\/en\/wp-json\/wp\/v2\/pages\/4758?cl_page=2\">2<\/a>\n                                            \n                                            <a class=\"wp-block-content-list__pagination-link\" href=\"\/en\/wp-json\/wp\/v2\/pages\/4758?cl_page=2\" rel=\"next\">Next<\/a>\n                                    <\/nav>\n                            <\/div>\n    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":0,"parent":4744,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-4758","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/comments?post=4758"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4758\/revisions"}],"predecessor-version":[{"id":8127,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4758\/revisions\/8127"}],"up":[{"embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4744"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}