The Flightdeck partner API by dope.security. Manage web policies, custom URL categories, URL and application bypass lists, SSL inspection configuration, and endpoint status for the dope.swg Secure Web Gateway. Authentication uses the OAuth 2.0 Client Credentials flow; the returned bearer token is required on all subsequent calls.
# generated: '2026-07-18'
# method: searched
# source: https://inflight.dope.security/dope.apis/public-api-specification
openapi: 3.0.3
info:
title: Flightdeck - dope.security - Public API specification
version: 1.0.3
description: The Flightdeck API by dope.security. Manage policies, custom categories, URL/application
bypass, SSL inspection, and endpoint status for the dope.swg Secure Web Gateway. Authentication uses
the OAuth 2.0 Client Credentials flow; the returned bearer token is required on all non-token calls.
contact:
name: dope.security Support
email: support@dope.security
url: https://inflight.dope.security/dope.apis/public-api-specification
servers:
- url: https://api.flightdeck.dope.security/v1
tags:
- name: Authorization
description: Everything about authorizing calls to Flightdeck
- name: Endpoints
description: Everything about your endpoints
- name: Policies
description: Everything about your Policies
- name: Custom Categories
description: Everything about your Custom Categories
security:
- BearerAuth: []
paths:
/partner/oauth/token:
post:
tags:
- Authorization
summary: Generate Flightdeck API access token
description: 'Use this API to generate an access token for use with the Flightdeck API. A valid
access token returned from
this API is required in all other Flightdeck API calls.
Token generation is based on the OAuth 2.0 Client Credentials Flow. The returned token is used
within the
HTTP Authorization header as follows:
`Authorization: Bearer <access token>`
Note:
- The required `client_id` and `client_secret` are created by an admin via the dope console.
- Returned access tokens are valid for a limited time period. Clients must check the `expires_in`
value in
the response to generate a new access token before the current one expires.
- The OAuth scopes parameter is not supported and if provided will be ignored. The scopes returned
in the access
token are set directly by the authorization server.
'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
grant_type:
type: string
description: The type of grant requested. You must set this to `client_credentials`
enum:
- client_credentials
client_id:
type: string
description: Your application's Client ID.
client_secret:
type: string
description: Your application's Client Secret.
required:
- grant_type
- client_id
- client_secret
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
access_token:
type: string
description: The new access token.
token_type:
type: string
enum:
- bearer
description: The type of token returned.
expires_in:
type: number
description: The expiration time of the new access token in seconds.
required:
- access_token
- token_type
- expires_in
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
'401':
description: Client not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
operationId: generateAccessToken
security: []
/endpoints/search:
get:
summary: List and Search Endpoints
description: 'Use this API to get a list of all endpoints, or search for those matching a query
parameter.
Note:
- To return a list of all endpoints do not include any additional parameter.
- Only one of the optional parameters is allowed to be specified per request.
- Results are returned in pages using cursor based pagination and ordered by the `lastSeen` property.
'
tags:
- Endpoints
parameters:
- in: query
name: id
description: Broad search query across endpoints by device, user and email identities that contain
this string (case-insensitive)
required: false
schema:
type: string
- in: query
name: emailId
description: Search by email ids that contain this string (case-insensitive)
required: false
schema:
type: string
- in: query
name: deviceName
description: Search by device names that contain this string (case-insensitive)
required: false
schema:
type: string
- in: query
name: userId
description: Search by user ids that contain this string (case-insensitive). `userId` for OIDC
users is usually their email address.
required: false
schema:
type: string
- in: query
name: osVersion
description: Filter by this exact device OS version string
required: false
schema:
type: string
- in: query
name: status
description: Filter by this exact set of status'
required: false
schema:
type: array
items:
type: string
enum:
- healthy
- error
- dormant
- disabled
explode: false
- in: query
name: debugState
description: 'Filter by this exact set of debug states.
0 means not in debug
1 means debug request sent to endpoint
2 means debug request acknowledged by endpoint
'
required: false
schema:
type: array
items:
type: string
enum:
- '0'
- '1'
- '2'
explode: false
- in: query
name: fallbackMode
description: Filter by the fallback mode
required: false
schema:
type: string
enum:
- 'true'
- 'false'
- in: query
name: locationId
description: Filter by this exact location id - with an underscore separating the case sensitive
city and country values e.g. "City_Country"
required: false
schema:
type: string
- in: query
name: agentVersion
description: Filter by this exact agent version
required: false
schema:
type: string
- $ref: '#/components/parameters/PaginationFirst'
- $ref: '#/components/parameters/PaginationAfter'
- in: query
name: order
description: The direction of the sort by the `lastSeen` property. The default is to sort by descending
required: false
schema:
type: string
enum:
- desc
- asc
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
pageInfo:
$ref: '#/components/schemas/PaginationResponse'
endpoints:
type: array
items:
$ref: '#/components/schemas/Endpoint'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: searchEndpoints
/policies:
get:
summary: List Policies
description: 'Use this API to get a paginated list of all your policies, ordered by policy name.
Each item includes the policy name, last-modified timestamp, SSL inspection status, and
the number of conflicting assignments.
The `sslInspection` field returns the effective value (`enabled` or `disabled`). If SSL
inspection is not explicitly configured on a policy, the value is inherited from the Base Policy.
Results are returned in pages using cursor-based pagination.
'
tags:
- Policies
parameters:
- $ref: '#/components/parameters/PaginationFirst'
- $ref: '#/components/parameters/PaginationAfter'
- in: query
name: order
description: Sort order for policy names. Defaults to `asc`.
required: false
schema:
type: string
enum:
- asc
- desc
default: asc
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
policies:
type: array
items:
$ref: '#/components/schemas/Policy'
pageInfo:
$ref: '#/components/schemas/PaginationResponse'
required:
- policies
- pageInfo
required:
- data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: listPolicies
/policies/{policy_name}:
post:
summary: Create a Policy
description: 'Use this API to create a new policy.
Specify the name of the policy in the path parameter (`policy_name`).
If the policy already exists, a `400` error is returned.
Validation rules for `policy_name`:
- Must not be empty or whitespace-only
- Must not contain leading or trailing whitespace
- Maximum length of 32 characters
- Must not contain any of the following characters: `# ! @ $ % ^ * ? . / \`
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to create
schema:
type: string
minLength: 1
maxLength: 32
pattern: ^[^#!@$%^*?./\\]+$
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request - invalid policy name or policy already exists
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: createPolicy
delete:
summary: Delete a Policy
description: 'Use this API to delete a custom policy by name.
This removes the policy and unassigns all users and groups from the policy.
The Base Policy cannot be deleted.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
description: The name of the policy to delete
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request. Policy not found or attempted to delete Base Policy.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: deletePolicy
/policies/{policy_name}/content:
get:
summary: Get Policy Content
description: 'Use this API to retrieve the entire content of a policy, including
categories and custom categories.
When a policy inherits from the base policy, `inheritsFromBase` will be `true`
and the content will reflect the base policy''s settings.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to retrieve content for
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyContentResponse'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: getPolicyContent
/policies/{policy_name}/content/restrictions:
put:
summary: Update Policy Content Restrictions
description: 'Use this API to update restrictions on dope and custom categories for a policy.
A single call may update restrictions on any combination of dope
and custom categories. Only submitted categories will be updated -
any category not included in the request will be left unchanged.
This API also resets categories back to inheriting from base.
Both dope categories and custom categories inherit from base
(and are reset) as a whole by sending `{inheritsFromBase:true}` in the payload.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to update restrictions for
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyContentRestrictionsRequest'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: updatePolicyRestrictions
/policies/{policy_name}/content/exceptions:
put:
summary: Update Policy Content Exceptions
description: 'Use this API to update user/group-level exceptions on dope and custom categories for
a policy.
Exceptions are per-user/group overrides of a category''s restriction.
Each exception is keyed by the user or group identifier (e.g. email address) within a category.
A single request can update exceptions across multiple dope and custom categories.
Categories not included in the request remain unchanged. For each category provided, the submitted
exception set is treated as the complete source of truth and fully replaces any existing exceptions.
Any existing entries not included in the request for that category will be removed.
To remove all exceptions from a category, pass an empty object `{}` as its value.
All user and group identifiers are validated against the tenant directory.
If any identifier cannot be resolved, the request fails with a `400 Bad Request`,
and the response includes details of the invalid entries.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to update exceptions for
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyContentExceptionsRequest'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: updatePolicyExceptions
/policies/{policy_name}/assignments:
get:
summary: Get Policy Assignments
description: 'Use this API to get the users and groups assigned to a policy.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to get assignments for
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
users:
type: array
items:
$ref: '#/components/schemas/AssignedUser'
groups:
type: array
items:
$ref: '#/components/schemas/AssignedGroup'
required:
- users
- groups
required:
- data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: getPolicyAssignments
put:
summary: Update Policy Assignments
description: 'Use this API to update the users and groups assigned to a policy.
Each provided field fully replaces that assignment list. Omitted fields are preserved.
Send an empty array to unassign all users or groups.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to update assignments for
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
users:
type: array
description: User emails to assign. Omit to leave unchanged, send [] to unassign all.
items:
type: string
groups:
type: array
description: Group emails to assign. Omit to leave unchanged, send [] to unassign all.
items:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: updatePolicyAssignments
/policies/{policy_name}/bypass/urls:
get:
summary: Get URL Bypass
description: 'Use this API to get the URL bypass entries for a policy.
The response contains both admin-defined `custom` entries and dope-provided
`default` entries with their per-entry toggle state.
When a policy inherits from the base policy, `inheritsFromBase` will be `true`
and the `custom` and `default` entries will reflect the base policy''s settings.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to retrieve the URL bypass for
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
inheritsFromBase:
type: boolean
description: Whether the URL bypass configuration is inherited from the base policy
custom:
type: array
description: Custom URL bypass entries defined by the admin
items:
$ref: '#/components/schemas/CustomBypassItem'
default:
type: array
description: Default URL bypass entries with their toggle states
items:
$ref: '#/components/schemas/DefaultBypassItem'
required:
- inheritsFromBase
- custom
- default
required:
- data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: getUrlBypass
put:
summary: Upsert URL Bypass
description: 'Upsert custom URL bypass entries and/or update default URL bypass states for a policy.
**Custom entries** are matched by name: matching names are overwritten, unknown names are added.
Unmentioned custom entries are preserved.
**Default entries** are matched by name: set `state` to `ignored` to suppress a default entry,
or `applied` to re-enable it. Unknown default entry names are silently ignored.
Pass `inheritsFromBase: true` as the entire `data` payload to reset the policy to inherit
all URL bypass configuration from the base policy (this drops all custom entries and default
overrides for this policy).
**Detaching from Base**: If a policy inherits from the Base Policy (`inheritsFromBase: true`),
sending `custom` or `default` entries will detach it. Base entries are not copied — include any
you want to keep in the request. Once detached, further Base Policy changes will no longer
propagate to this policy.
'
operationId: upsertUrlBypass
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to update URL bypass entries for
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- data
properties:
data:
oneOf:
- $ref: '#/components/schemas/BaseInheritance'
- $ref: '#/components/schemas/UrlBypassUpdateBody'
responses:
'200':
description: URL bypass updated successfully
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request or policy not found
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'401':
description: Unauthorized — missing or invalid bearer token
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
delete:
summary: Delete Custom URL Bypass Entries
description: 'Use this API to delete custom URL bypass entries from a policy by name.
The operation is idempotent — names that do not exist are silently ignored.
Policies that inherit URL bypass from the Base Policy cannot have custom URLs deleted.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to delete URL bypass entries from
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
custom:
type: object
properties:
urls:
type: array
items:
type: string
description: List of URL names to delete
required:
- urls
required:
- custom
required:
- data
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessMessage'
'400':
description: Bad request. Policy not found or policy inherits URL bypass from Base Policy.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'403':
description: Access denied
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Errors'
operationId: deleteCustomUrlBypass
/policies/{policy_name}/bypass/applications:
get:
summary: Get Application Bypass
description: 'Use this API to get the application bypass entries for a policy.
The response contains both admin-defined `custom` entries and dope-provided
`default` entries with their per-entry toggle state, split per platform
(`mac` and `windows`).
When a policy inherits from the base policy, `inheritsFromBase` will be `true`
and the `custom` and `default` entries will reflect the base policy''s settings.
'
tags:
- Policies
parameters:
- in: path
name: policy_name
required: true
description: The name of the policy to retrieve the application bypass for
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
inheritsFromBase:
type: boolean
description: Whether the application bypass configuration is inherited from the
base policy
custom:
type: object
description: Custom application bypass entries defined by the admin
properties:
mac:
type: array
description: Custom bypass apps on macOS
items:
$ref: '#/components/schemas/CustomBypassItem'
windows:
type: array
description: Custom bypass apps on Windows
items:
$ref: '#/components/schemas/CustomBypassItem'
required:
- mac
- windows
default:
type: object
description: Default application bypass entries with their toggle states
properties:
mac:
type: array
description: Default bypass apps on macOS
items:
$ref: '#/components/schemas/DefaultBypassItem'
windows:
# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/dopesecurity/refs/heads/main/openapi/dopesecurity-flightdeck-openapi.yml