Malwarebytes

Malwarebytes Endpoints API

## Endpoints Introduction An Endpoint is a device which has the ThreatDown Endpoint Agent installed. Currently, there are available Endpoint Agents for Windows, macOS, and Linux. Refer to the installation guide for more information on registering a new Endpoint. Using the Endpoint API, you can search your registered endpoints and retrieve their last known status. The API allows you to perform advanced queries and offers grouping capabilities so that you can perform deep analysis of your company's devices and the found threats, such as Detections or Suspicious Activities. You can scan, isolate, remediate, and reboot your endpoints remotely through the Job APIs. ## How to deploy an endpoint agent **Endpoint software can be installed in the following ways**: - Active Directory (AD) Group Policy - System Center Configuration Manager (SCCM) - Third-party deployment tools - Manually on the endpoints - Discovery & Deployment Tool Once the installation is complete, the endpoints will be displayed in the console. You can retrieve installers for your account through the `Installers` APIs.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 47

DELETE /nebula/v1/endpoints/{id} Delete a machine #
GET /nebula/v1/endpoints/{id} Get endpoint #
DELETE /nebula/v1/endpoints Delete multiple machines #
POST /nebula/v1/endpoints Search endpoints #
POST /nebula/v1/endpoints/export Export endpoints #
POST /nebula/v1/endpoints/export/async Export endpoints asynchronously #
GET /nebula/v1/endpoints/{id}/agent_info Get endpoint agent info #
GET /nebula/v1/endpoints/{id}/assets Get endpoint assets #
GET /nebula/v1/endpoints/{id}/drives Get endpoint drives #
GET /nebula/v1/endpoints/{id}/network Network information #
GET /nebula/v1/endpoints/{id}/sa All suspicious activity of an endpoint #
GET /nebula/v1/endpoints/{id}/sa/{sa_id}/exclusions Specific suspicious activity of an endpoint #
POST /nebula/v1/endpoints/{id}/sa/{sa_id}/remediate Remediate suspicious activity of an endpoint #
GET /nebula/v1/endpoints/{id}/scans/{scan_id} Get a scan of an endpoint #
GET /nebula/v1/endpoints/{id}/scans Get scans of an endpoint #
GET /nebula/v1/endpoints/{id}/scans/{scan_id}/detections Get the detections of a scan #
GET /nebula/v1/endpoints/{id}/status Endpoint status #
GET /nebula/v1/endpoints/{id}/diag-log Get diagnostic logs of an endpoint #
GET /nebula/v1/endpoints/{id}/quarantine Get quarantined items #
POST /nebula/v1/endpoints/{id}/drives/{volume_id}/reveal Reveal drive recovery key #
PUT /nebula/v1/endpoints/{id}/sa/{sa_id}/close Close suspicious activity of an endpoint #
PUT /nebula/v1/endpoints/{id}/sa/{sa_id}/open Open suspicious activity of an endpoint #
PUT /nebula/v1/endpoints/{id}/tags Set endpoint tags #
POST /nebula/v1/endpoints/search-groupby Search grouped endpoints #
DELETE /oneview/v1/accounts/{account_id}/endpoints/{id} Delete an endpoint #
GET /oneview/v1/accounts/{account_id}/endpoints/{id} Get endpoint #
DELETE /oneview/v1/endpoints Delete multiple endpoints across accounts #
POST /oneview/v1/endpoints Search endpoints across accounts #
POST /oneview/v1/endpoints/export Export endpoints (Bulk across accounts) #
POST /oneview/v1/endpoints/export/async Export endpoints asynchronously #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/agent_info Get endpoint agent info #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/assets Get endpoint assets #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/network Network information #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/sa All suspicious activity of an endpoint #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/exclusions Specific suspicious activity of an endpoint #
POST /oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/remediate Remediate suspicious activity of an endpoint #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/scans/{scan_id} Get a scan of an endpoint #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/scans Get scans of an endpoint #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/scans/{scan_id}/detections Get the detections of a scan #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/status Endpoint status #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/diag-log Generate a diagnostic log #
GET /oneview/v1/accounts/{account_id}/endpoints/{id}/quarantine Get quarantined items #
PUT /oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/close Close suspicious activity of an endpoint #
PUT /oneview/v1/accounts/{account_id}/endpoints/{id}/sa/{sa_id}/open Open suspicious activity of an endpoint #
PUT /oneview/v1/accounts/{account_id}/endpoints/{id}/tags Set endpoint tags #
POST /oneview/v1/accounts/{account_id}/endpoints Search endpoints #
POST /oneview/v1/endpoints/search-groupby Search grouped endpoints #

Documentation

📖
Documentation
https://api.threatdown.com/nebula/v1/docs
📖
APIReference
https://api.threatdown.com/nebula/v1/docs
📖
Documentation
https://cloud.malwarebytes.com/api/v2/oneview/docs

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-endpoints-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/malwarebytes-endpoints-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

malwarebytes-endpoints-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Malwarebytes Endpoints API
  version: 1.0.0
  x-logo:
    altText: ThreatDown logo
    url: https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png
    backgroundColor: '#FFFFFF'
  description: 'Operations tagged Endpoints across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:


# --- truncated at 32 KB (613 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-endpoints-api-openapi.yml