Malwarebytes Installers API
The Installers APIs allow you to deploy the endpoint agent to Windows and macOS devices.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Installers API
version: 1.0.0
description: 'Operations tagged Installers across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Installers
description: The Installers APIs allow you to deploy the endpoint agent to Windows and macOS devices.
paths:
/nebula/v1/installers:
servers:
- url: https://api.threatdown.com
get:
description: 'Endpoint software can be installed in the following ways:
- Active Directory (AD) Group Policy
- System Center Configuration Manager (SCCM)
- Third-party deployment tools
- Manually on the endpoints
- Discovery & Deployment Tool
- Once the installation is complete, the endpoints display in the Nebula console.
To retrieve account-specific installers, use the following API endpoints. The response includes a download URL for all the available installers. These download URLs expire in one hour.
The available installers are:
| Name | Description |
|-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| win_msi | This .msi installation package is lightweight. It includes the 32-bit Endpoint Agent, but does not include the .NET framework or other required software. |
| x64_msi | This .msi installation package is lightweight. It includes the 64-bit Endpoint Agent, but does not include the .NET framework or other required software. |
| ea2_arm_msi | This .msi installation package is for Windows ARM devices running Windows 11. It includes the ARM Endpoint Agent and .NET 8 runtime. |
| ea2_x64_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 64-bit Endpoint Agent and .NET 8 runtime. |
| ea2_x86_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 32-bit Endpoint Agent and .NET 8 runtime. |
| mac_os | macOS 11 Big Sur to macOS 26 Tahoe. This .pkg installer package includes the Endpoint Agent. |
Please note: the hash fields remain to not change the response, however they will be empty strings. This is due to a change in installer generation.
If you require the installer''s hash, check the response header under ''x-amz-meta-x-checksum-sha256''.
win_full and win_web have been deprecated but will remain in the response.
'
summary: Retrieve installers's links
security:
- client_credentials:
- read
- user_permissions:
- endpoints.install
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get all installers for your managed nebula account
properties:
win_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
win_web:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
win_full:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
mac_os:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_arm_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_x86_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_legacy_x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_legacy_x86_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
tags:
- Installers
operationId: api.nebula.get.installers
/oneview/v1/accounts/{account_id}/installers:
servers:
- url: https://api.threatdown.com
get:
description: 'Endpoint software can be installed in the following ways:
- Active Directory (AD) Group Policy
- System Center Configuration Manager (SCCM)
- Third-party deployment tools
- Manually on the endpoints
- Discovery & Deployment Tool
- Once the installation is complete, the endpoints display in the Nebula console.
To retrieve account-specific installers, use the following API endpoints. The response includes a download URL for all the available installers. These download URLs expire in one hour.
The available installers are:
| Name | Description |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| win_msi | This .msi installation package is lightweight. It includes the 32-bit Endpoint Agent, but does not include the .NET framework or other required software. |
| x64_msi | This .msi installation package is lightweight. It includes the 64-bit Endpoint Agent, but does not include the .NET framework or other required software. |
| ea2_arm_msi | This .msi installation package is for Windows ARM devices running Windows 11. It includes the ARM Endpoint Agent and .NET 8 runtime. |
| ea2_x64_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 64-bit Endpoint Agent and .NET 8 runtime. |
| ea2_x86_msi | This .msi installation package is for the Endpoint Agent version 2. It includes the 32-bit Endpoint Agent and .NET 8 runtime. |
| mac_os | macOS 11 Big Sur to macOS 26 Tahoe. This .pkg installer package includes the Endpoint Agent. |
Please note: the hash fields remain to not change the response, however they will be empty strings. This is due to a change in installer generation.
If you require the installer''s hash, check the response header under ''x-amz-meta-x-checksum-sha256''.
win_full and win_web have been deprecated but will remain in the response.
'
summary: Retrieve installers's links
security:
- client_credentials:
- read
- user_permissions:
- endpoints.install
status:
outage:
- auth
parameters:
- name: account_id
required: true
in: path
description: Account ID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get all installers for a managed nebula account
properties:
win_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
win_web:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
win_full:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
mac_os:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_arm_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_x86_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_legacy_x64_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
ea2_legacy_x86_msi:
type: object
title: Details about the installer
properties:
url:
type: string
title: The Download URL. Will expire after 60 seconds
link:
type: string
title: Non expirable download links
md5:
type: string
title: Checksum
sha256:
type: string
title: Checksum
version:
type: string
title: The version of this installer
tags:
- Installers
operationId: api.rmm.get.installers
components:
securitySchemes:
client_credentials:
type: oauth2
flows:
clientCredentials:
tokenUrl: /token
scopes:
read: Read data of your Nebula account
write: Write data, such as groups, policies, exclusions. Create Webhook subscriptions
execute: Issue jobs on your endpoints, like Scan, Reboot or Isolate.
user_permissions:
type: http
scheme: bearer
x-refined-from:
- malwarebytes-threatdown-nebula-openapi.json
- malwarebytes-threatdown-oneview-openapi.json