Trellix Response Actions API

openapi: 3.2.0
info:
  title: Trellix ePO SaaS Response Actions API
  description: The Trellix ePO SaaS API provides cloud-based access to ePolicy Orchestrator management capabilities. It enables programmatic control of devices, events, tags, queries, and response actions through the Trellix cloud management platform. Authentication uses OAuth 2.0 client credentials with scoped permissions for each resource type.
  version: '2.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
  termsOfService: https://www.trellix.com/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.manage.trellix.com
  description: Trellix Cloud Management Platform
security:
- bearerAuth: []
tags:
- name: Response Actions
  description: Trigger automated response actions on managed endpoints, including policy enforcement and remediation tasks.
paths:
  /epo/v2/response-actions:
    post:
      operationId: createResponseAction
      summary: Create a response action
      description: Trigger an automated response action on one or more managed endpoints. Response actions include policy enforcement, scan initiation, agent wake-up, and remediation tasks.
      tags:
      - Response Actions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResponseActionCreate'
      responses:
        '202':
          description: Response action accepted for processing
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ResponseAction'
        '400':
          description: Invalid response action request
        '401':
          description: Unauthorized - invalid or expired access token
components:
  schemas:
    ResponseAction:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the response action
        actionType:
          type: string
          description: Type of response action triggered
        status:
          type: string
          enum:
          - pending
          - in_progress
          - completed
          - failed
          description: Current status of the response action
        targetDevices:
          type: array
          items:
            type: string
          description: List of device identifiers targeted by the action
        createdAt:
          type: string
          format: date-time
          description: Timestamp when the action was created
    ResponseActionCreate:
      type: object
      required:
      - actionType
      - targetDevices
      properties:
        actionType:
          type: string
          enum:
          - wake_up_agent
          - run_scan
          - enforce_policy
          - collect_data
          description: Type of response action to execute
        targetDevices:
          type: array
          items:
            type: string
          description: List of device identifiers to target
        parameters:
          type: object
          description: Additional parameters specific to the action type
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token obtained through the client credentials flow. Requires appropriate scope permissions such as epo.device.r, epo.device.w, epo.tags.r, epo.tags.w, epo.evt.r, epo.qery.g, epo.qery.u, epo.resp.ra, and epo.resp.ru.
externalDocs:
  description: Trellix ePO SaaS Product Guide
  url: https://docs.trellix.com/bundle/epolicy-orchestrator-saas-product-guide