Security

We've a web server that uses the ClearPass API to quarantine a device by setting a local attribute UoY_Quarantined = true  in an endpoint entry. This all works just fineand we can (un)quarantine a devices whenever we want. Now of course we need a list of all the devices with this attribute set.

Rather than downloading the whole endpoint db and parsing it, can we make a specific API call to search for all endpoints with a particular attribute set ?

Rgds

Alex

... and the answer is yes.

From the API explorer, if we filter on

{"UoY_Quarantined":{"$exists":true}}

we get 

{
"_links": {
"self": {
"href": "https://clearpass1old.york.ac.uk/api/endpoint?calculate_count=false&offset=0&limit=25&sort=%2Bid&filter=%7B%22UoY_Quarantined%22%3A%7B%22%24exists%22%3Atrue%7D%7D"
},
"first": {
"href": "https://clearpass1old.york.ac.uk/api/endpoint?calculate_count=false&offset=0&limit=25&sort=%2Bid&filter=%7B%22UoY_Quarantined%22%3A%7B%22%24exists%22%3Atrue%7D%7D"
}
},
"_embedded": {
"items": [
{
"id": 943313,
"mac_address": "844bf50ee84b",
"status": "Unknown",
"attributes": {
"UoY_Quarantined": "true"
},
"_links": {
"self": {
"href": "https://clearpass1old.york.ac.uk/api/endpoint/943313"
}
}
}
]
}
}

Of course I guess that this version just checks for existience of UoY_Quarantine and not that it is set to true

so if you filter on

{"UoY_Quarantined":"true"}

You get the desired result