CloudrawAPI v0
Menu

API reference

Device trust

Trust rules and device-health (posture) profiles that decide whether a device is trusted.

List posture profiles

GET/v0/tenants/{tenant_id}/posture-profiles

read-only token

Returns your saved posture profiles (named sets of device-health checks) and the catalog of check names a profile may contain. Profiles are a saved list only: access and trust rules do not use them yet — put posture conditions in the rules themselves. Not paginated.

Token: read-only or full access · Created by: owner or security admin

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Responses

200 Profiles and the check catalog.

application/json

  • itemsarray of PostureProfilerequired
    items fields
    • idstringrequired
    • namestringrequired

      Up to 80 characters.

    • conditionsarray of stringrequired

      One of: disk_encrypted, antivirus_on, antivirus_present, edr_present, firewall_on, os_up_to_date, screen_lock, domain_or_entra_joined, managed_baseline, os_is_windows, os_is_macos.

    • created_atstring (date-time)
    • updated_atstring | null (date-time)
    • versioninteger
  • next_cursorstring | null

    Opaque cursor for the next page; null on the last page.

  • catalogarray of string

    Check names a profile may contain.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles" -Headers $headers
Python
import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "items": [
    {
      "id": "pp_3k8x0s2m1d",
      "name": "Finance laptops",
      "conditions": [
        "disk_encrypted",
        "edr_present",
        "firewall_on",
        "os_up_to_date"
      ],
      "created_at": "2026-10-01T10:00:00.000Z",
      "updated_at": null,
      "version": 1
    }
  ],
  "next_cursor": null,
  "catalog": [
    "disk_encrypted",
    "antivirus_on",
    "antivirus_present",
    "edr_present",
    "firewall_on",
    "os_up_to_date",
    "screen_lock",
    "domain_or_entra_joined",
    "managed_baseline",
    "os_is_windows",
    "os_is_macos"
  ]
}

Create a posture profile

POST/v0/tenants/{tenant_id}/posture-profiles

full-access tokenidempotent

Saves a named set of device-health checks. Duplicate check names are removed. Audited.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key to retry safely — the same key and body within 24 h returns the first answer.

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Headers

  • Idempotency-Keystring

    A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.

    Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

  • namestringrequired

    Up to 80 characters (longer names are cut).

  • conditionsarray of stringrequired

    At least one check name from the catalog.

Responses

201 The profile.

application/json

  • idstringrequired
  • namestringrequired

    Up to 80 characters.

  • conditionsarray of stringrequired

    One of: disk_encrypted, antivirus_on, antivirus_present, edr_present, firewall_on, os_up_to_date, screen_lock, domain_or_entra_joined, managed_baseline, os_is_windows, os_is_macos.

  • created_atstring (date-time)
  • updated_atstring | null (date-time)
  • versioninteger
400 name-required conditions-required conditions-must-be-strings unknown-condition

name-required: name is missing or blank.

conditions-required: conditions is missing or empty.

conditions-must-be-strings: conditions contains something other than strings.

unknown-condition: A check name is not in the catalog; detail names it.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

409 idempotency-key-reuse

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Finance laptops",
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date"
  ]
}'
PowerShell
$body = @'
{
  "name": "Finance laptops",
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date"
  ]
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
        "name": "Finance laptops",
        "conditions": [
            "disk_encrypted",
            "edr_present",
            "firewall_on",
            "os_up_to_date"
        ]
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "Finance laptops",
    "conditions": [
      "disk_encrypted",
      "edr_present",
      "firewall_on",
      "os_up_to_date"
    ]
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 201 · application/json
{
  "id": "pp_3k8x0s2m1d",
  "name": "Finance laptops",
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date"
  ],
  "created_at": "2026-10-01T10:00:00.000Z",
  "updated_at": null,
  "version": 1
}

Update a posture profile

PATCH/v0/tenants/{tenant_id}/posture-profiles/{profile_id}

full-access token

Renames the profile and/or replaces its check list. A blank name is ignored. No If-Match is needed. Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • profile_idstringrequired

    Posture profile id.

    Example: pp_3k8x0s2m1d

Request body application/json

  • namestring

    Up to 80 characters.

  • conditionsarray of string

    Replaces the list; at least one check name.

Responses

200 The updated profile.

application/json

  • idstringrequired
  • namestringrequired

    Up to 80 characters.

  • conditionsarray of stringrequired

    One of: disk_encrypted, antivirus_on, antivirus_present, edr_present, firewall_on, os_up_to_date, screen_lock, domain_or_entra_joined, managed_baseline, os_is_windows, os_is_macos.

  • created_atstring (date-time)
  • updated_atstring | null (date-time)
  • versioninteger
400 conditions-required conditions-must-be-strings unknown-condition

conditions-required: conditions is an empty list.

conditions-must-be-strings: conditions contains something other than strings.

unknown-condition: A check name is not in the catalog.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 profile-not-found tenant-not-found

profile-not-found: No posture profile with this id.

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X PATCH "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date",
    "screen_lock"
  ]
}'
PowerShell
$body = @'
{
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date",
    "screen_lock"
  ]
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Patch -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.patch(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "conditions": [
            "disk_encrypted",
            "edr_present",
            "firewall_on",
            "os_up_to_date",
            "screen_lock"
        ]
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "conditions": [
      "disk_encrypted",
      "edr_present",
      "firewall_on",
      "os_up_to_date",
      "screen_lock"
    ]
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "id": "pp_3k8x0s2m1d",
  "name": "Finance laptops",
  "conditions": [
    "disk_encrypted",
    "edr_present",
    "firewall_on",
    "os_up_to_date",
    "screen_lock"
  ],
  "created_at": "2026-10-01T10:00:00.000Z",
  "updated_at": "2026-10-13T09:24:11.000Z",
  "version": 2
}

Delete a posture profile

DELETE/v0/tenants/{tenant_id}/posture-profiles/{profile_id}

full-access token

Deletes the profile. Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • profile_idstringrequired

    Posture profile id.

    Example: pp_3k8x0s2m1d

Responses

202 Deleted (state: done).

application/json

  • idstringrequired
  • tenant_idstring
  • statestringrequired

    One of: pending, running, done, failed.

  • result_uristring | null
  • errorobject | string | null

    Why it failed, or a short status note (e.g. revoke_pending).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 profile-not-found tenant-not-found

profile-not-found: No posture profile with this id.

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d" -Headers $headers
Python
import os, uuid, requests

r = requests.delete(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.status_code)
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/posture-profiles/pp_3k8x0s2m1d", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);
Response 202 · application/json
{
  "id": "task_8k2x0m9s1d",
  "tenant_id": "tq7x2m9k4ab",
  "state": "done",
  "result_uri": null,
  "error": null
}

List trust rules

GET/v0/tenants/{tenant_id}/trust-rules

read-only token

Returns every trust rule, oldest first. A device is trusted when it matches at least one enabled trust rule (or an admin marked it trusted). With no trust rules at all, devices are not trusted but are not blocked either. Pages like List access rules: pass limit, then cursor = the previous next_cursor; without limit every rule comes back.

Token: read-only or full access · Created by: owner or security admin

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Query parameters

  • limitinteger

    Page size, 1-200 (above 200 = 200). Leave it out to get every rule in one answer.

    Example: 50

  • cursorstring

    The next_cursor of the previous page, unchanged.

Responses

200 Trust rules (one page when limit is set).

application/json

  • itemsarray of TrustRulerequired
    items fields
    • idstringrequired

      Trust rule id.

    • namestringrequired

      1-128 characters.

    • matchConditionNoderequired

      One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

      match fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • enabledbooleanrequired

      Disabled rules are ignored.

    • form_representableboolean
    • form_viewRuleFormView

      The rule read as the console's simple form: Include / Require / Except. Present only when form_representable is true.

      form_view fields
      • includearray of ConditionNoderequired

        Who the rule applies to (one OR list): group / person / device / simple attribute leaves, decorated with resolved_groups, resolved_people or resolved_devices.

        include fields
        • opstring

          Group node: how the children combine.

          One of: and, or.

        • negateboolean

          Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

        • childrenarray of ConditionNode

          Group node: the child nodes.

        • typestring

          Leaf: what is tested.

          One of: group, person, device, posture, network, time, mfa, app, attribute.

        • fieldstring

          Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

        • operatorstring

          Leaf: the operator (depends on type / field).

        • valueany

          Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

        • resolved_groupsarray of object

          Read-only, in form_view: the groups a group leaf names.

          resolved_groups fields
          • idstring
          • display_namestring
          • statestring
        • resolved_peoplearray of object

          Read-only, in form_view: the people a person leaf names.

          resolved_people fields
          • idstring
          • display_namestring
          • emailstring
          • statestring
        • resolved_devicesarray of object

          Read-only, in form_view: the devices a device leaf names.

          resolved_devices fields
          • idstring
          • display_namestring
          • statestring
      • requirearray of ConditionNoderequired

        Conditions that must all hold (posture, time, mfa, attribute).

        require fields
        • opstring

          Group node: how the children combine.

          One of: and, or.

        • negateboolean

          Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

        • childrenarray of ConditionNode

          Group node: the child nodes.

        • typestring

          Leaf: what is tested.

          One of: group, person, device, posture, network, time, mfa, app, attribute.

        • fieldstring

          Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

        • operatorstring

          Leaf: the operator (depends on type / field).

        • valueany

          Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

        • resolved_groupsarray of object

          Read-only, in form_view: the groups a group leaf names.

          resolved_groups fields
          • idstring
          • display_namestring
          • statestring
        • resolved_peoplearray of object

          Read-only, in form_view: the people a person leaf names.

          resolved_people fields
          • idstring
          • display_namestring
          • emailstring
          • statestring
        • resolved_devicesarray of object

          Read-only, in form_view: the devices a device leaf names.

          resolved_devices fields
          • idstring
          • display_namestring
          • statestring
      • excludearray of ConditionNoderequired

        Who is excluded (the negated OR list).

        exclude fields
        • opstring

          Group node: how the children combine.

          One of: and, or.

        • negateboolean

          Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

        • childrenarray of ConditionNode

          Group node: the child nodes.

        • typestring

          Leaf: what is tested.

          One of: group, person, device, posture, network, time, mfa, app, attribute.

        • fieldstring

          Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

        • operatorstring

          Leaf: the operator (depends on type / field).

        • valueany

          Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

        • resolved_groupsarray of object

          Read-only, in form_view: the groups a group leaf names.

          resolved_groups fields
          • idstring
          • display_namestring
          • statestring
        • resolved_peoplearray of object

          Read-only, in form_view: the people a person leaf names.

          resolved_people fields
          • idstring
          • display_namestring
          • emailstring
          • statestring
        • resolved_devicesarray of object

          Read-only, in form_view: the devices a device leaf names.

          resolved_devices fields
          • idstring
          • display_namestring
          • statestring
    • versionintegerrequired

      Send as If-Match on PATCH and DELETE.

    • created_atstring (date-time)
    • updated_atstring (date-time)
  • next_cursorstring | null

    Opaque cursor for the next page; null on the last page.

400 invalid-limit invalid-cursor

invalid-limit: limit is not a whole number of at least 1.

invalid-cursor: cursor is not a next_cursor from this list.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules" -Headers $headers
Python
import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "items": [
    {
      "id": "tr_4m8s2k0x9q",
      "name": "Company laptops",
      "match": {
        "op": "and",
        "children": [
          {
            "type": "posture",
            "field": "computer_type",
            "operator": "in",
            "value": [
              "domain"
            ]
          },
          {
            "type": "posture",
            "field": "disk_encrypted",
            "operator": "eq",
            "value": true
          },
          {
            "type": "posture",
            "field": "edr_present",
            "operator": "eq",
            "value": true
          }
        ]
      },
      "enabled": true,
      "form_representable": true,
      "form_view": {
        "include": [],
        "require": [
          {
            "type": "posture",
            "field": "computer_type",
            "operator": "in",
            "value": [
              "domain"
            ]
          },
          {
            "type": "posture",
            "field": "disk_encrypted",
            "operator": "eq",
            "value": true
          },
          {
            "type": "posture",
            "field": "edr_present",
            "operator": "eq",
            "value": true
          }
        ],
        "exclude": []
      },
      "version": 2,
      "created_at": "2026-09-20T09:00:00.000Z",
      "updated_at": "2026-10-13T09:24:11.000Z"
    }
  ],
  "next_cursor": null
}

Create a trust rule

POST/v0/tenants/{tenant_id}/trust-rules

full-access tokenidempotent

Creates a trust rule and re-evaluates every device right away. Devices that become trusted or untrusted get their access updated immediately and raise an alert. Use Test a draft trust rule first to see who would gain or lose trust. Audited.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key to retry safely — the same key and body within 24 h returns the first answer.

Conditions use the same tree as access rules (see Create an access rule). In trust rules group not_in, os_in and network leaves are evaluated too; time, mfa, app and attribute leaves are never met yet.

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Headers

  • Idempotency-Keystring

    A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.

    Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

  • namestringrequired

    1-128 characters.

  • matchConditionNoderequired

    One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

    match fields
    • opstring

      Group node: how the children combine.

      One of: and, or.

    • negateboolean

      Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

    • childrenarray of ConditionNode

      Group node: the child nodes.

    • typestring

      Leaf: what is tested.

      One of: group, person, device, posture, network, time, mfa, app, attribute.

    • fieldstring

      Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

    • operatorstring

      Leaf: the operator (depends on type / field).

    • valueany

      Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

    • resolved_groupsarray of object

      Read-only, in form_view: the groups a group leaf names.

      resolved_groups fields
      • idstring
      • display_namestring
      • statestring
    • resolved_peoplearray of object

      Read-only, in form_view: the people a person leaf names.

      resolved_people fields
      • idstring
      • display_namestring
      • emailstring
      • statestring
    • resolved_devicesarray of object

      Read-only, in form_view: the devices a device leaf names.

      resolved_devices fields
      • idstring
      • display_namestring
      • statestring
  • enabledboolean

    Default true.

Responses

201 The rule.

application/json

  • idstringrequired

    Trust rule id.

  • namestringrequired

    1-128 characters.

  • matchConditionNoderequired

    One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

    match fields
    • opstring

      Group node: how the children combine.

      One of: and, or.

    • negateboolean

      Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

    • childrenarray of ConditionNode

      Group node: the child nodes.

    • typestring

      Leaf: what is tested.

      One of: group, person, device, posture, network, time, mfa, app, attribute.

    • fieldstring

      Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

    • operatorstring

      Leaf: the operator (depends on type / field).

    • valueany

      Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

    • resolved_groupsarray of object

      Read-only, in form_view: the groups a group leaf names.

      resolved_groups fields
      • idstring
      • display_namestring
      • statestring
    • resolved_peoplearray of object

      Read-only, in form_view: the people a person leaf names.

      resolved_people fields
      • idstring
      • display_namestring
      • emailstring
      • statestring
    • resolved_devicesarray of object

      Read-only, in form_view: the devices a device leaf names.

      resolved_devices fields
      • idstring
      • display_namestring
      • statestring
  • enabledbooleanrequired

    Disabled rules are ignored.

  • form_representableboolean
  • form_viewRuleFormView

    The rule read as the console's simple form: Include / Require / Except. Present only when form_representable is true.

    form_view fields
    • includearray of ConditionNoderequired

      Who the rule applies to (one OR list): group / person / device / simple attribute leaves, decorated with resolved_groups, resolved_people or resolved_devices.

      include fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • requirearray of ConditionNoderequired

      Conditions that must all hold (posture, time, mfa, attribute).

      require fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • excludearray of ConditionNoderequired

      Who is excluded (the negated OR list).

      exclude fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
  • versionintegerrequired

    Send as If-Match on PATCH and DELETE.

  • created_atstring (date-time)
  • updated_atstring (date-time)
400 invalid-trust-rule

invalid-trust-rule: The body fails validation; detail lists every problem as path: message.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

409 idempotency-key-reuse

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Company laptops",
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  }
}'
PowerShell
$body = @'
{
  "name": "Company laptops",
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  }
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
        "name": "Company laptops",
        "match": {
            "op": "and",
            "children": [
                {
                    "type": "posture",
                    "field": "computer_type",
                    "operator": "in",
                    "value": [
                        "domain"
                    ]
                },
                {
                    "type": "posture",
                    "field": "disk_encrypted",
                    "operator": "eq",
                    "value": True
                },
                {
                    "type": "posture",
                    "field": "edr_present",
                    "operator": "eq",
                    "value": True
                }
            ]
        }
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "Company laptops",
    "match": {
      "op": "and",
      "children": [
        {
          "type": "posture",
          "field": "computer_type",
          "operator": "in",
          "value": [
            "domain"
          ]
        },
        {
          "type": "posture",
          "field": "disk_encrypted",
          "operator": "eq",
          "value": true
        },
        {
          "type": "posture",
          "field": "edr_present",
          "operator": "eq",
          "value": true
        }
      ]
    }
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 201 · application/json
{
  "id": "tr_4m8s2k0x9q",
  "name": "Company laptops",
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  },
  "enabled": true,
  "form_representable": true,
  "form_view": {
    "include": [],
    "require": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ],
    "exclude": []
  },
  "version": 1,
  "created_at": "2026-09-20T09:00:00.000Z",
  "updated_at": "2026-09-20T09:00:00.000Z"
}

Test a draft trust rule

POST/v0/tenants/{tenant_id}/trust-rules:evaluate

read-only token

Validates a draft trust rule without saving it and shows which devices it matches now, and who would gain or lose trust compared with today (other enabled rules still count; devices an admin marked manually or quarantined are left out). When editing a rule, pass its id as replaces so its current version is not counted.

Token: read-only or full access · Created by: owner or security admin

Validation problems come back as compiles: false with errors (status 200).

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

Request body application/json

  • matchConditionNoderequired

    One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

    match fields
    • opstring

      Group node: how the children combine.

      One of: and, or.

    • negateboolean

      Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

    • childrenarray of ConditionNode

      Group node: the child nodes.

    • typestring

      Leaf: what is tested.

      One of: group, person, device, posture, network, time, mfa, app, attribute.

    • fieldstring

      Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

    • operatorstring

      Leaf: the operator (depends on type / field).

    • valueany

      Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

    • resolved_groupsarray of object

      Read-only, in form_view: the groups a group leaf names.

      resolved_groups fields
      • idstring
      • display_namestring
      • statestring
    • resolved_peoplearray of object

      Read-only, in form_view: the people a person leaf names.

      resolved_people fields
      • idstring
      • display_namestring
      • emailstring
      • statestring
    • resolved_devicesarray of object

      Read-only, in form_view: the devices a device leaf names.

      resolved_devices fields
      • idstring
      • display_namestring
      • statestring
  • replacesstring | null

    Id of the trust rule this draft would replace.

Responses

200 The dry-run result.

application/json

  • compilesbooleanrequired
  • errorsarray of objectrequired
    errors fields
    • pathstring
    • messagestring
  • form_representableboolean
  • form_viewRuleFormView

    The rule read as the console's simple form: Include / Require / Except. Present only when form_representable is true.

    form_view fields
    • includearray of ConditionNoderequired

      Who the rule applies to (one OR list): group / person / device / simple attribute leaves, decorated with resolved_groups, resolved_people or resolved_devices.

      include fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • requirearray of ConditionNoderequired

      Conditions that must all hold (posture, time, mfa, attribute).

      require fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • excludearray of ConditionNoderequired

      Who is excluded (the negated OR list).

      exclude fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
  • match_countintegerrequired

    Devices the draft matches right now.

  • sample_matchesarray of TrustRuleDevice

    Up to 10 of them.

    sample_matches fields
    • device_idstring
    • device_namestring | null
    • personstring | null
    • osstring | null
    • trust_nowstring

      One of: trusted, untrusted.

    • trust_sourcestring
    • reasonstring
  • would_gainarray of TrustRuleDevicerequired

    Devices that would become trusted with this draft (other enabled rules still count).

    would_gain fields
    • device_idstring
    • device_namestring | null
    • personstring | null
    • osstring | null
    • trust_nowstring

      One of: trusted, untrusted.

    • trust_sourcestring
    • reasonstring
  • would_losearray of TrustRuleDevicerequired

    Devices that would stop being trusted (only when replaces names a rule being edited).

    would_lose fields
    • device_idstring
    • device_namestring | null
    • personstring | null
    • osstring | null
    • trust_nowstring

      One of: trusted, untrusted.

    • trust_sourcestring
    • reasonstring
401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl
curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules:evaluate" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  },
  "replaces": "tr_4m8s2k0x9q"
}'
PowerShell
$body = @'
{
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  },
  "replaces": "tr_4m8s2k0x9q"
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules:evaluate" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules:evaluate",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "match": {
            "op": "and",
            "children": [
                {
                    "type": "posture",
                    "field": "computer_type",
                    "operator": "in",
                    "value": [
                        "domain"
                    ]
                },
                {
                    "type": "posture",
                    "field": "disk_encrypted",
                    "operator": "eq",
                    "value": True
                },
                {
                    "type": "posture",
                    "field": "edr_present",
                    "operator": "eq",
                    "value": True
                }
            ]
        },
        "replaces": "tr_4m8s2k0x9q"
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules:evaluate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "match": {
      "op": "and",
      "children": [
        {
          "type": "posture",
          "field": "computer_type",
          "operator": "in",
          "value": [
            "domain"
          ]
        },
        {
          "type": "posture",
          "field": "disk_encrypted",
          "operator": "eq",
          "value": true
        },
        {
          "type": "posture",
          "field": "edr_present",
          "operator": "eq",
          "value": true
        }
      ]
    },
    "replaces": "tr_4m8s2k0x9q"
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "compiles": true,
  "errors": [],
  "form_representable": true,
  "form_view": {
    "include": [],
    "require": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ],
    "exclude": []
  },
  "match_count": 12,
  "sample_matches": [
    {
      "device_id": "dvc_5mxq2b7r8k",
      "device_name": "FIN-LT-014",
      "person": "Dana Levi",
      "os": "Windows 11 Pro 24H2",
      "trust_now": "trusted",
      "trust_source": "rule",
      "reason": "matched trust rule \"Company laptops\""
    }
  ],
  "would_gain": [],
  "would_lose": [
    {
      "device_id": "dvc_8k0s2m9x4q",
      "device_name": "HR-LT-003",
      "person": "Omer Katz",
      "os": "Windows 11 Pro",
      "trust_now": "trusted",
      "trust_source": "rule",
      "reason": "matched trust rule \"Company laptops\""
    }
  ]
}

Update a trust rule

PATCH/v0/tenants/{tenant_id}/trust-rules/{rule_id}

full-access token

Changes name, match and/or enabled (a non-boolean enabled is ignored). Every device is re-evaluated right away. Requires If-Match. Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • rule_idstringrequired

    Trust rule id (from List trust rules).

    Example: tr_4m8s2k0x9q

Headers

  • If-Matchstringrequired

    The rule's current version (from a GET or the last write). Required: without it the call answers 428 if-match-required; with a stale value 409 version-conflict.

    Example: 3

Request body application/json

  • namestring

    1-128 characters.

  • matchConditionNode

    One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

    match fields
    • opstring

      Group node: how the children combine.

      One of: and, or.

    • negateboolean

      Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

    • childrenarray of ConditionNode

      Group node: the child nodes.

    • typestring

      Leaf: what is tested.

      One of: group, person, device, posture, network, time, mfa, app, attribute.

    • fieldstring

      Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

    • operatorstring

      Leaf: the operator (depends on type / field).

    • valueany

      Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

    • resolved_groupsarray of object

      Read-only, in form_view: the groups a group leaf names.

      resolved_groups fields
      • idstring
      • display_namestring
      • statestring
    • resolved_peoplearray of object

      Read-only, in form_view: the people a person leaf names.

      resolved_people fields
      • idstring
      • display_namestring
      • emailstring
      • statestring
    • resolved_devicesarray of object

      Read-only, in form_view: the devices a device leaf names.

      resolved_devices fields
      • idstring
      • display_namestring
      • statestring
  • enabledboolean

Responses

200 The updated rule.

application/json

  • idstringrequired

    Trust rule id.

  • namestringrequired

    1-128 characters.

  • matchConditionNoderequired

    One node of a condition tree: a group node (op + children) or a leaf (type + operator + value). See the table in Create an access rule.

    match fields
    • opstring

      Group node: how the children combine.

      One of: and, or.

    • negateboolean

      Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

    • childrenarray of ConditionNode

      Group node: the child nodes.

    • typestring

      Leaf: what is tested.

      One of: group, person, device, posture, network, time, mfa, app, attribute.

    • fieldstring

      Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

    • operatorstring

      Leaf: the operator (depends on type / field).

    • valueany

      Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

    • resolved_groupsarray of object

      Read-only, in form_view: the groups a group leaf names.

      resolved_groups fields
      • idstring
      • display_namestring
      • statestring
    • resolved_peoplearray of object

      Read-only, in form_view: the people a person leaf names.

      resolved_people fields
      • idstring
      • display_namestring
      • emailstring
      • statestring
    • resolved_devicesarray of object

      Read-only, in form_view: the devices a device leaf names.

      resolved_devices fields
      • idstring
      • display_namestring
      • statestring
  • enabledbooleanrequired

    Disabled rules are ignored.

  • form_representableboolean
  • form_viewRuleFormView

    The rule read as the console's simple form: Include / Require / Except. Present only when form_representable is true.

    form_view fields
    • includearray of ConditionNoderequired

      Who the rule applies to (one OR list): group / person / device / simple attribute leaves, decorated with resolved_groups, resolved_people or resolved_devices.

      include fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • requirearray of ConditionNoderequired

      Conditions that must all hold (posture, time, mfa, attribute).

      require fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
    • excludearray of ConditionNoderequired

      Who is excluded (the negated OR list).

      exclude fields
      • opstring

        Group node: how the children combine.

        One of: and, or.

      • negateboolean

        Group node: true on an or node marks an exclude list ("anyone except …"). Not enforceable in access rules.

      • childrenarray of ConditionNode

        Group node: the child nodes.

      • typestring

        Leaf: what is tested.

        One of: group, person, device, posture, network, time, mfa, app, attribute.

      • fieldstring

        Leaf: the sub-field for posture, network, mfa (and the attribute name for attribute).

      • operatorstring

        Leaf: the operator (depends on type / field).

      • valueany

        Leaf: the operand — a list of ids, a boolean, a list of codes, {tz,start,end}, {from,to}, …

      • resolved_groupsarray of object

        Read-only, in form_view: the groups a group leaf names.

        resolved_groups fields
        • idstring
        • display_namestring
        • statestring
      • resolved_peoplearray of object

        Read-only, in form_view: the people a person leaf names.

        resolved_people fields
        • idstring
        • display_namestring
        • emailstring
        • statestring
      • resolved_devicesarray of object

        Read-only, in form_view: the devices a device leaf names.

        resolved_devices fields
        • idstring
        • display_namestring
        • statestring
  • versionintegerrequired

    Send as If-Match on PATCH and DELETE.

  • created_atstring (date-time)
  • updated_atstring (date-time)
400 invalid-trust-rule

invalid-trust-rule: The body fails validation; detail lists every problem as path: message.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 trust-rule-not-found tenant-not-found

trust-rule-not-found: No trust rule with this id.

tenant-not-found: No workspace with this id.

409 version-conflict

version-conflict: If-Match does not match the rule's current version (someone changed it meanwhile; re-read and retry).

428 if-match-required

if-match-required: No If-Match header was sent.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X PATCH "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "enabled": false
}'
PowerShell
$body = @'
{
  "enabled": false
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Patch -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q" -Headers $headers -ContentType "application/json" -Body $body
Python
import os, uuid, requests

r = requests.patch(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "enabled": False
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "enabled": false
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());
Response 200 · application/json
{
  "id": "tr_4m8s2k0x9q",
  "name": "Company laptops",
  "match": {
    "op": "and",
    "children": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ]
  },
  "enabled": false,
  "form_representable": true,
  "form_view": {
    "include": [],
    "require": [
      {
        "type": "posture",
        "field": "computer_type",
        "operator": "in",
        "value": [
          "domain"
        ]
      },
      {
        "type": "posture",
        "field": "disk_encrypted",
        "operator": "eq",
        "value": true
      },
      {
        "type": "posture",
        "field": "edr_present",
        "operator": "eq",
        "value": true
      }
    ],
    "exclude": []
  },
  "version": 3,
  "created_at": "2026-09-20T09:00:00.000Z",
  "updated_at": "2026-10-13T09:24:11.000Z"
}

Delete a trust rule

DELETE/v0/tenants/{tenant_id}/trust-rules/{rule_id}

full-access token

Deletes the rule and re-evaluates every device right away; devices trusted only through this rule become untrusted. Requires If-Match. Audited.

Token: full access · Created by: owner

Path parameters

  • tenant_idstringrequired

    Your workspace id (Settings → Workspace in the console; it is also in every console URL).

    Example: tq7x2m9k4ab

  • rule_idstringrequired

    Trust rule id (from List trust rules).

    Example: tr_4m8s2k0x9q

Headers

  • If-Matchstringrequired

    The rule's current version (from a GET or the last write). Required: without it the call answers 428 if-match-required; with a stale value 409 version-conflict.

    Example: 3

Responses

202 Deleted (state: done).

application/json

  • idstringrequired
  • tenant_idstring
  • statestringrequired

    One of: pending, running, done, failed.

  • result_uristring | null
  • errorobject | string | null

    Why it failed, or a short status note (e.g. revoke_pending).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 trust-rule-not-found tenant-not-found

trust-rule-not-found: No trust rule with this id.

tenant-not-found: No workspace with this id.

409 version-conflict

version-conflict: If-Match does not match the rule's current version (someone changed it meanwhile; re-read and retry).

428 if-match-required

if-match-required: No If-Match header was sent.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl
curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"
PowerShell
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q" -Headers $headers
Python
import os, uuid, requests

r = requests.delete(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.status_code)
Node.js
const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/trust-rules/tr_4m8s2k0x9q", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);
Response 202 · application/json
{
  "id": "task_8k2x0m9s1d",
  "tenant_id": "tq7x2m9k4ab",
  "state": "done",
  "result_uri": null,
  "error": null
}