In REST architecture, after you send a request, your server returns response data. This response includes:

  • An HTTP status code.

  • Data in the form of JSON code blocks. The content of this JSON depends between API requests.

JSON responses may contain different objects with various data. These differ from response to response.

Error Codes

The Cybereason API uses the following error codes:




200 OK

Successful response. This indicates that the server processed the request without issue. Note this does not always mean that the server returns data.


The server was able to receive and run the request but there is no content in the response body.




400 Bad Request

This means that the request is not well-formed, contains syntactically incorrect information, violates schema, or does not match existing information. Ensure that your request body uses the required information.

403 Forbidden

You are not authorized to access this endpoint. This may happen even if you use valid logon credentials.

404 Not found

The server cannot find anything with the specified URL. Make sure you send the request to the correct URL and URI.

422 Unprocessible entity

The format of the request JSON is correct but the content is not present.

Response Examples

The following examples show different responses received by the Cybereason API.

View all actions currently in progress or waiting on a Sensor

              "batchId": 32260991,
              "actionType": "InstallPrevention",
              "actionArguments": null,
              "globalStats": {
                  "stats": {
                      "UnknownProbe": 0,
                      "partialResponse": 0,
                      "EndedWithUnknownError": 0,
                      "Pending": 0,
                      "ProbeRemoved": 0,
                      "None": 0,
                      "Disconnected": 0,
                      "InvalidState": 0,
                      "EndedWithSensorTimeout": 0,
                      "InProgress": 0,
                      "Timeout": 0,
                      "Succeeded": 1,
                      "UnauthorizedUser": 0,
                      "Primed": 0,
                      "NotSupported": 0,
                      "EndedWithTooManySearches": 0,
                      "Started": 0,
                      "GettingChunks": 0,
                      "MsiFileCorrupted": 0,
                      "AlreadyUpdated": 0,
                      "AbortTimeout": 0,
                      "Aborted": 0,
                      "EndedWithTooManyResults": 0,
                      "SendingMsi": 0,
                      "FailedSending": 0,
                      "ChunksRequired": 0,
                      "FailedSendingToServer": 0,
                      "EndedWithInvalidParam": 0,
                      "TimeoutSending": 0,
                      "NewerInstalled": 0,
                      "Failed": 0,
                      "MsiSendFail": 0
              "finalState": true,
              "totalNumberOfProbes": 1,
              "initiatorUser": "[email protected]",
              "startTime": 1517749766180,
              "aborterUser": null,
              "abortTime": 0,
              "abortTimeout": false,
              "abortHttpStatusCode": null

View a failure in setting an isolation rule

    "message:": "Rule update failure",
    "result": "The selected isolation rule does not exist"