Changelog

Keep track of every change to the Kolide API

This changelog lists additions and updates to the Kolide API, in chronological order.

July 9th, 2026

• Add a poll_bearer_token rotation endpoint for SSF polling streams: POST /ssf_streams/{id}/rotate_poll_token. Rotate without recreating the stream — the stream_id, configuration, and event history are preserved. Pass mode: overlap (new token issued while the current one keeps working for overlap_seconds, 1–86400, for zero-downtime rollout), immediate (new token, current one invalidated at once), or disable (revoke without a replacement; the stream can’t be polled until you rotate again). The new token is revealed once in the response for overlap and immediate.

June 25th, 2026

• Improve SSF (Shared Signals Framework) verification spec compliance. The /.well-known/ssf-configuration verification_endpoint is now a concrete URL (https://api.kolide.com/ssf_streams/verify) rather than a path template. Trigger verification by POSTing to that endpoint with stream_id in the request body, per OpenID SSF 1.0 §7.1.3.1; an optional state correlation value is echoed back and included in the delivered verification event.

June 2nd, 2026

• Add GET /custom_check_drafts endpoint. This read-only endpoint is only available in the 2026-04-07 API version and returns the Custom Check Drafts in your account, including their osquery SQL, notification templates, publish status, and validation statuses.

May 5th, 2026

• Add per-stream bearer token authentication for SSF polling streams. When a polling stream is created through POST /ssf_streams, the response now includes a poll_bearer_token field. This token is returned once and must be stored securely — it will not be shown again. All subsequent requests to the GET /ssf_streams/{streamId}/events and POST /ssf_streams/{streamId}/events endpoints must include the token in an X-Kolide-Poll-Bearer-Token header. Existing polling streams created before this change are not affected.
• Enforce HTTPS and block private network targets for SSF push stream delivery URLs. The aud field on push streams now requires a valid https:// URL. URLs using http://, targeting localhost, loopback addresses (127.x.x.x), or RFC 1918 private ranges (10.x.x.x, 192.168.x.x, 172.16–31.x.x) will be rejected with a validation error.

April 28th, 2026

• Improve SSF (Shared Signals Framework) spec compliance. The /.well-known/ssf-configuration discovery endpoint now advertises configuration_endpoint and verification_endpoint as required by the SSF spec. Push streams now support an authorization_header field — when set, Kolide includes it as the Authorization header on every SET delivery to that stream’s endpoint, enabling push receivers that require authentication.
• Fix SSF stream API responses where the delivery field was returned as a JSON string instead of an object. If you worked around this by parsing the delivery field manually, that workaround can now be removed.

April 20th, 2026

• Add percent_passing field to GET /checks and GET /checks/{id}. This integer (0–100) represents the percentage of targeted devices currently passing the check, enabling programmatic compliance monitoring and alerting workflows.

April 7th, 2026

• Add new API version, 2026-04-07. This new version of the API omits the results field on reporting/queries and reporting/queries/{id}. Query results can be retrived at reporting/queries/{queryId}/results

April 2nd, 2026

• Add searchable_fields to GET /reporting/tables and GET /reporting/tables/{name} responses, listing the fields available for filtering on each table.
• Add query parameter support to GET /reporting/tables/{tableName}/table_records for filtering results using the standard search syntax (for example query=device_id:123). Device tables support device_id, check tables support check_id, and person tables support person_id.

February 2nd, 2026

• Add last_seen_at field to GET /devices and GET /devices/{id}. This timestamp indicates when the device last communicated with the Kolide servers.

October 13th, 2025

• Add people/{personId}/person_groups endpoint.

October 3rd, 2025

• Add person_groups/{personGroupId}/people endpoint.

August 5th, 2025

• Add searchable person_name field in the /auth_logs endpoint.
• Add searchable person_email field in the /auth_logs endpoint.
• Add searchable person_id field in the /auth_logs endpoint.
• Add searchable device_id field in the /auth_logs endpoint.
• Add searchable result field in the /auth_logs endpoint.

July 24th, 2025

• Add reporting/queries/{queryId}/results endpoint providing paginated reporting query results.
• Allow omitting results in the /reporting/queries and /reporting/queries/{id} endpoints through the omit_results=1 URL query parameter. API responses may time out for reporting queries with large resultsets. In such cases, results can be omitted from these responses by including a URL query parameter of omit_results=1. To retrieve query resultsets in a paginated fashion, use the new /reporting/queries/{queryId}/results endpoint.

March 14th, 2025

• Add searchable device_display_name field in the checks/{checkId}/results/ endpoint.
• Add searchable device_display_name field in the devices/{deviceId}/check_results/ endpoint.
• Add searchable check_name field in the checks/{checkId}/results/ endpoint.
• Add searchable check_name field in the devices/{deviceId}/check_results/ endpoint.
• Add searchable status field in the checks/{checkId}/results/ endpoint.
• Add searchable status field in the devices/{deviceId}/check_results/ endpoint.

February 4th, 2025

• Add searchable id field in the /people endpoint.

January 21st, 2025

• Add whoami/ endpoint.

January 17th, 2025

• Add devices/{deviceId}/check_results/ endpoint.

December 12th, 2024

• Add kolide_provided field in the /checks endpoint.

November 19th, 2024

• Add updatable options field to the checks/{checkId}/configurations/ endpoint.

November 14th, 2024

• Add update support to the checks/{checkId}/configurations/ endpoint.

October 21st, 2024

• Add checks/{checkId}/configurations/ endpoint.

October 3rd, 2024

• Add checks/{checkId}/results/ endpoint.

September 11th, 2024

• Add support for device_trust.status_changed webhooks. This event is sent when a device’s authentication status changes.

September 6th, 2024

• Add searchable check_slug field in the checks endpoint.

July 24th, 2024

• Add osquery_sql_template, issue_title, fix_instructions_template, and rationale_template fields to GET /checks and GET /checks/{checkId} endpoints.

July 2nd, 2024

• Add support for deleting Live Query campaigns

June 27th, 2024

• Add more detailed ‘actor’ information to audit_logs list and show endpoints.

June 21st, 2024

• Add support for admin_users.created webhook events. This event is sent when a new admin user is created.

June 17th, 2024

Bug fix: This makes the responses match the documented types.

• Make sure identifier on registered_owner_info is a string for GET /devices and GET /devices/{id}.
• Make sure identifier on registered_owner_info and device_info are a string for DELETE /devices/{deviceId}/registration.
• Make sure identifier on requester_information, device_information, and issues are a string for GET /exemption_requests, GET /exemption_requests/{id}, PATCH /exemption_requests/{id}, and PUT /exemption_requests/{id}.
• Make sure identifier on device_information and check_information are a string for GET /issues and GET /issues/{id}
• Make sure identifier on device_information is a string for GET /live_query_campaigns/{liveQueryCampgainId}/query_results
• Make sure identifier on requester_information and device_information are a string for GET /registration_requests, GET /registration_requests/{id}, PATCH /registration_requests/{id}, and PUT /registration_requests/{id}

June 15th, 2024

• Deprecate internal_denial_reason in favor of internal_message for PATCH /registration_requests/{id} to support adding a note when approving requests. More details.

June 3rd, 2024

• Add create support to /live_query_campaigns endpoint.
• Add update support to /live_query_campaigns endpoint.

March 28th, 2024

• Add people/{personId}/open_issues/ endpoint.

March 21st, 2024

• Add support for auth_logs.failure webhooks. This event is sent when an end-user attempts to authenticate through Kolide but never successfully finishes the authentication attempt.

March 12th, 2024

• Add will_block_at filtering to /devices endpoint.

March 11th, 2024

• Add support for auth_logs.success webhooks. This event is sent when an end-user successfully completes an SSO authentication through Kolide.

March 5th, 2024

• Add searchable last_rechecked_at field in the issues endpoint.

January 22nd, 2024

• Add /packages and /packages/{id} endpoints for information about agent installation packages.

By accessing or using 1Password Developer Tools, you agree to the API and SDK Terms of Service.

Glad to hear it! If you have anything you'd like to add, feel free to contact us.

Sorry to hear that. Please contact us if you'd like to provide more details.