Query device application instances.

POST

/devices/apps/instances

Query and filter device application instances.
An instance is an installation of an application on a specific device by a specific user.
Removed installs are included; filter on removed_time IS NULL for current installs.

Note that the risk score for an application instance is not the same as the application risk score.
The application risk score is the inherent risk of the application itself, while the instance risk score reflects the risk of that application being installed on that specific device.

Relations:

device (Device): The device the application instance is on

employee (Person): The person who owns the device the application instance is on

application (DeviceApplication): The device application this is an instance of

Additional Filters:

employee_organization (string): Filter by employee's organization/team

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/devices/apps/instances' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

200 - Example 1

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "allowlisted": true,
            "application_id": "030B484C-F0F3-46C7-B86A-9D02BF160DAA",
            "application_name": "VS Code",
            "device_id": "030B484C-F0F3-46C7-B86A-9D02BF160DAA",
            "employee_email": "joe.smith@example.com",
            "employee_name": "Joe Smith",
            "first_seen": "2021-01-01T00:00:00Z",
            "high_prevalence": true,
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "removed_time": "2019-08-24T14:15:22.123Z",
            "risk_score": 9.2,
            "version": "25.5.4.2"
        }
    ]
}

Modified at 2026-10-21 15:09:25

Get a device application

List device infections