> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Get compliance alerts, optionally narrowed by a filter
> Return the paginated list of active compliance alerts, narrowed by a `filter` — THE tool to answer any targeted question about non-compliance ("which macOS devices are not encrypted", "who owns the offline devices"). Send an empty body to list everything. Every `filter` entry is keyed by a `key` from `getComplianceAlertsFilterCatalog` (`GET /compliance/alerts/filters-options`) and its value is always a clause `{ "operationType": "INCLUDE" | "EXCLUDE", "values": [...] }` — never a bare value, never an operator like `eq`. Criteria are ANDed. Example: non-encrypted macOS devices → `{"filter":{"platform":{"operationType":"INCLUDE","values":["MACOS"]},"status":{"operationType":"INCLUDE","values":["NOT_ENCRYPTED"]}}}`. An unknown key is rejected with 400 — the criterion is never silently ignored. Each alert already carries its device name, platform and owner, so no per-row `getDevice` chaining is needed. `ownerId` values are employee ids — resolve them with `getEmployees`.
Key: ReadScope: Company
## OpenAPI
````yaml https://api.getprimo.com/openapi.json post /compliance/alerts/search
openapi: 3.1.1
info:
title: Public API - BETA
description: Read docs on https://docs.getprimo.com/
version: '1.0'
contact: {}
servers:
- url: https://api.getprimo.com
security:
- apikey: []
tags: []
paths:
/compliance/alerts/search:
post:
tags:
- Compliance
summary: Get compliance alerts, optionally narrowed by a filter
description: >-
Return the paginated list of active compliance alerts, narrowed by a
`filter` — THE tool to answer any targeted question about non-compliance
("which macOS devices are not encrypted", "who owns the offline
devices"). Send an empty body to list everything. Every `filter` entry
is keyed by a `key` from `getComplianceAlertsFilterCatalog` (`GET
/compliance/alerts/filters-options`) and its value is always a clause `{
"operationType": "INCLUDE" | "EXCLUDE", "values": [...] }` — never a
bare value, never an operator like `eq`. Criteria are ANDed. Example:
non-encrypted macOS devices →
`{"filter":{"platform":{"operationType":"INCLUDE","values":["MACOS"]},"status":{"operationType":"INCLUDE","values":["NOT_ENCRYPTED"]}}}`.
An unknown key is rejected with 400 — the criterion is never silently
ignored. Each alert already carries its device name, platform and owner,
so no per-row `getDevice` chaining is needed. `ownerId` values are
employee ids — resolve them with `getEmployees`.
operationId: searchComplianceAlerts
parameters: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/SearchComplianceAlertsBody'
responses:
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/GetComplianceAlerts_Output'
components:
schemas:
SearchComplianceAlertsBody:
type: object
properties:
page:
default: 1
type: integer
minimum: 1
maximum: 9007199254740991
perPage:
default: 50
type: integer
minimum: 1
maximum: 100
filter:
description: >-
One entry per criterion, keyed by the `key` returned by the filter
catalog (`GET /compliance/alerts/filters-options`). Every value is a
clause { operationType, values } — never a bare value, never an
operator like `eq`. Criteria are ANDed. An unknown key is rejected
with 400 rather than ignored.
type: object
properties:
deviceId:
type: object
properties:
operationType:
description: >-
INCLUDE keeps the alerts matching the values, EXCLUDE keeps
the alerts that do not.
type: string
enum:
- INCLUDE
- EXCLUDE
values:
description: Device ids, as returned by getDevices.
minItems: 1
type: array
items:
type: string
pattern: ^[a-f\d]{24}$
required:
- operationType
- values
platform:
type: object
properties:
operationType:
description: >-
INCLUDE keeps the alerts matching the values, EXCLUDE keeps
the alerts that do not.
type: string
enum:
- INCLUDE
- EXCLUDE
values:
description: Device platforms.
minItems: 1
type: array
items:
type: string
enum:
- ANDROID
- IOS
- IPADOS
- MACOS
- WINDOWS
- LINUX
- CHROME_OS
- UNKNOWN
required:
- operationType
- values
ownerId:
type: object
properties:
operationType:
description: >-
INCLUDE keeps the alerts matching the values, EXCLUDE keeps
the alerts that do not.
type: string
enum:
- INCLUDE
- EXCLUDE
values:
description: >-
Employee ids the devices are assigned to, as returned by
getEmployees.
minItems: 1
type: array
items:
type: string
pattern: ^[a-f\d]{24}$
required:
- operationType
- values
status:
type: object
properties:
operationType:
description: >-
INCLUDE keeps the alerts matching the values, EXCLUDE keeps
the alerts that do not.
type: string
enum:
- INCLUDE
- EXCLUDE
values:
description: Non-compliant statuses carried by the alert.
minItems: 1
type: array
items:
type: string
enum:
- NOT_ENCRYPTED
- NOT_UP_TO_DATE
- FAILED
- ERROR
- NOT_PROTECTED
- MDM_OFF
- MISSING_AGENT
- OFFLINE_7_DAYS
- OFFLINE
- PENDING
- MISSING_RECOVERY_KEY
- CREATION_PENDING
- CREATION_FAILED
- GRACE_PERIOD
- DEMOTION_PENDING
- MDM_ON_IN_ANOTHER_MDM
- READY_ZTD
- ACTION_REQUIRED
- BELOW_MINIMUM_VERSION
- UNSUPPORTED_OS_EDITION
- MISSING_BYPASS_CODE
required:
- operationType
- values
type:
type: object
properties:
operationType:
description: >-
INCLUDE keeps the alerts matching the values, EXCLUDE keeps
the alerts that do not.
type: string
enum:
- INCLUDE
- EXCLUDE
values:
description: Compliance rule types behind the alert.
minItems: 1
type: array
items:
type: string
enum:
- MDM_CONTROL_MALWAREBYTES
- MDM_CONTROL_RECOVERY_OS
- MDM_CONTROL_ENCRYPTION
- MDM_CONTROL_OS_UPDATE
- MDM_CONTROL_SOFTWARE_UPDATE
- MDM_CONTROL_WIFI
- MDM_CONTROL_ADMIN_USER_MANAGEMENT
- MDM_CONTROL_ADMIN_USER_PASSWORD_ROTATION
- MDM_CONTROL_DEVICE_NAMING
- MDM_CONTROL_GOOGLE_CHROME
- MDM_CONTROL_FIREWALL
- MDM_CONTROL_USB_BLOCKING
- MDM_CONTROL_ENTRA_SSO
- MDM_CONTROL_OKTA_SSO
- MDM_CONTROL_CUSTOM_FILE
- MDM_CONTROL_PASSWORD_POLICY
- MDM_CONTROL_SENTINEL_ONE
- MDM_CONTROL_RUSTDESK
- MDM_CONTROL_APP_BLOCKING
- MDM_CONTROL_DISABLE_PROFILES_PANE
- MDM_CONTROL_DISABLE_AIRDROP
- MDM_CONTROL_SCREEN_CAPTURE
- MDM_CONTROL_AIR_PRINT
- MDM_CONTROL_PRIMO_SSO
- MDM_CONTROL_WEB_CLIP
- MDM_ENROLLMENT
- MDM_ONLINE
- MDM_ICLOUD_LOCK_STATUS
- PRIMO_REQUIREMENT
required:
- operationType
- values
checkedAt:
type: object
properties:
operationType:
type: string
const: INCLUDE
values:
description: >-
Exactly one relative bucket of how long ago the device
compliance was last checked.
minItems: 1
maxItems: 1
type: array
items:
type: string
enum:
- UNDER_24_HOURS
- ONE_TO_SEVEN_DAYS
- SEVEN_TO_THIRTY_DAYS
- THIRTY_TO_NINETY_DAYS
- OVER_NINETY_DAYS
required:
- operationType
- values
additionalProperties: false
GetComplianceAlerts_Output:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
deviceId:
type: string
deviceName:
anyOf:
- type: string
- type: 'null'
devicePlatform:
anyOf:
- type: string
enum:
- ANDROID
- IOS
- IPADOS
- MACOS
- WINDOWS
- LINUX
- CHROME_OS
- UNKNOWN
- type: 'null'
owner:
description: Employee the alerting device is assigned to.
anyOf:
- type: object
properties:
id:
type: string
firstName:
type: string
lastName:
type: string
required:
- id
- firstName
- lastName
additionalProperties: false
- type: 'null'
complianceRuleId:
type: string
ruleType:
description: Type of the compliance rule behind the alert.
anyOf:
- type: string
- type: 'null'
mdmControlId:
anyOf:
- type: string
- type: 'null'
status:
type: string
enum:
- ACTIVE
- NOT_PROTECTED
- OFFLINE_7_DAYS
- PENDING
- PROTECTED
- FAILED
- NOT_ENCRYPTED
- MISSING_RECOVERY_KEY
- ENCRYPTED
- ACTION_REQUIRED
- GRACE_PERIOD
- UP_TO_DATE
- NOT_UP_TO_DATE
- ENFORCED
- ERROR
- CREATION_PENDING
- DEMOTION_PENDING
- CREATED
- CREATION_FAILED
- SUCCESS
- INSTALLED
- MDM_ON
- MDM_OFF
- MDM_ON_IN_ANOTHER_MDM
- READY_ZTD
- MISSING_AGENT
- ONLINE
- OFFLINE
- ENABLED
- DISABLED
- MISSING_BYPASS_CODE
- MEETS_REQUIREMENTS
- BELOW_MINIMUM_VERSION
- UNSUPPORTED_OS_EDITION
createdAt:
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
updatedAt:
description: When the compliance of the device was last checked.
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
required:
- id
- deviceId
- deviceName
- devicePlatform
- owner
- complianceRuleId
- ruleType
- mdmControlId
- status
- createdAt
- updatedAt
additionalProperties: false
pagination:
type: object
properties:
totalElements:
type: integer
minimum: 0
maximum: 9007199254740991
totalPages:
type: integer
minimum: 0
maximum: 9007199254740991
page:
type: integer
minimum: 1
maximum: 9007199254740991
perPage:
type: integer
minimum: 1
maximum: 100
required:
- totalElements
- totalPages
- page
- perPage
additionalProperties: false
required:
- data
- pagination
additionalProperties: false
securitySchemes:
apikey:
scheme: bearer
bearerFormat: API key
type: http
description: >-
Use your Primo API key in the Authorization header as `Bearer
`.
````