Warden API
Bramble Warden is RMM's security add-on: vulnerabilities on every device, patching (OS, applications and containers), hardening baselines, Cyber Essentials remediation, urgent advisories, Active Directory and Group Policy, customer security audits, and the SIEM (Logs & auditing). Warden's settings are in the Admin Centre API.
- Address
https://<your-org>.brambleit.cloud/warden- Sign-in
- Signed-in browser session (the
sso_session/session_idcookies from Bramble sign-in). - Endpoints
- 130
- OpenAPI
- warden.json
- Guides
- How Warden works
Signing in
These endpoints use a signed-in browser session. From your own systems, use Flows webhooks and Bramble steps, or the main API with an API key. See Calling the API.
Scope. Like RMM, list endpoints follow the site and group selector:
pass site_id and/or group_id in the query.
Issues, not CVEs. Warden counts an issue as one package to fix on one
device. A single kernel update can clear hundreds of CVEs, so CVE counts are
detail, not the headline. A finding's fix state is one of installable
(an update is available now), reboot (installed, waiting for a restart),
awaiting (a fix is announced but not yet in the device's repositories),
released, manual (needs a person) or none.
Changes go through jobs. Patching, removals, upgrades and hardening fixes are queued as jobs or plans that devices pick up on their next check-in; the endpoints return straight away and you follow progress with the job or plan endpoints.
Resources
Overview
The dashboard numbers, who you are and what you can do, lookup lists for filters, and recent activity.
| Method | Path | Summary |
|---|---|---|
| GET | /api/me | Who you are: the signed-in person and what they can do here |
| GET | /api/overview | Dashboard numbers |
| GET | /api/settings | Warden settings (read-only) |
| GET | /api/lookups | Lists for filters (sites, groups, packages…) |
| GET | /api/activity | Recent activity |
Vulnerabilities & findings
Vulnerable packages across the fleet (one row per package) and the individual findings (package × device × CVE). Mark findings accepted or false positive.
| Method | Path | Summary |
|---|---|---|
| GET | /api/vulnerabilities | List vulnerable packages |
| GET | /api/vulnerabilities/:package | One package's findings across devices |
| GET | /api/findings | List findings |
| POST | /api/findings/status | Accept or dismiss findings |
Devices
Warden's view of each device, excluding a device from checks, and rebooting it.
| Method | Path | Summary |
|---|---|---|
| GET | /api/devices | List devices with their issues |
| GET | /api/devices/:id | A device's findings, updates and history |
| POST | /api/devices/:id/reboot | Reboot a device now (clears the "reboot pending" upgrade blocker) |
| POST | /api/devices/:id/exclude | Exclude a device from Warden ("don't check"), or include it again |
| DELETE | /api/devices/:id/exclude | Include an excluded device again |
Scans
Start a vulnerability scan for one device or all, follow its progress, cancel it, and scan history.
| Method | Path | Summary |
|---|---|---|
| POST | /api/scan | Start a scan |
| GET | /api/scan/status | Live progress for the header bar |
| POST | /api/scan/cancel | Cancel the running scan (or one specific run) |
| GET | /api/scans | Scan history (Activity → Scans) |
Patching
Pending updates; patch jobs (security only, everything, chosen packages, or apps); patch policies that run on a schedule within a maintenance window; approvals for policies that need them; removing a package; OS release upgrades; and Windows Update profiles (categories, feature upgrades).
| Method | Path | Summary |
|---|---|---|
| GET | /api/updates | Pending updates across devices |
| POST | /api/approvals | Approve or reject updates waiting for approval |
| GET | /api/jobs | List patch jobs |
| GET | /api/jobs/:id | Get a patch job with per-device results |
| POST | /api/jobs | Start a patch job |
| POST | /api/patch/bulk | Patch everything that needs it |
| POST | /api/jobs/:id/cancel | Cancel a patch job |
| GET | /api/policies | List patch policies |
| POST | /api/policies | Create a patch policy |
| PUT | /api/policies/:id | Update a patch policy |
| DELETE | /api/policies/:id | Delete a patch policy |
| POST | /api/policies/:id/run | Run a patch policy now |
| POST | /api/removals | Plan removing a package |
| GET | /api/removals | List package removals |
| POST | /api/removals/:id/confirm | Confirm a package removal |
| POST | /api/removals/:id/cancel | Cancel a package removal |
| POST | /api/os-upgrades | Plan an OS release upgrade |
| GET | /api/os-upgrades | List OS upgrades |
| POST | /api/os-upgrades/:id/confirm | Confirm an OS upgrade |
| GET | /api/os-upgrades/:id/output | What the device printed, plus its release upgrade logs once fetched |
| POST | /api/os-upgrades/:id/logs | Fetch an upgrade's logs from the device |
| POST | /api/os-upgrades/:id/cancel | Cancel an OS upgrade |
| GET | /api/wu | Windows Update profiles |
| POST | /api/wu/profiles | Create a Windows Update profile |
| PUT | /api/wu/profiles/:id | Update a Windows Update profile |
| DELETE | /api/wu/profiles/:id | Delete a Windows Update profile |
Applications
Outdated applications across the fleet and the full application inventory.
| Method | Path | Summary |
|---|---|---|
| GET | /api/apps | Application patching: outdated apps across the fleet, one row per app |
| GET | /api/apps/inventory | Application inventory: every app found on devices (device_apps, built by the scanner from each device's report), one row per app, with how many devices have … |
| GET | /api/apps/inventory/devices | Devices that have an app |
Containers
Docker images on devices, their vulnerabilities, and starting, stopping, restarting or updating containers.
| Method | Path | Summary |
|---|---|---|
| GET | /api/containers | Every Docker image on the devices in scope, its containers and findings, plus which Docker hosts don't report image packages yet (agent < 6.23.0) |
| POST | /api/containers/actions | Start / stop / restart / update containers (lib/containeractions.js) |
| GET | /api/containers/actions/:id/output | Output of a container action |
| GET | /api/containers/:device/:image/findings | A container image's vulnerabilities |
Urgent alerts
Critical advisories and newly exploited CVEs that affect your devices, public notices from national security centres, and alerts you add yourself from a link.
| Method | Path | Summary |
|---|---|---|
| GET | /api/alerts | Critical advisories, newly exploited CVEs and people's own alerts, with where each device in scope stands: affected / possibly / patched / safe |
| GET | /api/notices | Public notices (lib/notices.js): everything NCSC / CERT-EU published about vulnerabilities, with the alert each one raised or joined |
| GET | /api/alerts/:id | Get an alert with affected devices |
| POST | /api/alerts/lookup | Reads a pasted link (NCSC / vendor notice) for the "Track an alert" form: its title, summary, CVE IDs and the distro advisories that cover them |
| POST | /api/alerts | Add an alert by hand |
| PUT | /api/alerts/:id | Update an alert |
| DELETE | /api/alerts/:id | Delete an alert |
| POST | /api/alerts/:id/dismiss | Archive or restore an alert |
| POST | /api/alerts/:id/recheck | Check devices against an alert again |
| POST | /api/alerts/:id/containers/accept | A container image on one device: accept this alert's findings in it until a newer image is out ({ device_id, image_id, undo }) |
Cyber Essentials
Cyber Essentials checks and remediation. A plan lists the fixes for chosen devices; you approve it, Warden applies it, and each item can be undone. Items that need a person can be marked done or dismissed.
| Method | Path | Summary |
|---|---|---|
| GET | /api/ce | Cyber Essentials status |
| GET | /api/remediation | List remediation plans |
| POST | /api/remediation | Plan Cyber Essentials fixes |
| GET | /api/remediation/items | Outstanding items across open plans (optionally ?control=firewall) |
| GET | /api/remediation/:id | Get a remediation plan |
| PATCH | /api/remediation/items/:id | Change a plan item |
| POST | /api/remediation/:id/approve | Approve and apply a plan |
| POST | /api/remediation/:id/discard | Discard a plan |
| POST | /api/remediation/items/:id/undo | Undo an applied fix |
| POST | /api/remediation/items/:id/done | Mark a manual item done |
| POST | /api/remediation/items/:id/dismiss | Dismiss an item |
| POST | /api/remediation/:id/apply | Apply more of an approved plan: unticked items, or retry failed ones |
| POST | /api/remediation/:id/close | Close a plan |
Hardening
Hardening baselines for Windows and Linux: a policy of rules per device type, results per device, planning and applying fixes (with undo), exceptions, and the standard as a Group Policy script for domain admins.
| Method | Path | Summary |
|---|---|---|
| GET | /api/baseline | Hardening overview |
| POST | /api/baseline/enable | Opt-in: Hardening checks run only for organisations that turned it on |
| GET | /api/baseline/policy | The Hardening policy: which rules, per device type, and applying it to a domain as GPOs |
| PUT | /api/baseline/policy | Update the hardening policy |
| POST | /api/baseline/policy/apply | Apply the hardening policy to a domain as Group Policy |
| POST | /api/baseline/policy/applies/:id/undo | Undo a Group Policy apply |
| GET | /api/baseline/platforms | Hardening by platform |
| GET | /api/baseline/platforms/:os | One platform's rules and devices |
| GET | /api/baseline/rules/:id | Get a hardening rule |
| POST | /api/baseline/policy/rules | Add rules to the policy, or take them out, for some device types |
| POST | /api/baseline/policy/apply-now | Apply the policy now on one platform's devices outside a domain (Warden fixes them itself) |
| GET | /api/baseline/devices/:id | A device's hardening results |
| PUT | /api/baseline/devices/:id/type | A Linux device's type (server / workstation) by hand, or null for detected |
| POST | /api/baseline/check | Check devices against the baseline now |
| POST | /api/baseline/plan | Plan hardening fixes |
| POST | /api/baseline/apply | Apply planned hardening fixes |
| POST | /api/baseline/undo | Undo hardening fixes on a device |
| GET | /api/baseline/standard | The Hardening policy as a script a domain admin can run instead of Apply |
| GET | /api/baseline/local-standard | The standard on Windows devices outside a domain (applied by Warden) |
| PUT | /api/baseline/local-standard | Set the standard for devices outside a domain |
| PUT | /api/baseline/exceptions | Add a hardening exception |
| DELETE | /api/baseline/exceptions | Remove a hardening exception |
Active Directory & Group Policy
Domain controllers enrolled in RMM: Group Policy objects and required settings, changes made through Warden (with undo), and running gpupdate on devices. Needs warden.directory.manage.
| Method | Path | Summary |
|---|---|---|
| GET | /api/gpo | Domains and Group Policy objects |
| POST | /api/gpo/changes | Changes in Active Directory / Group Policy (warden.directory.manage) |
| POST | /api/gpo/changes/:id/undo | Undo a directory change |
| POST | /api/gpo/refresh | Read Group Policy from the domain again |
| POST | /api/gpo/requirements | Require a GPO on devices |
| DELETE | /api/gpo/requirements/:id | Remove a GPO requirement |
| POST | /api/gpo/gpupdate | Run gpupdate on devices |
Network devices
Hosts found by RMM network probes with their findings, and network kit (UniFi) from connectors: polling and firmware upgrades.
| Method | Path | Summary |
|---|---|---|
| GET | /api/network | Scoped by the probe that saw a host: with a site/group picked, only that site's probes, their hosts and findings |
| POST | /api/network/scan | Scan network hosts now |
| POST | /api/network/findings/status | Accept or dismiss network findings |
| GET | /api/network/kit | Connectors are set up in BRM-Admin → Warden → Network integrations |
| POST | /api/network/kit/:id/poll | Refresh a network device now |
| POST | /api/network/kit/upgrade | Firmware upgrades: { connector_id, device_ids, when (ISO time, or empty for now) } |
| DELETE | /api/network/kit/jobs/:id | Cancel a firmware upgrade |
Agent updates
Managed Bramble agent updates — the update window and running updates now.
| Method | Path | Summary |
|---|---|---|
| GET | /api/agent-updates | List agent updates |
| PUT | /api/agent-updates/policy | Set the agent update window |
| POST | /api/agent-updates/run | Update agents now |
PSA tickets
Tickets Warden has raised in PSA for findings, and raising one by hand.
| Method | Path | Summary |
|---|---|---|
| GET | /api/tickets | List Warden's PSA tickets |
| POST | /api/tickets | Raise a PSA ticket for a finding |
Logs & auditing (SIEM)
Security events collected from Windows and Linux devices: collection status, a summary, searching events, and one event in full.
| Method | Path | Summary |
|---|---|---|
| GET | /api/siem/status | SIEM collection status |
| GET | /api/siem/summary | SIEM summary |
| GET | /api/siem/events | Search security events |
| GET | /api/siem/event | Get one security event |
| GET | /api/siem/devices | Every device in scope, with collection status and the audit policy state |
Security audits
Customer security audits: a questionnaire with answers filled in from device data where Warden can, completed by hand where it can't, and a branded report.
| Method | Path | Summary |
|---|---|---|
| GET | /api/audits | List security audits |
| POST | /api/audits | Start a security audit |
| GET | /api/audits/:id | Get an audit with its questions and answers |
| PUT | /api/audits/:id | Update an audit |
| PUT | /api/audits/:id/answers/:qid | Answer a question |
| POST | /api/audits/:id/refresh | Fill in answers from device data again |
| POST | /api/audits/:id/complete | Complete an audit |
| POST | /api/audits/:id/reopen | Reopen an audit |
| DELETE | /api/audits/:id | Delete an audit |
| GET | /api/audits/:id/report | The customer report: a printable HTML page (Print → Save as PDF) |
Web pages
These return pages for the browser rather than data.
GET /