[SentinelOne] Get Activities. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Activity Types. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Last activity as Syslog message. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Add cred details. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Cred Group. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Policy. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Policy Action. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Deactivate Policies. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. SentinelOne requires scopeLevel and osType on this endpoint — pass them in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. osType: OS type, one of 'linux', 'macos' or 'windows'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Cred Group. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Cred Group Detail. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Packages. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Deploy System Package. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Available Packages. SentinelOne requires scopeLevel and osType on this endpoint — pass them in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. osType: OS type, one of 'linux', 'macos' or 'windows'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Cred group details. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Cred groups. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Latest Packages. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Parent Policies. SentinelOne requires scopeLevel, osType and skip on this endpoint — pass them in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. osType: OS type, one of 'linux', 'macos' or 'windows'. skip: the number of items to skip; SentinelOne stops at 1000, so page with cursor where the tool offers one. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Policies. SentinelOne requires scopeLevel, osType and skip on this endpoint — pass them in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. osType: OS type, one of 'linux', 'macos' or 'windows'. skip: the number of items to skip; SentinelOne stops at 1000, so page with cursor where the tool offers one. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] All Policies OS Count. SentinelOne requires scopeLevel on this endpoint — pass it in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Policies OS Count. SentinelOne requires scopeLevel on this endpoint — pass it in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'account', 'group', 'site' or 'tenant'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Has Policy. This is a POST that READS: the criteria travel in the request body, and nothing is created or changed. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reorder Policies. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reset Policy Retry Counter. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Set Scope Inheriting. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Cred Group Details. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update package. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Policy. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Upload Agent Package. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Upload System Package. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Internal api only to notify action was triggered without actually performing it. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Scope to one customer with siteIds / accountIds / groupIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Perform an Action on selected assets/entities. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Scope to one customer with siteIds / accountIds / groupIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Fetch surface ids in case of select all with filters. This is a POST that READS: the criteria travel in the request body, and nothing is created or changed. Scope to one customer with siteIds / accountIds / groupIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get alerts. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Available Actions by Asset/Entity Type. This is a POST that READS: the criteria travel in the request body, and nothing is created or changed. Scope to one customer with siteIds / accountIds / groupIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Alert Analyst Verdict. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Threat Incident. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Activate Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Rule. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable a Managed Detection Rule. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Enable a Managed Detection Rule. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Data Sources. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Free-Text Filters. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Managed Detection Rules. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Managed Detection Rules. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Rules. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get settings for Managed Detection Rules. SentinelOne requires scopeLevel on this endpoint — pass it in filtersJson or the call fails with a 400. scopeLevel: scope level, one of 'global', 'group', 'account' or 'site'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Severities. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Statuses. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Surfaces. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Template Detection Rules. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Rule. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update settings for Managed Detection Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Abort Scan. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Approve Stateless Upgrades. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Approve Uninstall. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Broadcast Message. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Can run Remote Shell. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Clear Remote Shell. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Connect to Network. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Manage endpoint tags: add, remove, override. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Randomize UUID. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Terminate Remote Shell. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Decommission. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable Agent. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable Network Discovery. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disconnect from Network. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Edit local upgrade/downgrade Site authorization. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Enable Agent. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Enable Network Discovery. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Fetch Files. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Fetch Firewall Logs. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Fetch Firewall Rules. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Fetch Logs. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Get Applications. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Initiate Scan. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Mark as up-to-date. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Move between Sites. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Move to Console. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reject uninstall. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reset Local Config. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reset Passphrase Capability. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reset Passphrases. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Restart. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Set External ID. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Set Persistent Configuration Overrides. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Shutdown. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Start Remote Profiling. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Start Remote Shell. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Stop Remote Profiling. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Uninstall. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Software. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Count Agents. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Access Token. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Access Token. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable PNA for Hyperautomation. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Enable Agent PNA for Hyperautomation. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Agent Logs. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Agents. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Applications. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Endpoint tags count by Filters. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get the endpoint tags that match the filters. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get local upgrade/downgrade Agent authorization. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Passphrase. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Processes. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] List Access Tokens. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Change Device Review. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Change Device Review in Bulk. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Change Device Tags. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export JSON Raw Data. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Network Discovery Data. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Unprotected Endpoints Discovery Data. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] JSON Raw Data. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Network Discovery Settings. Scope to one customer with siteIds / accountIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Network Discovery Table. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Unprotected Endpoints Discovery Settings. Scope to one customer with siteIds / accountIds. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Unprotected Endpoints Discovery Table. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Network Discovery Settings. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Unprotected Endpoints Discovery Settings. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Add Rule Tags. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Copy Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Firewall Rule. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Enable/Disable Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Rules. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Configuration. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Firewall Rules. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Protocols. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Import Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Move Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Remove Rule Tags. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Reorder Rules. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Set Location. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Configuration. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create Task. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Maintenance Windows as CSV. Scope to one customer with siteIds / accountIds / groupIds. SentinelOne requires taskType on this endpoint — pass it in filtersJson or the call fails with a 400. taskType: task type, one of 'agents_upgrade', 'agent_version_change', 'auto_deploy', 'script_execution', 'cis_scan', 'gad' or 'forensics_collection'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Child Scope Task Configuration. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. SentinelOne requires taskType on this endpoint — pass it in filtersJson or the call fails with a 400. taskType: task type, one of 'agents_upgrade', 'agent_version_change', 'auto_deploy', 'script_execution', 'cis_scan', 'gad' or 'forensics_collection'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Task Configuration. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. SentinelOne requires taskType on this endpoint — pass it in filtersJson or the call fails with a 400. taskType: task type, one of 'agents_upgrade', 'agent_version_change', 'auto_deploy', 'script_execution', 'cis_scan', 'gad' or 'forensics_collection'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Task Configuration (Flexible MW). Scope to one customer with siteIds / accountIds / groupIds. SentinelOne requires taskType on this endpoint — pass it in filtersJson or the call fails with a 400. taskType: task type, one of 'agents_upgrade', 'agent_version_change', 'auto_deploy', 'script_execution', 'cis_scan', 'gad' or 'forensics_collection'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Has Child Scopes. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. SentinelOne requires taskType on this endpoint — pass it in filtersJson or the call fails with a 400. taskType: task type, one of 'agents_upgrade', 'agent_version_change', 'auto_deploy', 'script_execution', 'cis_scan', 'gad' or 'forensics_collection'. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Update Task Configuration (Flexible MW). A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create IOCs. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Create IOCs from STIX bundle. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Create Threat Intelligence user config. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete IOCs. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Threat Intelligence user config. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Threat Intelligence user config. Scope to one customer with siteIds / accountIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Add to Blocklist. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Add to Blocklist (Deep Visibility). A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Add to Exclusions. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Add Note to Multiple. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Updated Threat Incident. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Delete Threat Note. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disable Engines. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Disconnect Container. This acts on EVERY endpoint matching the filter in the request body, not on one machine. Run the matching read with countOnly=true FIRST to see how many endpoints the filter selects. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Mitigation Report. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Export Threats. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Fetch Threat File. A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Events. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Exclusion Options. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Threat Notes. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Threat Timeline. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] Get Threats. Page with cursor: pass the response's `pagination.nextCursor` back as cursor until it is null. Do not page by offset — SentinelOne stops at 1000 items and truncates silently. Scope to one customer with siteIds / accountIds / groupIds. Pass any other documented query parameter as a flat JSON object in filtersJson. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.

[SentinelOne] DESTRUCTIVE — Mark as Threat (Deep Visibility). A 200 response does not prove the change landed — SentinelOne returns a success-shaped body with an `affected` count that can be 0. Re-read to confirm. A 403 here means the console API token's ROLE lacks a permission for this endpoint — widen the service user's role in SentinelOne, it is not a StackJack setting.