[WatchGuard Cloud] Adds a comment to a ThreatSync incident. Purely additive — it creates a new comment and changes nothing that exists — so it is not marked destructive.

[WatchGuard Cloud] DESTRUCTIVE. Permanently removes one comment from a ThreatSync incident. The comment trail is the written record of how an incident was handled, and WatchGuard has no undo for this — an incident that later becomes evidence loses that record. Prefer wg_update_incident_comment when the text is simply wrong.

[WatchGuard Cloud] Returns one ThreatSync incident by ID, optionally with its actions and comments inline. Get incident IDs from wg_list_incidents. Reading the incident with its actions is the cheapest way to see what has already been tried before performing another one.

[WatchGuard Cloud] Returns one response action on one ThreatSync incident, with its full detail. Get action IDs from wg_list_incident_actions.

[WatchGuard Cloud] Lists the response actions recorded against one ThreatSync incident — what was attempted, by whom and how it ended. Read this before performing another action, so a remediation is not run twice.

[WatchGuard Cloud] Lists ThreatSync incidents — the correlated detections WatchGuard raises across Firebox, Endpoint Security and NDR together, which makes this the first place to look when asking what is happening on a customer's estate. Page with limit plus startAfter, using the cursor value from the last record of the previous page. Use duration (a number followed by D, e.g. 7D) to bound the window rather than paging through history. As a Service Provider, pass accountId to work in a managed account — list them with wg_list_managed_accounts — or set tenants true to include managed accounts alongside your own.

[WatchGuard Cloud] Replaces the text of one comment on a ThreatSync incident. It rewrites that comment and nothing else, and the comment trail keeps its own history, so it is not marked destructive. Get comment IDs from wg_list_incident_comments.

[WatchGuard Cloud] Moves a ThreatSync incident to a different status, with an optional note. This is triage bookkeeping — it changes nothing on any device and the status can be moved back — so it is not marked destructive. Read the incident first with wg_get_incident to see which statuses it has already been through.

[WatchGuard Cloud] Lists ThreatSync response actions across the whole account rather than for one incident — the record of every remediation ThreatSync has run, which is what a monthly security review is built from. Bound it with duration (a number of days followed by D) rather than paging through history.

[WatchGuard Cloud] DESTRUCTIVE. Runs a ThreatSync response action outside any one incident — block, quarantine or stop something on a live estate, with no incident record tying it to a detection and no undo. Prefer wg_perform_incident_action when the action belongs to an incident, so the remediation is recorded against it.

[WatchGuard Cloud] DESTRUCTIVE. Runs a ThreatSync response action against a live incident — this is the remediation lane, so the command can block a connection, quarantine a file or stop a process on a real machine, and WatchGuard offers no undo for it. Read wg_list_incident_actions first to see what the incident already accepts and what has been tried. The parameters object is the command's own argument set, exactly as ThreatSync documents it for that command.

[WatchGuard Cloud] DESTRUCTIVE. Submits several ThreatSync requests together as one transaction. Each entry names its own path, method and body, so this can reach ANY ThreatSync write — including the remediation actions and the comment delete — in a single call, and nothing in the batch is reviewed tool by tool. Use the individual tools unless you genuinely need one transaction, and read WatchGuard's transaction documentation before composing the body.

[WatchGuard Cloud] Returns the BIOS and hardware characteristics of one managed device. Get device IDs from wg_list_endpoint_devices.

[WatchGuard Cloud] Returns a download URL for an endpoint installation package built with a specific managed configuration. It reads a URL and installs nothing by itself. Get configuration IDs from wg_list_endpoint_managed_configurations.

[WatchGuard Cloud] Returns the endpoint license position for an account — what is owned, what is used and what is left. Read this before deploying to new devices.

[WatchGuard Cloud] DESTRUCTIVE. Re-points devices at a different managed configuration, which REPLACES the protection settings applied to those machines — a device moved to a weaker profile stops enforcing what its old profile enforced, silently and immediately. StackJack ships no unlink tool to reverse it, so read the device's current configuration with wg_list_endpoint_devices (config true) and the target profile with wg_list_endpoint_managed_configurations before calling this. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] Lists the devices WatchGuard Endpoint Security manages, with their addresses and operating systems. This is where device IDs come from for every other endpoint tool. Page with top and skip; WatchGuard caps the response at 3,000 records however you ask, so narrow with search rather than paging past that. As a Service Provider, pass accountId to read a managed account.

[WatchGuard Cloud] Lists the managed configurations of one type — the protection profiles devices are assigned to. Read this before linking any device to a configuration, so the profile is the one you meant.

[WatchGuard Cloud] Lists published patches that are not installed on the customer's devices — the patch-gap report. Narrow with filter by patch type or criticality rather than reading the whole estate.

[WatchGuard Cloud] Lists devices with their protection status — which agents are installed, up to date and actually protecting the machine. This is the read that answers whether a customer's endpoint coverage is real, rather than whether the devices exist. Capped by WatchGuard at 3,000 records.

[WatchGuard Cloud] Lists the software installed across the customer's managed devices. Use filter with WatchGuard's own filter syntax to narrow to one device or one product — an unfiltered estate-wide read is large.

[WatchGuard Cloud] Lists devices discovered on the customer's network that WatchGuard does NOT manage — the gap between what is on the network and what is protected. Capped by WatchGuard at 3,000 records.

[WatchGuard Cloud] Starts an immediate malware scan on the named devices. It creates a scan task and removes nothing, so it is not marked destructive — it is the safest first response to a suspicion. It does use the devices' processors while it runs, so an estate-wide scan in working hours will be noticed. Track it afterwards with wg_list_endpoint_tasks. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] DESTRUCTIVE. Sends an action to the named devices — today that means a restart, which closes whatever the person at the keyboard had open. The countdown gives them warning; without one the machine restarts immediately. Name the exact device IDs. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] DESTRUCTIVE. Removes WatchGuard protection from the named devices, leaving them unprotected and no longer reporting. Re-protecting a device means building an installer and running it on the machine, so this is not something an assistant should do to tidy up an inventory. Use it only when a device is genuinely being retired or moved off the product. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] DESTRUCTIVE. Takes the named devices OFF the network. Isolation is the right answer to a live compromise and the wrong answer to almost everything else: an isolated machine loses shared drives, line-of-business applications and remote access, and the person using it will notice within seconds. Name the exact device IDs — never a whole estate — and reverse it with wg_stop_endpoint_device_isolation. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] DESTRUCTIVE. Returns isolated devices to the network. It reads like an undo, and it is marked destructive for the same reason isolation is: a machine was quarantined because something was found on it, and putting it back before that is resolved re-exposes the network to it. Confirm the threat is cleared first — wg_list_incidents will show whether the incident that isolated it is closed. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] Returns the current risk configuration: which risk factors are switched on and at what severity. Read this before changing it — the update replaces the whole list, so this response is the only record of what to put back.

[WatchGuard Cloud] Returns counts of detected security events by type. The type parameter is a MASK: add the codes of the event types you want, so 3 asks for types 1 and 2 together and 255 asks for all of them.

[WatchGuard Cloud] Returns a count of affected devices for each type of risk detected — which risks exist and how widespread each one is. Use wg_list_endpoint_device_risks to see which devices are behind a number.

[WatchGuard Cloud] Lists devices with the risks detected on each, by risk level — the device-level view behind the company risk summary. Capped by WatchGuard at 3,000 records, so narrow with filter or search.

[WatchGuard Cloud] Lists security events of one type over a period — malware, exploits, blocked programs and the rest, one code per type. The host name filter must be base-64 encoded, which is WatchGuard's own requirement rather than ours. Capped by WatchGuard at 3,000 records.

[WatchGuard Cloud] DESTRUCTIVE. REPLACES the whole risk-settings list for an account. A factor left out of the list you send is not preserved, and switching a factor off stops WatchGuard reporting that risk at all — the customer's posture looks better while nothing has changed on any device. Read wg_get_endpoint_risk_configuration first and send back the complete list with only your intended change. Acts on the Aether generation unless you set generation to wes.

[WatchGuard Cloud] Returns the definition of one endpoint task — what it was set up to do and against which devices. Get the task ID and type from wg_list_endpoint_tasks; the type is part of the address, so a right ID with the wrong type will not be found.

[WatchGuard Cloud] Returns what one repetition of an endpoint task actually found — the detections from a scan, the patches applied by an installation. Status says whether it ran; this says what it did.

[WatchGuard Cloud] Returns the per-device status of one repetition of an endpoint task — which devices the run reached, which are still pending and which failed. This is the read that answers whether a scan you started has finished.

[WatchGuard Cloud] Lists the repetitions of one endpoint task — a recurring task runs many times, and each run has its own job ID. Use a job ID from here with the status and results tools.

[WatchGuard Cloud] Lists the endpoint tasks created in an account — scans, disinfections, patch installations and IOC searches. Start here after running a scan: the task ID and type from this list are what every other task tool needs.

[WatchGuard Cloud] DESTRUCTIVE. Creates a real managed account under yours — a new customer tenancy in WatchGuard Cloud, with commercial consequences. WatchGuard requires EVERY field: type, name, contact first and last name, email, phone, industry, and both the billing and mailing addresses in full. Confirm the details with whoever owns the relationship before calling this; there is no draft state.

[WatchGuard Cloud] DESTRUCTIVE. Deletes an entire managed account. This is the single most dangerous operation in the WatchGuard connector: it removes a customer's whole tenancy, and with force set true it removes every account beneath it as well. There is no undo. Confirm the account ID against wg_list_managed_accounts and confirm the intent with a human before calling this.

[WatchGuard Cloud] Returns one WatchGuard Cloud account's information. Called with no account ID it reads your own account, which is also how StackJack tests this connection. Use the fields parameter to ask for specific account fields rather than the whole record.

[WatchGuard Cloud] Lists the accounts you manage. START HERE when working across customers: every other WatchGuard tool takes an optional account ID, and this is the only place those IDs come from. Filter by name for a partial match, or by type to separate Service Provider accounts from subscribers.

[WatchGuard Cloud] DESTRUCTIVE. REPLACES a managed account's record. WatchGuard requires every field on this call, so anything you leave out is not preserved — a partial update wipes the contact details or an address rather than leaving them alone. Read the account with wg_get_account first and send the complete record back with only your intended change.

[WatchGuard Cloud] Returns one view of the Firebox Executive Dashboard — the traffic-side report a customer sees in a quarterly review: top applications, top destinations, top clients and so on. One view per call, so ask for the views you need in turn. Leave devices empty to cover every Firebox in the account.

[WatchGuard Cloud] Returns one view of the Firebox Security Dashboard — what the firewall BLOCKED over the period: blocked countries, botnet sites, malware, attacks and the rest. This is the report that shows a customer what their firewall stopped. One view per call.

[WatchGuard Cloud] Records a new asset in WatchGuard NDR — typically something NDR has not discovered by itself, such as a device on a segment it cannot see. Purely additive: it creates a record and changes nothing that exists, so it is not marked destructive. WatchGuard accepts only IP_V4 addresses on create.

[WatchGuard Cloud] DESTRUCTIVE. Permanently removes an asset from WatchGuard NDR, with its history and its link to past Smart Alerts. NDR may rediscover the device later, but it comes back as a new asset with none of the context — the importance, roles and tags someone set are gone. There is no undo.

[WatchGuard Cloud] Returns one WatchGuard NDR asset in full — its addresses, roles, importance, threat score and when it was first and last seen. Get asset IDs from wg_list_ndr_assets. Read this before updating an asset: the update replaces the record.

[WatchGuard Cloud] Lists the assets WatchGuard NDR knows about on the customer's network — what it has seen, what it believes each thing is, and each asset's threat score. Filter by naming both field and value together; sorting by threatScore descending is the fastest route to what deserves attention.

[WatchGuard Cloud] DESTRUCTIVE. REPLACES a WatchGuard NDR asset record. WatchGuard requires the name, addresses, device type and importance on every call, so anything you leave out — the description, the roles, the tags — is cleared rather than kept. Read the asset with wg_get_ndr_asset first and send the complete record back with only your intended change.

[WatchGuard Cloud] Closes a WatchGuard NDR Smart Alert with a documented reason. This is triage: the alert is resolved, nothing is deleted, and it is not marked destructive. BUT two of its options change what NDR does in future — allowInFuture authorizes the activity so similar traffic stops raising alerts, and includeSimilar closes other matching alerts in the same call. Leave both unset unless you mean them, because a mistaken authorization quietly suppresses a real detection later.

[WatchGuard Cloud] Returns one WatchGuard NDR Smart Alert in full — the network detection, what it was raised on and why. Smart Alert IDs appear on the assets they concern and in ThreatSync incidents that correlate them.

[WatchGuard Cloud] Returns the health probe of one WatchGuard Cloud API. All sixteen WatchGuard APIs publish the same probe and this one tool reaches every one of them through the service selector. It proves the SERVICE is up; it does NOT prove your credential works — a revoked API key still gets a healthy answer here, so use Test Connection in StackJack, or any ordinary read, to check the credential.

[WatchGuard Cloud] DESTRUCTIVE. Deletes one deployment transaction record, selected by its transaction id. There is no undo: WatchGuard removes the record outright and answers with the deleted object. This is NOT a cancel button - the specification publishes no cancel verb and does not say whether a scheduled push still runs once its record is gone - so move an unwanted deployment with wg_update_firebox_deployment_transaction instead of deleting its record. Confirm the record with wg_get_firebox_deployment_transaction before deleting it: a transaction whose status is complete or failed is a finished deployment, and this removes that deployment's record from the transaction list. The id comes from wg_list_firebox_deployment_transactions, or from the transaction objects wg_deploy_firebox_configuration answers with.

[WatchGuard Cloud] DESTRUCTIVE. Deploys the global exceptions saved in WatchGuard Cloud onto the Fireboxes you name, or the full configuration when full_config is true. This is the one Firebox Management call that leaves WatchGuard Cloud: every other configuration write in this connector is saved as pending until this runs, and what it pushes takes effect on live traffic. Name the devices explicitly instead of the whole estate. full_config decides WHAT is pushed and WatchGuard defaults it to false, which deploys global exceptions only, so a policy, network, alias, schedule or certificate change needs full_config set to true or this call succeeds and ships nothing. start_date takes the literal value now to deploy immediately or a UTC timestamp to queue it, and a queued push can be moved afterwards with wg_update_firebox_deployment_transaction. devices holds at most 50 Fireboxes, so a larger estate is more than one call, and WatchGuard creates one transaction PER DEVICE. The two success shapes differ: 201 answers a bare array of transaction objects, while 200 answers an object carrying ok, the transactions it created, and errors, a map of device id to the reason that device was SKIPPED - the vendor's own example reason is global exceptions not enabled for the device, which wg_enable_firebox_global_exceptions fixes - so read errors before reporting success. Reach for wg_list_firebox_deployment_transactions first to see what is already queued, and read each transaction back with wg_get_firebox_deployment_transaction rather than treating this answer as a finished deployment. The body is a JSON object whose fields are description, devices, full_config, start_date, version; required: devices, start_date.

[WatchGuard Cloud] DESTRUCTIVE. Disables management and deployment of global exceptions through the Firebox Management API for the Fireboxes you name, and deletes the exceptions already on them unless retain_device_configuration is true. WatchGuard defaults retain_device_configuration to false, so leaving it out DELETES the exceptions currently on every Firebox you name; send it as true to keep them, because enabling global exceptions again later does not restore what this removed. WatchGuard answers 204 No Content here, so this tool returns a short success acknowledgement rather than a transaction and there is nothing to read back. wg_enable_firebox_global_exceptions is the other half of the same switch, and it takes no retain flag. devices holds at most 50 Fireboxes. The body is a JSON object whose fields are devices, retain_device_configuration; required: devices.

[WatchGuard Cloud] DESTRUCTIVE. Enables management and deployment of global exceptions through the Firebox Management API for the Fireboxes you name. This is the switch that lets exception changes made through this API reach those Fireboxes at the next deployment, and its other half, wg_disable_firebox_global_exceptions, can delete the exceptions already on a device. It is the prerequisite of wg_deploy_firebox_configuration: a deployment does not fail for a Firebox that has global exceptions disabled, it SKIPS that device and names it in the response's errors map. WatchGuard answers 204 No Content here, so this tool returns a short success acknowledgement rather than a transaction and there is nothing to read back. devices holds at most 50 Fireboxes. The body is a JSON object whose fields are devices; required: devices.

[WatchGuard Cloud] Reads one deployment transaction record by its id, the status of a single configuration push to a single Firebox. This is the read-back for every write in this family: wg_deploy_firebox_configuration answers the transaction objects it created, and this tool re-reads one of them by id until its status settles. WatchGuard answers an ARRAY here even for a single record. status is one of scheduled, imaged, pending, in_progress, complete or failed, so a transaction that has not reached complete is not a deployed configuration, and original_author_username is always empty for transactions the Firebox Management API created. The id comes from wg_list_firebox_deployment_transactions, or from the transaction objects wg_deploy_firebox_configuration answers with.

[WatchGuard Cloud] Lists the deployment transaction records for the account, one record per Firebox per configuration push, each with its status. Reach for this first in this family: it shows what is already queued or running before another push is added with wg_deploy_firebox_configuration. Each record carries id, device, account, inception_time, start_date and status, where status is one of scheduled, imaged, pending, in_progress, complete or failed, so a transaction that has not reached complete is not a deployed configuration. original_author_username is always empty for transactions the Firebox Management API created, so a blank operator is expected rather than missing data. The id returned here is what wg_get_firebox_deployment_transaction, wg_update_firebox_deployment_transaction and wg_delete_firebox_deployment_transaction take. WatchGuard declares no paging on this route - no page size, no offset and no cursor - so one call returns the WHOLE collection for the account; on a large estate expect a large result, and narrow it with device.

[WatchGuard Cloud] DESTRUCTIVE. Reschedules one deployment transaction, selected by its transaction id, by replacing its start date. start_date is required, so one call replaces the schedule of a pending deployment: the literal value now brings a queued configuration push FORWARD onto live Fireboxes immediately. WatchGuard documents this as a replace, so send description back alongside it to keep it - the transaction object in the answer carries no description field to read a lost one back from. Read the record first with wg_get_firebox_deployment_transaction: a transaction whose status has already left scheduled is a push that has started or finished. WatchGuard answers with the updated transaction record, as an ARRAY, and publishes no separate cancel verb for a queued deployment. The id comes from wg_list_firebox_deployment_transactions, or from the transaction objects wg_deploy_firebox_configuration answers with. The body is a JSON object whose fields are description, start_date; required: start_date.

[WatchGuard Cloud] Reads one Firebox authentication group, the umbrella group a firewall policy matches users against, by object id. Answers the typed domains array (firebox_domain, authentication_domain, authpoint_domain or saml_settings) and the typed members array (firebox_user, firebox_group, shared_user_group, authpoint_user_group or saml_user_group), which together resolve a policy's user match. Object ids come from wg_list_firebox_auth_groups.

[WatchGuard Cloud] Reads one AuthPoint user or group reference held in Firebox configuration, by object id. Answers the pointer WatchGuard stores, which is name, type (user or group) and the AuthPoint domain reference, not the AuthPoint object itself. Object ids come from wg_list_firebox_authpoint_user_groups.

[WatchGuard Cloud] Reads one SAML user or group reference held in Firebox configuration, by object id. Answers name, which the vendor constrains to an email address or a user name, type (user or group), the SAML domain reference and movpn_enforcement. Object ids come from wg_list_firebox_saml_user_groups.

[WatchGuard Cloud] Reads one Firebox local user account by object id. THE RESPONSE IS CREDENTIAL MATERIAL: password is a required member of WatchGuard's firebox_user schema, so this body carries the user's Firebox password in the clear. Treat it as a secret and never paste it into a ticket, a chat or a document. The body also carries name, description, the session and idle timeouts in seconds, the authentication domain and the groups the user belongs to. Object ids come from wg_list_firebox_users.

[WatchGuard Cloud] Reads one Firebox local user group by object id. Answers name, description, the optional authentication domain and the members array of references to Firebox users. Object ids come from wg_list_firebox_user_groups; wg_get_firebox_auth_group reads the umbrella authentication group kind instead.

[WatchGuard Cloud] Lists the Firebox authentication groups, the umbrella groups a firewall policy matches users against, for the account, or for one Firebox or one template. An auth group is the one kind that spans identity sources: its domains array names firebox_domain, authentication_domain, authpoint_domain or saml_settings entries, and its members array is typed firebox_user, firebox_group, shared_user_group, authpoint_user_group or saml_user_group. That is where a policy's user match is actually resolved, so reach here first when tracing which users a policy applies to; the four other lists in this group read the individual member kinds. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result.

[WatchGuard Cloud] Lists the AuthPoint users and groups this Firebox configuration references, for the account, or for one Firebox or one template. Each entry is a POINTER into an AuthPoint domain rather than the AuthPoint object itself: name, type (user or group) and the domain reference. It says which AuthPoint identities this Firebox configuration can match, not what AuthPoint holds. The policy side is wg_list_firebox_auth_groups, and wg_list_firebox_saml_user_groups is the same shape for a SAML identity provider. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result.

[WatchGuard Cloud] Lists the SAML users and groups this Firebox configuration references, for the account, or for one Firebox or one template. Each entry is a POINTER into a SAML identity provider: name, which the vendor constrains to an email address or a user name, type (user or group), the domain reference, and movpn_enforcement, the one member the AuthPoint equivalent does not carry. Use wg_list_firebox_authpoint_user_groups for the AuthPoint side and wg_list_firebox_auth_groups for the groups a policy matches on. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result.

[WatchGuard Cloud] Lists the Firebox local user groups, whose members are Firebox users, for the account, or for one Firebox or one template. Each group carries name, description, an optional authentication domain and a members array of references to Firebox users, which wg_list_firebox_users reads. This is the LOCAL group kind: wg_list_firebox_auth_groups reads the umbrella authentication groups a firewall policy matches users against, and the AuthPoint and SAML lists read pointers into those identity providers. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result.

[WatchGuard Cloud] Lists the Firebox local user accounts for the account, or for one Firebox or one template. THE RESPONSE IS CREDENTIAL MATERIAL: password is a required member of WatchGuard's firebox_user schema, so every object in this list carries that user's Firebox password in the clear. Treat the result as a secret and never paste it into a ticket, a chat or a document. Reach here first for who can authenticate to a Firebox; wg_get_firebox_user reads one account back by id and wg_list_firebox_user_groups shows their group membership. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result.

[WatchGuard Cloud] DESTRUCTIVE. Creates a new blocked sites exception. The value of the action parameter specifies whether the Firebox allows or blocks traffic for the site. The action field decides whether the Firebox ALLOWS or BLOCKS the site - allow puts the address on the Blocked Sites Exception list, block puts it on the Blocked Sites list - and it DEFAULTS TO allow when omitted, so a create that names no action opens traffic an administrator may have meant to stop. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are action, address, description, device; required: address.

[WatchGuard Cloud] Creates a new botnet site exception. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are address, description, device; required: address.

[WatchGuard Cloud] Creates a new file exception. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are action, description, device, md5; required: action, md5.

[WatchGuard Cloud] Creates a new Geolocation exception. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are address, description, device; required: address.

[WatchGuard Cloud] Creates a new IPS signature exception. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are action, alarm, description, device, signature_id; required: action, signature_id.

[WatchGuard Cloud] DESTRUCTIVE. Creates a new WebBlocker exception. The action field decides whether the exception allows or denies every URL its rule matches, so a wrong value either opens web traffic the customer's policy refuses or blocks a site the customer needs. It is saved in WatchGuard Cloud only: no Firebox enforces it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. That deployment answers global_exceptions not enabled for device for any Firebox that wg_enable_firebox_global_exceptions has not enabled first. The response carries the new exception's id and version. The body is a JSON object whose fields are action, alarm, device, name, rule, rule_type; required: action, name, rule, rule_type.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified blocked sites exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_blocked_site_exception mints a new id, so confirm the id with wg_get_firebox_blocked_site_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified botnet site exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_botnet_site_exception mints a new id, so confirm the id with wg_get_firebox_botnet_site_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified file exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_file_exception mints a new id, so confirm the id with wg_get_firebox_file_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified Geolocation exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_geolocation_exception mints a new id, so confirm the id with wg_get_firebox_geolocation_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified IPS signature exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_ips_signature_exception mints a new id, so confirm the id with wg_get_firebox_ips_signature_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] DESTRUCTIVE. Deletes the specified WebBlocker exception. There is no undo: WatchGuard publishes no restore for a deleted exception and recreating it with wg_create_firebox_webblocker_exception mints a new id, so confirm the id with wg_get_firebox_webblocker_exception before you call this. WatchGuard answers with the deleted exception, marked inactive. The removal is saved in WatchGuard Cloud only: no Firebox stops enforcing the exception until wg_deploy_firebox_configuration pushes the account's exceptions to the devices.

[WatchGuard Cloud] Retrieves the specified blocked sites exception. The id comes from wg_list_firebox_blocked_site_exceptions and looks like bse_12345_ARBHLJ70Y78rGOIGBS. The response carries the version that wg_update_firebox_blocked_site_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Retrieves the specified botnet site exception. The id comes from wg_list_firebox_botnet_site_exceptions and looks like bote_CjBY92ourN7Izaa1jJu3eH5. The response carries the version that wg_update_firebox_botnet_site_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Retrieves the specified file exception. The id comes from wg_list_firebox_file_exceptions and looks like file_12345_UqhDVIdx8D5iwivAX. The response carries the version that wg_update_firebox_file_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Retrieves the specified Geolocation exception. The id comes from wg_list_firebox_geolocation_exceptions and looks like geoe_12345_aHbWC5IuWO3qzyV2t. The response carries the version that wg_update_firebox_geolocation_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Retrieves the specified IPS signature exception. The id comes from wg_list_firebox_ips_signature_exceptions and looks like ipse_12345_eY5Jwxv1nE3Xlk3zx. The response carries the version that wg_update_firebox_ips_signature_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Retrieves the specified WebBlocker exception. The id comes from wg_list_firebox_webblocker_exceptions and looks like wbe_12124_7HM70EvrifZ7rSfXSA. The response carries the version that wg_update_firebox_webblocker_exception requires, so read the exception before you replace it.

[WatchGuard Cloud] Lists the blocked sites exceptions saved in the WatchGuard Cloud account. This is the blocked sites kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_blocked_site_exception, wg_update_firebox_blocked_site_exception and wg_delete_firebox_blocked_site_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_blocked_site_exceptions instead, which reads the same saved blocked sites exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists the botnet site exceptions saved in the WatchGuard Cloud account. This is the botnet site kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_botnet_site_exception, wg_update_firebox_botnet_site_exception and wg_delete_firebox_botnet_site_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_botnet_site_exceptions instead, which reads the same saved botnet site exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists every exception saved in the WatchGuard Cloud account in one response - blocked sites, botnet sites, files, Geolocation, IPS signatures and WebBlocker together. Start here rather than with the six per-kind lists, and narrow the result with query. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that the get, update and delete tools take and the version that an update has to send back. These are saved objects: a Firebox enforces them only after wg_deploy_firebox_configuration pushes them.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_exceptions instead, which reads the same saved exceptions of all six kinds. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists the file exceptions saved in the WatchGuard Cloud account. This is the file kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_file_exception, wg_update_firebox_file_exception and wg_delete_firebox_file_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_file_exceptions instead, which reads the same saved file exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists the Geolocation exceptions saved in the WatchGuard Cloud account. This is the Geolocation kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_geolocation_exception, wg_update_firebox_geolocation_exception and wg_delete_firebox_geolocation_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_geolocation_exceptions instead, which reads the same saved Geolocation exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists the IPS signature exceptions saved in the WatchGuard Cloud account. This is the IPS signature kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_ips_signature_exception, wg_update_firebox_ips_signature_exception and wg_delete_firebox_ips_signature_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_ips_signature_exceptions instead, which reads the same saved IPS signature exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] Lists the WebBlocker exceptions saved in the WatchGuard Cloud account. This is the WebBlocker kind only; wg_list_firebox_exceptions returns all six kinds in one call. The response is an object with count, more, objects and start_after, so when more is true call again with start_after set to the value the response returned. Each object carries the id that wg_get_firebox_webblocker_exception, wg_update_firebox_webblocker_exception and wg_delete_firebox_webblocker_exception take, and the version that an update has to send back.

[WatchGuard Cloud] DEPRECATED by WatchGuard: use wg_list_firebox_webblocker_exceptions instead, which reads the same saved WebBlocker exceptions. This v1 route declares no paging at all, so one call returns the WHOLE collection for the account and on a large estate that is a large result. It also answers a bare JSON array where the v2 read answers an object with count, more, objects and start_after.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified blocked sites exception. This replaces the exception wholesale - every field you leave out is cleared, and an omitted action falls back to the schema default allow, which moves the address onto the Blocked Sites Exception list and lets the traffic through. Read the current object with wg_get_firebox_blocked_site_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are action, address, description, version; required: address, version.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified botnet site exception. This replaces the exception wholesale - every field you leave out is cleared rather than kept, so an omitted description is erased and a changed address re-points the exception at a different site. Read the current object with wg_get_firebox_botnet_site_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are address, description, version; required: address, version.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified file exception. This replaces the exception wholesale - every field you leave out is cleared, and action decides whether the Firebox allows the file or drops it, so a wrong value here delivers a file the customer meant to stop. Read the current object with wg_get_firebox_file_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are action, description, md5, version; required: action, md5, version.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified Geolocation exception. This replaces the exception wholesale - every field you leave out is cleared rather than kept, and the address is the whole exception, so a changed value exempts a different site from the Geolocation block. Read the current object with wg_get_firebox_geolocation_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are address, description, version; required: address, version.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified IPS signature exception. This replaces the exception wholesale - every field you leave out is cleared, an omitted alarm falls back to false so the Firebox stops alarming on the signature, and action decides whether the signature is allowed, blocked or dropped. Read the current object with wg_get_firebox_ips_signature_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are action, alarm, description, signature_id, version; required: action, signature_id, version.

[WatchGuard Cloud] DESTRUCTIVE. Updates the specified WebBlocker exception. This replaces the exception wholesale - every field you leave out is cleared, and action decides whether the matching URLs are allowed or denied, so a wrong value either opens web traffic the customer's policy refuses or blocks a site the customer needs. Read the current object with wg_get_firebox_webblocker_exception and send it back complete. version is required and must be the version the exception carries now; a stale version comes back as a conflict. The change is saved in WatchGuard Cloud only: no Firebox sees it until wg_deploy_firebox_configuration pushes the account's exceptions to the devices. The body is a JSON object whose fields are action, alarm, name, rule, rule_type, version; required: action, name, rule, rule_type, version.

[WatchGuard Cloud] Creates the shared Phase 1 (IKE) settings object for one Firebox. The Firebox is named by the body's device field, not by a path or query parameter. One object can exist per Firebox, so a second create for the same device is refused as a conflict rather than replacing the existing object; change an existing one with wg_update_firebox_bovpn_p1_shared_settings. Every branch office VPN tunnel on that Firebox inherits these settings. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are device, ike_proposals, natt_interval; required: ike_proposals.

[WatchGuard Cloud] DESTRUCTIVE. Creates a branch office VPN (BOVPN) IPSec tunnel in the account. The body carries psk, the tunnel pre-shared key, in clear text, so this stores credential material, and WatchGuard echoes the key back in the response. At least one endpoint must be a cloud-managed Firebox, named in endpoint_a; both route-based and policy-based tunnels are supported. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are address_family, auth_method, certs, disabled, endpoint_a, endpoint_b, endpoint_b_name, interfaces, ipsec_tunnel_core, local_remote_pairs, name, psk, psk_encrypted, routes and 3 more; required: endpoint_a, interfaces, name, routes.

[WatchGuard Cloud] DESTRUCTIVE. Deletes one branch office VPN IPSec tunnel, selected by its object id in the path. There is no undo: WatchGuard removes the tunnel outright and the branch office connection it carries drops once the change is deployed, so confirm the object id first. WatchGuard answers with the deleted tunnel, pre-shared key included. The object id comes from wg_list_firebox_bovpn_tunnels. The sibling wg_delete_firebox_bovpn_tunnel_by_name deletes by name instead. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it.

[WatchGuard Cloud] DESTRUCTIVE. Deletes one branch office VPN IPSec tunnel, selected by the tunnel name. This selects the tunnel by NAME rather than by object id, so a wrong name deletes a different tunnel rather than failing, and there is no undo: the branch office connection that tunnel carries drops once the change is deployed. WatchGuard answers with the deleted tunnel, pre-shared key included. Prefer wg_delete_firebox_bovpn_tunnel, which takes the tunnel's object id in the path. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it.

[WatchGuard Cloud] Retrieves the shared Phase 1 (IKE) settings that a Firebox's branch office VPN tunnels inherit. Name a device to read that Firebox's single object; omit device and WatchGuard returns every Phase 1 shared settings object in the account, with no paging. One object can exist per Firebox. Read this before wg_update_firebox_bovpn_p1_shared_settings: the version field it returns is what that update must send back.

[WatchGuard Cloud] Retrieves one branch office VPN IPSec tunnel, selected by its object id in the path. Read this before any wholesale update: the object's version field is what wg_update_firebox_bovpn_tunnel must send back, and the fields you do not send to that tool are cleared. The response carries psk, the tunnel's pre-shared key, in clear text.

[WatchGuard Cloud] Retrieves one network configuration object of a Firebox, selected by its object id. The object id comes from the id field of wg_list_firebox_networks. The response carries credentials in clear text: pppoe_client.password, dynamic_dns.password and each wireless interface's passphrase.

[WatchGuard Cloud] Retrieves one SD-WAN configuration object of a Firebox, selected by its object id. The object id comes from the id field of wg_list_firebox_sdwans.

[WatchGuard Cloud] Lists the branch office VPN (BOVPN) IPSec tunnels of the account, or of one Firebox. This is the reach-first read for every other BOVPN tool: it is where a tunnel's id, its name and its version number come from. The response carries each tunnel's psk, the pre-shared key, in clear text. WatchGuard declares no paging on this route, so one call returns the whole collection; filter with device to keep the result small.

[WatchGuard Cloud] Lists the network configuration objects of the account, or of one Firebox or one account-level template. Start here for interface, VLAN, bridge, PPPoE, dynamic DNS and wireless settings, then read a single object with wg_get_firebox_network. The response carries credentials in clear text: pppoe_client.password, dynamic_dns.password and each wireless interface's passphrase. WatchGuard declares no paging on this route, so one call returns the whole collection; filter with device or templateid to keep the result small.

[WatchGuard Cloud] Lists the SD-WAN configuration objects of the account, or of one Firebox or one account-level template. This is the reach-first read for SD-WAN actions and their link-monitoring settings; read a single object with wg_get_firebox_sdwan. WatchGuard declares no paging on this route, so one call returns the whole collection; filter with device or templateid to keep the result small.

[WatchGuard Cloud] Updates only the routes list or the endpoint certificates of one branch office VPN IPSec tunnel, selected by its object id in the path. Every other field of the tunnel, its pre-shared key included, is preserved: this is the partial sibling of wg_update_firebox_bovpn_tunnel, which replaces the whole object. The response is the updated tunnel and carries psk, the pre-shared key, in clear text. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are certs, routes.

[WatchGuard Cloud] Updates only the routes list or the endpoint certificates of one branch office VPN IPSec tunnel, selected by the id or the name in the body. This route takes no path or query selector, so the tunnel is chosen by the body's id or name field and a wrong name updates a different tunnel rather than failing. Prefer wg_patch_firebox_bovpn_tunnel, which takes the tunnel's object id in the path. Every other field of the tunnel, its pre-shared key included, is preserved, and the response is the updated tunnel and carries psk, the pre-shared key, in clear text. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are certs, id, name, routes.

[WatchGuard Cloud] DESTRUCTIVE. Replaces the shared Phase 1 (IKE) settings that a Firebox's branch office VPN tunnels inherit. Every branch office VPN tunnel on the Firebox inherits these Phase 1 settings, so one call can renegotiate every branch tunnel on that device at once. It replaces the object wholesale: any field you leave out is cleared rather than kept. Read the current object with wg_get_firebox_bovpn_p1_shared_settings first and send its version back; WatchGuard refuses a stale version as a conflict. WatchGuard's prose says the Firebox is named by the body's device attribute, and its own example sends id and device as well, although the update schema documents only ike_proposals, natt_interval and version. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are ike_proposals, natt_interval, version; required: ike_proposals, version.

[WatchGuard Cloud] DESTRUCTIVE. Replaces one branch office VPN IPSec tunnel, selected by its object id in the path. This replaces the tunnel wholesale, including its pre-shared key: every field you leave out is cleared rather than kept, so read the tunnel with wg_get_firebox_bovpn_tunnel and send it back complete. WatchGuard echoes the key back in the response. version must be the version you just read, and WatchGuard refuses a stale one as a conflict. The sibling wg_update_firebox_bovpn_tunnel_by_name takes no object id and selects the tunnel from the body instead; wg_patch_firebox_bovpn_tunnel changes the routes or the certificates without touching anything else. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are address_family, auth_method, certs, disabled, endpoint_a, endpoint_b, endpoint_b_name, interfaces, ipsec_tunnel_core, local_remote_pairs, name, psk, psk_encrypted, routes and 4 more; required: endpoint_a, interfaces, name, routes, version.

[WatchGuard Cloud] DESTRUCTIVE. Replaces one branch office VPN IPSec tunnel, selected by the tunnel name in the body. This selects the tunnel by NAME from the body and replaces it wholesale, so a wrong name edits a different tunnel rather than failing, and every field you leave out is cleared rather than kept. The body carries the pre-shared key and WatchGuard echoes it back in the response. WatchGuard's prose calls the name a URL parameter, but the specification declares no path or query parameter on this route: the name travels in the body. Prefer wg_update_firebox_bovpn_tunnel, which takes the tunnel's object id in the path. version must be the version you read with wg_get_firebox_bovpn_tunnel or wg_list_firebox_bovpn_tunnels. The change is saved in WatchGuard Cloud and reaches no Firebox until wg_deploy_firebox_configuration pushes it. The body is a JSON object whose fields are address_family, auth_method, certs, disabled, endpoint_a, endpoint_b, endpoint_b_name, interfaces, ipsec_tunnel_core, local_remote_pairs, name, psk, psk_encrypted, routes and 4 more; required: endpoint_a, interfaces, name, routes, version.

[WatchGuard Cloud] Creates a firewall policy on a Firebox. Saved in WatchGuard Cloud only: the new rule reaches no device until wg_deploy_firebox_configuration pushes the configuration. Read wg_list_firebox_policy_groups, wg_list_firebox_traffic_types and wg_list_firebox_aliases first, because group, traffic_types, sources and destinations all name objects that must already exist. The body is a JSON object whose fields are action, connection_rate_limit, content_filtering, content_scanning, description, destinations, device, enabled, geolocation, group, hidden, idle_timeout, immutable, name and 18 more; required: action, destinations, device, enabled, group, name, sources, traffic_types, type.

[WatchGuard Cloud] DESTRUCTIVE. Deletes one firewall policy. There is no undo, and the id is all this call takes: confirm the rule with wg_get_firebox_policy first, because a wrong id removes a rule that is filtering traffic today. WatchGuard refuses to delete a policy marked permanent. WatchGuard answers 201, not 204, and the body is the deleted policy with inactive set to true - that is success, not a failure. The deletion is saved in WatchGuard Cloud; the Firebox stops enforcing the rule at the next wg_deploy_firebox_configuration.

[WatchGuard Cloud] Returns one firewall alias and the members it resolves to. Use it to see exactly which hosts, networks, ranges, FQDNs, users or groups a policy matches when its sources or destinations name this alias. Each member is a typed object: type says what kind it is and value carries the address or the referenced object.

[WatchGuard Cloud] Returns one content filtering rule with its application control and WebBlocker category actions. CREDENTIAL IN THE ANSWER: webblocker_override.password is the cleartext password an end user types to override a blocked category, so treat this result as a secret and do not forward or store it, and note that WatchGuard only fills it when webblocker_override.wbo_method is password rather than user_group. The appcontrol array carries one entry per application, each allow or block; the webblocker array carries one entry per URL category, each allow, bypass, deny or warn with its own log and alarm flags; and deny_uncategorized decides what happens to a site in no category.

[WatchGuard Cloud] Returns one firewall policy in full, including the version number an update has to send back. Read this before wg_update_firebox_policy: that call replaces the rule wholesale and requires the object's current version, and this is where both the version and the complete rule come from. The record carries the rule's action, type, group, sources, destinations, traffic_types, schedule and NAT settings, wrapped in WatchGuard's object metadata: id, object, version, account, device and created.

[WatchGuard Cloud] Returns one firewall policy group with the ordered list of policies inside it. The policies array is the order WatchGuard runs the member rules in, and each reference in it resolves through wg_get_firebox_policy. WatchGuard requires only the group's name, so a group with no members can answer without the array at all.

[WatchGuard Cloud] Returns one static NAT (SNAT) action with its external-to-internal address rules. Each rule pairs an external_address - an IPv4 host, a reference to an external network, or the Any-External system alias - with the internal_address the traffic is sent to, and may narrow the match with destination_port and source_address. A policy uses the action by naming it in a destination of type firewall_snat_action.

[WatchGuard Cloud] Returns one traffic shaping rule with the bandwidth it limits or guarantees. behavior is limit or guarantee, method is all_users or per_user (with max_users when it is per_user), rule_type says which traffic the rule applies to - outbound, inbound, custom, first, last, content_filtering or mixed - and the bandwidth is carried as upload and download in Kbps.

[WatchGuard Cloud] Returns one traffic type with the protocols and ports it matches. The type field says whether WatchGuard predefined it or the account created it, category is the vendor grouping - Auth, Custom, Database, Email, File, General, Network, RemoteAccess, Tunneling, VoIP/Chat, WatchGuard or Web - and protocols lists one entry per matched protocol, each typed any (the protocol with no port restriction), single_port or port_range for TCP and UDP, or icmp.

[WatchGuard Cloud] Lists the firewall aliases defined for the account, or for one Firebox or template. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. An alias is a named set of at least one member - IPv4 or IPv6 hosts, networks and ranges, FQDNs, WatchGuard's own system aliases such as Any-External, or references to another alias, a network, a Firebox user or group, an authentication group, or an AuthPoint or SAML user group - that a policy's sources and destinations point at by name, so read this before you write a policy that names one. Each entry's id is the objectid wg_get_firebox_alias takes.

[WatchGuard Cloud] Lists the content filtering rules, the application control and WebBlocker category actions, for the account or for one Firebox or template. CREDENTIAL IN THE ANSWER: each rule's webblocker_override.password is the cleartext password an end user types to override a blocked category, so treat this result as a secret and do not forward or store it. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. Every rule carries its whole appcontrol array (one entry per application, allow or block) and webblocker array (one entry per URL category, allow, bypass, deny or warn), so this answer is large on a tuned account. Each entry's id is the objectid wg_get_firebox_content_filtering_rule takes.

[WatchGuard Cloud] Lists the firewall policies WatchGuard Cloud holds for the account, or for one Firebox when you name a device. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. Start here for anything policy-shaped: the answer is a count plus an objects array, and each entry's id is the objectid that wg_get_firebox_policy, wg_update_firebox_policy, wg_set_firebox_policy_enabled and wg_delete_firebox_policy take. Send full=1 when you need whole rules rather than the id, name, group and device summary.

[WatchGuard Cloud] Lists the firewall policy groups defined for the account, or for one Firebox or template. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. A policy group is the ordered container a firewall policy's group field names, and WatchGuard's own groups are First Run Policies, Core Policies and Last Run Policies. Each entry's policies array lists its member policies in the order they run, and each entry's id is the objectid wg_get_firebox_policy_group takes.

[WatchGuard Cloud] Lists the static NAT (SNAT) actions defined for the account, or for one Firebox or template. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. A SNAT action maps an external address to an internal one and a firewall policy's nat settings name it. Each entry's id is the objectid wg_get_firebox_snat_action takes.

[WatchGuard Cloud] Lists the traffic shaping rules defined for the account, or for one Firebox or template. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. A traffic shaping rule limits or guarantees bandwidth for the policies that name it in their traffic_shaping field. Each entry's id is the objectid wg_get_firebox_traffic_shaping_rule takes.

[WatchGuard Cloud] Lists the traffic types, the named protocol and port sets, available for the account or for one Firebox or template. WatchGuard declares no paging on this route, so one call returns the WHOLE collection for the account; on a large estate expect a large result. A firewall policy's traffic_types field names these, both WatchGuard's predefined ones such as All TCP and UDP or FTP and any the account created, so read this to find valid names before you create or update a policy. Each entry's id is the objectid wg_get_firebox_traffic_type takes.

[WatchGuard Cloud] DESTRUCTIVE. Enables or disables one firewall policy without touching any of its other settings. Disabling a firewall policy stops it enforcing without deleting it, so the rule looks present in the configuration while it is no longer applied; the same call with enabled true puts it back. The body needs device as well as enabled: the Firebox ID the policy belongs to, which wg_get_firebox_policy returns. No other field is read, so the rule's version is not required here. WatchGuard answers 201 with the whole updated policy, not an empty body. The change is saved in WatchGuard Cloud and takes effect on the Firebox at the next wg_deploy_firebox_configuration. The body is a JSON object whose fields are device, enabled; required: device, enabled.