NetBird Full API Reference + Read-Only MCP Prototype
POST/api/integrations/edr/falcon

Create a Falcon EDR integration

Creates a new Falcon EDR integration using CrowdStrike API credentials. Supply client_id, secret, cloud_id, groups, and zta_score_threshold; sync_interval must be between 1 and 1440 minutes when provided. A 200 response returns the created integration and its identifiers and sync details.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

7 body fields

CrowdStrike credentials and configuration for the Falcon EDR integration.

client_idstringrequired
CrowdStrike API client ID
cloud_idstringrequired
CrowdStrike cloud identifier (e.g., "us-1", "us-2", "eu-1")
enabledbooleanoptional
Indicates whether the integration is enabled
Default:true
groupsarray<string>required
The Groups this integration applies to
secretstringrequired
CrowdStrike API client secret
sync_intervalintegeroptional
How often devices are synced from the integration, in minutes. Minimum value is 1 minute, maximum is 1440 minutes.
zta_score_thresholdintegerrequired
The minimum Zero Trust Assessment score required for agent approval (0-100)

4 status codes
200Returns the created Falcon EDR integration, including its identifier, account, groups, configuration, and sync timestamps.
account_idstringrequired
The identifier of the account this integration belongs to.
cloud_idstringrequired
CrowdStrike cloud identifier
created_atstringrequired
Timestamp of when the integration was created.
created_bystringrequired
The user id that created the integration
enabledbooleanrequired
Indicates whether the integration is enabled
groupsarray<object>required
List of groups
idintegerrequired
The unique numeric identifier for the integration.
last_synced_atstringrequired
Timestamp of when the integration was last synced.
sync_intervalintegerrequired
How often devices are synced from the integration, in minutes.
updated_atstringrequired
Timestamp of when the integration was last updated.
zta_score_thresholdintegerrequired
The minimum Zero Trust Assessment score required for agent approval (0-100)
400Returned when the JSON is invalid, a required field is missing, or a value fails validation.
messagestringoptional
A human-readable error message.
401Returned when the authentication token is missing or invalid.
messagestringoptional
A human-readable error message.
500Returned when an internal server error occurs.
messagestringoptional
A human-readable error message.

Error handling

client_id, secret, cloud_id, groups, and zta_score_threshold are required; omitting any or providing invalid JSON or values returns a 400. sync_interval must be between 1 and 1440 minutes, and zta_score_threshold must be between 0 and 100. A 401 is returned when the authentication token is missing or invalid, and a 500 indicates an internal server error.