NetBird Full API Reference + Read-Only MCP Prototype
POST/api/integrations/edr/sentinelone

Create an EDR SentinelOne integration

Creates a new EDR SentinelOne integration configuration. Provide the API credentials, applicable groups, sync requirements, and agent-matching attributes; api_token, api_url, groups, last_synced_interval, and match_attributes are required. Set network_status to connected, disconnected, or quarantined when specifying that matching attribute.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

7 body fields

SentinelOne integration configuration. api_token, api_url, groups, last_synced_interval, and match_attributes are required.

api_tokenstringrequired
SentinelOne API token
api_urlstringrequired
The Base URL of SentinelOne API
enabledbooleanoptional
Indicates whether the integration is enabled
Default:true
groupsarray<string>required
The Groups this integrations applies to
last_synced_intervalintegerrequired
The devices last sync requirement interval in hours. Minimum value is 24 hours.
match_attributesobjectrequired
Attribute conditions to match when approving agents
sync_intervalintegeroptional
How often devices are synced from the integration, in minutes. Minimum value is 1 minute, maximum is 1440 minutes.

4 status codes
200Returns the created SentinelOne integration configuration, including its ID, account and creator identifiers, API URL, groups, sync settings, matching attributes, enabled state, and timestamps.
account_idstringrequired
The identifier of the account this integration belongs to.
api_urlstringrequired
The Base URL of SentinelOne API
created_atstringrequired
Timestamp of when the integration was created.
created_bystringrequired
The user id that created the integration
enabledbooleanrequired
Indicates whether the integration is enabled
groupsarray<object>required
List of groups
idintegerrequired
The unique numeric identifier for the integration.
last_synced_atstringrequired
Timestamp of when the integration was last synced.
last_synced_intervalintegerrequired
The devices last sync requirement interval in hours.
match_attributesobjectrequired
Attribute conditions to match when approving agents
sync_intervalintegerrequired
How often devices are synced from the integration, in minutes.
updated_atstringrequired
Timestamp of when the integration was last updated.
400Returned when the request contains invalid JSON, omits a required field, or fails validation.
messagestringoptional
A human-readable error message.
401Returned when the request has no valid authentication token.
messagestringoptional
A human-readable error message.
500Returned when an internal server error occurs.
messagestringoptional
A human-readable error message.

Error handling

api_token, api_url, groups, last_synced_interval, and match_attributes are required; omitting any returns a 400. last_synced_interval must be at least 24 hours, and sync_interval must be between 1 and 1440 minutes when provided; match_attributes.network_status must be connected, disconnected, or quarantined. A 401 indicates missing or invalid authentication, and a 500 indicates an internal server error.