NetBird Full API Reference + Read-Only MCP Prototype
PUT/api/integrations/edr/falcon

Replace a Falcon EDR integration configuration

Replaces the configuration of an existing Falcon EDR integration. Supply client_id, secret, cloud_id, groups, and zta_score_threshold; sync_interval must be between 1 and 1440 minutes when provided. A 200 response returns the updated integration and its configuration.

7 body fields

CrowdStrike credentials and configuration to apply to the Falcon EDR integration.

client_idstringrequired
CrowdStrike API client ID
cloud_idstringrequired
CrowdStrike cloud identifier (e.g., "us-1", "us-2", "eu-1")
enabledbooleanoptional
Indicates whether the integration is enabled
Default:true
groupsarray<string>required
The Groups this integration applies to
secretstringrequired
CrowdStrike API client secret
sync_intervalintegeroptional
How often devices are synced from the integration, in minutes. Minimum value is 1 minute, maximum is 1440 minutes.
zta_score_thresholdintegerrequired
The minimum Zero Trust Assessment score required for agent approval (0-100)

5 status codes
200Returns the updated Falcon EDR integration, including its identifier, account, groups, configuration, and sync timestamps.
account_idstringrequired
The identifier of the account this integration belongs to.
cloud_idstringrequired
CrowdStrike cloud identifier
created_atstringrequired
Timestamp of when the integration was created.
created_bystringrequired
The user id that created the integration
enabledbooleanrequired
Indicates whether the integration is enabled
groupsarray<object>required
List of groups
idintegerrequired
The unique numeric identifier for the integration.
last_synced_atstringrequired
Timestamp of when the integration was last synced.
sync_intervalintegerrequired
How often devices are synced from the integration, in minutes.
updated_atstringrequired
Timestamp of when the integration was last updated.
zta_score_thresholdintegerrequired
The minimum Zero Trust Assessment score required for agent approval (0-100)
400Returned when the JSON is invalid, a required field is missing, or a value fails validation.
messagestringoptional
A human-readable error message.
401Returned when the request is unauthorized.
messagestringoptional
A human-readable error message.
404Returned when the Falcon EDR integration is not found.
messagestringoptional
A human-readable error message.
500Returned when an internal server error occurs.
messagestringoptional
A human-readable error message.

Error handling

Invalid JSON, a missing required field, or an invalid value returns a 400; sync_interval must be between 1 and 1440 minutes and zta_score_threshold must be between 0 and 100. A 401 is returned when authentication is unauthorized, a 404 when the integration is not found, and a 500 when an internal server error occurs.