Changelog

Version 3.3 November 2024

Features

New subscription requests

You can now start and stop subscriptions with the following requests:

  • a PUT request to the subscriptions/start endpoint, to start a subscription.
  • a PUT request to the subscriptions/stop endpoint, to stop a subscription.

New webhook requests

You can now configure and manage webhooks for your workspaces. For more information about webhooks, see what are webhooks.

Webhooks requests include:

  • a POST request to the settings/webhooks endpoint: Create a webhook configuration
  • a GET request to the settings/webhooks/{id}/test endpoint: Test a webhook configuration
  • a PUT request to the settings/webhooks/{id} endpoint: Update a webhook configuration
  • a GET request to the settings/webhooks/{id} endpoint: Retrieve a webhook configuration
  • a GET request to the settings/webhooks endpoint: Retrieve all webhook configurations
  • a DELETE request to the settings/webhooks/{id} endpoint: Delete a webhook configuration

Enhancements

New parameters in request body when triggering a ticket action

When making a POST request to the tickets/{id}/actions endpoint, the following parameters are now included in the request body:

  • eventAction > uiView : The name of the event as it appears in the Coro console.
  • eventAction > type : The group type of the ticket, such as EDR or malware.

Version 3.2 June 2024

Features

New subscription requests

You can now send subscription calls which enable admin portal users to view and manage workspace subscriptions. The calls include:

  • a GET request to the /subscriptions endpoint: Retrieve the subscription details of a specific workspace, including the modules and add-ons that are enabled and disabled.
  • a PUT request to the /subscriptions endpoint: Update the subscription of a specific workspace. Modifying your subscription alters your billing amount. Required modules and add-ons must be enabled. To get the details of which modules and add-ons must be enabled for different bundles offered by Coro, use the POST request to the /subscriptions/bundleInfo endpoint.
  • a POST request to the /subscriptions/bundleInfo endpoint: Retrieve the details of modules and add-ons included in specific bundles offered by Coro. These details can be used to update your subscription with the PUT request to the /subscriptions endpoint.
Important

Modifying your subscription alters your billing amount.

New archive workspace endpoint

You can now make a PUT request to the /workspaces/archive endpoint to archive an inactive workspace using the specified workspace ID. When a workspace is archived, any cloud applications are disconnected, and Inbound Gateway and Network settings are cleared. Admin portal users can’t sign into archived workspaces, and archived workspaces don’t appear in an MSP's list of workspaces.

New pendingAdminEmails parameter

The pendingAdminEmails parameter is now returned in the GET and POST requests to the /workspaces endpoint. The parameter lists the email addresses of all admin portal users invited to the workspace who have not yet activated their accounts.

Enhancements

role parameter returned in additional response

The role parameter is now returned in the GET request to the /portal-users endpoint. This is a read-only parameter, which can't be edited through the API. The role parameter reflects an admin portal user's role within the Coro console. All current and future admin portal users added through the API automatically receive a super admin role, granting them full permissions and access in the Coro console.

Improved descriptions

Descriptions for parameters and endpoints have been improved.

Version 3.1.1 March 2024

Features

New role parameter

The role parameter is now returned in the GET request to the /portal-users/{id} endpoint. This is a read-only parameter, which can't be edited through the API. The role parameter reflects an admin portal user's role within the Coro console. All current and future admin portal users automatically receive a super admin role, granting them full permissions and access in the Coro console.

Version 3.1 February 2024

Features

Multi-region deployment

Coro now allows users to store data in Canadian and German data centers, alongside existing US centers. This feature is essential for users in Canada and Europe, meeting local regulatory requirements to keep data within their operational region.

The environment for each region has a unique URL:

  • US: api.secure.coro.net
  • Canada: api.secure-ca.coro.net
  • Germany: api.secure-eu.coro.net

New endpoint /devices/{enrollmentCode}/actions

You can now make GET and POST requests to the /devices/{enrollmentCode}/actionsendpoint.

For both requests, the device enrollment code is required. You can retrieve this by making a GET request to the /devices endpoint.

The GET request retrieves all supported actions for a device, while the POST request performs actions on the device.

The actions included are:

Action Description Values
deviceProtection Remove a device from protection. remove
malwareScan Malware scans conduct a thorough scan of specified drives, detecting malware. start; stop
tamperProtection Tamper protection prevents users and certain types of malware from tampering with important security features or disabling protection. enable; disable
dataGovernanceScan Data governance scans conduct a thorough scan of specified drives for sensitive data. startFullScan; startPartialScan; stop
updateAgent Update the device’s Coro Agent to the latest version. updateToLatest
driveEncryption Drive encryption protects the data on that drive from unauthorized access. Metadata is required: {"driveLetter": "driveLetter"}. The driveLetter is the identifier of the drive, such as C drive, D drive, etc. encrypt
deviceState The state of the device, which can be shut down or restarted. shutdown; restart

New endpoints for portal users

You can now make the following requests:

  • GET request to the /portal-user endpoint: retrieve a list of portal users
  • GET request to the /portal-user/{id} endpoint: retrieve a specific portal user
  • POST request to the /portal-user endpoint: add a portal user to the workspace

Version 3.0.1 December 2023

Features

New parameters in GET /usage endpoint

The moduleStatistics object is now returned in the GET request to the /usage resource endpoint. This object contains details about the number of devices associated with each module. The object returned appears similar to:

Copy
Copied
 "moduleStatistics": {
        "deviceModules": {
          "endpointSecurity": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "endpointDataGovernance": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "edr": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "network": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "mdm": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          }
        },
        "mdmModules": {
          "active": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "disenrolled": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "inactive": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          }
        }
      }

The following table describes the parameters in the response:

Parameter Description Example
moduleStatistics An object containing details of module device statistics for the workspace. -
deviceModules The number of devices associated with each module in the workspace. -
deviceModules_endpointSecurity The number of devices associated with the endpoint security module in the workspace. -
deviceModules_endpointSecurity_windowsCount The number of Windows devices associated with the endpoint security module. 120
deviceModules_endpointSecurity_macOsCount The number of macOS devices associated with the endpoint security module. 130
deviceModules_endpointSecurity_androidCount The number of Android devices associated with the endpoint security module. 125
deviceModules_endpointSecurity_iosCount The number of iOS devices associated with the endpoint security module. 125
deviceModules_endpointDataGovernance The number of devices associated with the endpoint data governance module in the workspace. -
deviceModules_endpointDataGovernance_windowsCount The number of Windows devices associated with the endpoint data governance module. 120
deviceModules_endpointDataGovernance_macOsCount The number of macOS devices associated with the endpoint data governance module. 130
deviceModules_endpointDataGovernance_androidCount The number of Android devices associated with the endpoint data governance module. 125
deviceModules_endpointDataGovernance_iosCount The number of iOS devices associated with the endpoint data governance module. 125
deviceModles_edr The number of devices associated with the EDR module in the workspace. -
deviceModles_edr_windowsCount The number of Windows devices associated with the EDR module. 120
deviceModles_edr_macOsCount The number of macOS devices associated with the EDR module. 130
deviceModles_edr_androidCount The number of Android devices associated with the EDR module. 125
deviceModles_edr_iosCount The number of iOS devices associated with the EDR module. 125
deviceModules_network The number of devices associated with the network module in the workspace. -
deviceModules_network_windowsCount The number of Windows devices associated with the network module. 120
deviceModules_network_macOsCount The number of macOS devices associated with the network module. 130
deviceModules_network_androidCount The number of Android devices associated with the network module. 125
deviceModules_network_iosCount The number of iOS devices associated with the network module. 125
deviceModules_mdm The number of active devices associated with the MDM module in the workspace. -
deviceModules_mdm_windowsCount The number of active Windows devices associated with the MDM module. 120
deviceModules_mdm_macOsCount The number of active macOS devices associated with the MDM module. 130
deviceModules_mdm_androidCount The number of active Android devices associated with the MDM module. 125
deviceModules_mdm_iosCount The number of active iOS devices associated with the MDM module. 125
mdmModules The number of devices associated with the MDM module in the workspace. -
mdmModules_active The number of active, connected devices associated with the MDM module in the workspace. -
mdmModules_active_windowsCount The number of active Windows devices associated with the MDM module. 110
mdmModules_activ_macOsCount The number of active macOS devices associated with the MDM module. 120
mdmModules_active_androidCount The number of active Android devices associated with the MDM module. 115
mdmModules_active_iosCount The number of active iOS devices associated with the MDM module. 115
mdmModules_disenrolled The number of disenrolled devices in the workspace. -
mdmModules_disenrolled_windowsCount The number of disenrolled Windows devices associated with the MDM module. 5
mdmModules_disenrolled_macOsCount The number of disenrolled macOS devices associated with the MDM module. 5
mdmModules_disenrolled_androidCount The number of disenrolled Android devices associated with the MDM module. 5
mdmModules_disenrolled_iosCount The number of disenrolled iOS devices associated with the MDM module. 5
mdmModules_inactive The number of inactive devices in the workspace. Inactive devices haven’t responded in at least three days. -
mdmModules_inactive_windowsCount The number of inactive Windows devices associated with the MDM module. 5
mdmModules_inactive_macOsCount The number of inactive macOS devices associated with the MDM module. 5
mdmModules_inactive_androidCount The number of inactive Android devices associated with the MDM module. 5
mdmModules_inactive_iosCount The number of inactive iOS devices associated with the MDM module. 5

Version 3.0 October 2023

Features

New GET /usage endpoint

You can now make a GET request to the /usage resource endpoint to view the usage of a workspace.

The request appears similar to:

Copy
Copied
curl -i -X GET \
  'http://api.secure.coro.net/v1/usage?start={start}&end={end}&page={page}&pageSize={pageSize}' \
  -H 'Authorization: Bearer <access_token>' \
  -H 'Workspace: Workspace1'

The following table describes the parameters in the request:

Parameter Description Example Required
Workspace The workspace identifier, which isolates API requests inside the provided workspace scope. Workspace1 yes
start Filter by a start time, in UNIX format, including milliseconds. 1697093798 yes
end Filter by an end time, in UNIX format, including milliseconds. 1698093798 yes
page API responses use pagination to reduce loading time. Return a specific page of results, using a zero-based page index (0..N). 3 no
pageSize API responses use pagination to reduce loading time. Return a maximum of this many items per page. 20 no

A successful response appears similar to:

Copy
Copied
HTTP/1.1 200 OK
Content-Type: application/json
Date: {date}
X-Coro-Trace-Id: {trace-id}
Transfer-Encoding: chunked

{
  "items": [
    {
      "workspaceId": "companyWorkspace",
      "parentWorkspaceId": "partnerWorkspace",
      "workspaceType": "child",
      "time": 1672545600000,
      "subscriptionType": "subscription",
      "trialStartDate": 1694009438802,
      "trialEndDate": 1694009438802,
      "connectedCloudApplications": [
        "Google_workspace"
      ],
      "modules": [
        "NETWORK"
      ],
      "addons": [
        "SECURED_WEB_GATEWAY"
      ],
      "bundles": [
        "MANAGED_SASE"
      ],
      "users": {
        "protectedUsers": 215,
        "protectableUsers": 130
      },
      "devices": {
        "protectedDevicesStats": {
          "windowsCount": 115,
          "macOsCount": 100,
          "androidCount": 115,
          "iosCount": 100
        }
      },
      "atcEnabledStats": {
        "windowsCount": 0
      }
    }
  ],
  "totalElements": 0
}

The following table describes the parameters in the response:

Parameter Description Type Example
workspaceId The unique identifier of the workspace. header companyWorkspace
parentWorkspaceId The unique identifier of the parent workspace. query partnerWorkspace
workspaceType The type of workspace being created.
Options include: regular - for individual companies; channel - for the MSP parent level; child - for MSP customers.
query child
time The time at which the workspace usage information was taken, in UNIX format, including milliseconds. query 1672545600000
subscriptionType The type of subscription.
Options include: initial - a workspace has been created but an onboarding event to trigger the trial state has not yet occurred; trial - an onboarding event has been triggered, such as a cloud app is connected or device is activated; freeze - the trial or subscription has expired; subscription - an MSP admin has started the subscription.
query subscription
trialStartDate The start of the trial, if applicable, in UNIX format, including milliseconds. query 1697093798
trialEndDate The end of the trial, if applicable, in UNIX format, including milliseconds. query 1698093798
connectedCloudApplications The cloud applications connected to the workspace. query Google workspace
modules The modules enabled in the workspace. query NETWORK
addons The add-ons enabled in the workspace. query SECUREDWEBGATEWAY
bundles The bundles enabled in the workspace. query MANAGED_SASE
users_protectedUsers The number of protected users in the workspace across all apps. query 215
users_protectableUsers The number of protectable users in the workspace across all apps. Protectable users do not currently have protection enabled. query 130
devices_protectedDevicesStats_windowsCount The number of Windows devices in the workspace. query 115
devices_protectedDevicesStats_macOsCount The number of macOS devices in the workspace. query 100
devices_protectedDevicesStats_androidCount The number of Android devices in the workspace. query 115
devices_protectedDevicesStats_iosCount The number of iOS devices in the workspace. query 100
atcEnabledStats_windowsCount The number of Windows devices with ATC enabled. When enabled, Coro monitors active processes for known and potential threats, and blocks processes (that are not explicitly allowlisted) that exhibit suspicious behavior. query 0

New parameters in the GET /workspaces and POST /workspaces calls

The 200 successful response of the GET and POST requests to the /workspaces resource endpoint now has additional parameters:

  • mainAdminEmail - the initial admin email address provided when the workspace was created
  • adminEmails - the email addresses of all admins associated with the workspace
  • lastAdminLoginTime - the most recent login to the workspace by an admin user, in UNIX format, including milliseconds
  • workspaceCreationTime - the date the workspace was created, in UNIX format, including milliseconds