/portalAPI/Policy/*

This article will encompass all portalAPI calls that are related to /portalAPI/Policy/* endpoints

 

If you are new to working with ThreatLocker PortalAPI endpoints and/or have questions regarding authentication and terminology used throughout this article, please look through the following guide:

Getting Started with ThreatLocker PortalAPIs

PolicyGetById

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyGetById

• Method: GET
• Description: This API is used when navigating to the Apps icon and selecting the Policies page from the popout menu in the ThreatLocker Portal, then locating and selecting the policy for which you want to view policy information. This API is also used when viewing an application from the Apps -> Applications page using the application sidebar, selecting the Existing Policies tab, and selecting a policy to view its information. This API returns detailed policy information for the selected policy, including but not limited to the applications associated with it, the action it will take, where it applies, and its position in the policy order. Ensure the managedOrganizationId header matches the location where the policy exists.
• Required Body/Parameters
  • Parameters
    
    • policyId: This field determines which policy's information will be returned.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
• Optional Body/Parameters
  
  • N/A
• Permission Requirements
  • Assign any one of the following permissions:

    • Edit Application Control Policies
    • View Application Control Policies

PolicyGetByParameters

• • • pageNumber and pageSize: These fields determine how many policies will be returned, as if the response were on the Policies page. However, these fields do not follow the same conventions for pageNumber and pageSize as the Portal does (the Portal uses 25, 50, 100, or 500 for pageSize). Any valid integer can be entered, and it will be returned in the selected format. For instance, if there are 5 policies to be returned but “pageNumber”: 1 and “pageSize”: 2, 2 entries will be returned per page, and the first two policies will be shown.

      • Expects: An Integer value

• Optional Body/Parameters
  
  • Fields
    • activeOnly: This field determines whether only active policies will be returned. When this field is omitted or set to false, all policies, including inactive and expired, will be returned based on the other fields used. When set to true, only the active policies will be returned.
      • Expects: true or false
    • osType: This field determines the OS type of the policies that will be returned. It is used only in combination with the computerGroupId field when it is set to "00000000-0000-0000-0000-000000000000". If the computerGroupId field is set to view a specific location, either an organizationId, computerGroupId, or computerId, this field can be omitted. This field expects the Integer associated with the OS type:
      • Windows = 1
      • MAC = 2
      • Linux = 3
      • Windows XP = 5
    • searchText: This field allows you to search through your policies by inputting any text/details you want to search for. When this field is omitted, all policies will be shown based on the other search fields used. This field searches results by policy name, case-insensitively, effectively using wildcards on either side of the text entered. For example, when entering "is a test", the policy name "This is a test policy" would be returned. Anything that matches or contains the string will be returned based on the other fields used.
      • Expects: Any text input
    • showAllPolicies: This field is used when a computerGroupId value other than "00000000-0000-0000-0000-000000000000" is used. When this field is omitted or set to false, only policies located at the computerGroupId specified will be shown. When this field is set to true, it shows any policy that affects the currently selected policy level. This means that if a computerId is entered into the computerGroupId field, any policies that apply at the global, global group, entire organization, and computer group levels will be displayed, in addition to the policies at the computer level. This is because the computer may have policies at these levels that could affect it as well. The order in which these policies are shown and affect your endpoints depends on the policy structure your organization uses: hierarchical or flat. For more information on these structures, see the KB articles below:

Policy Order Changes | ThreatLocker Help Center

Policy Hierarchy | ThreatLocker Help Center

• • • • Expects: true or false

• Permission Requirements
  • Assign any one of the following permissions:

    • Edit Application Control Policies
    • View Application Control Policies

PolicyGetForViewPoliciesByApplicationId

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyGetForViewPoliciesByApplicationId

• Method: POST
• Description: This API is used when navigating to the Application Control page in the ThreatLocker Portal, selecting the Applications tab, and selecting the policy icon in the Policies column next to an application to view the policies attached to the application. This API is also used when viewing an application using the application sidebar and selecting the Existing Policies tab. This API can be used to identify the number of policies applied to a specific application and how those policies are applied within the organization (either permitted, permitted with or without a Ringfence™, permitted with or without Elevation, and/or denied).

Note: Currently, only policies that exist at the organization specified explicitly in the organizationId field below will be shown. This means that when viewing child organization policies, any global policies affecting the organization that exist at a parent organization will not be shown.

• Required Body/Parameters
  • Fields
    • applicationId: This field determines which application's policies will be returned. To get a list of applicationIds for the applications in your organization, use the ApplicationGetByParameters endpoint, as documented in this article:

ApplicationGetByParameters

• • • • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • organizationId: This field expects the organizationId of the organization where you want to view the policies associated with the selected application. To view the policies in a different organization than the currently logged in/managed organization, change this organizationId to any organization the user has access to (typically a child organization).
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • pageNumber and pageSize: These fields determine the number of policies that will be returned per page. However, these fields do not follow the same conventions as the pageNumber and pageSize values used by the Portal do (pageSize in the Portal is 25, 50, or 100). Any valid Integer can be entered, and it will return in the selected formatting. For instance, if there are 5 policies to be returned, but “pageNumber”: 1 and “pageSize”: 2, 2 entries will be returned per page, and the first two policies will be shown.
      • Expects: An Integer value

• Optional Body/Parameters
  
  • Fields
    • appliesToId: This field determines the level at which policies will be returned. Any valid organizationId, computerGroupId, or computerId can be entered. When an ID is entered into this field, the search will be narrowed to the specific ID (location) entered. For example, when entering a computerId, the selected application's policies that are returned will be only the policies applied at that computer, if there are policies applied at that level. Ensure that the ID selected is located within the organizationId entered above. When this field is omitted or set to "00000000-0000-0000-0000-000000000000", all policies at any level within the organization for the specified application will be returned.
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • includeDenies: This field determines whether explicit deny policies will be included when returning the policies associated with the selected application. When set to true, the deny policies will be returned. When this field is omitted or set to false, the deny policies will not be returned; Only policies that are set to permit or permit with Ringfence™, with and without Elevation, will be returned.
      • Expects: true or false

• Permissions Needed for User
  • View Application Control Policies
  • Edit Application Control Policies

PolicyInsert

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyInsert

• Method: POST
• Description: This API is used when navigating through the Apps pages of the ThreatLocker Portal, locating and selecting the "+ New Policy" button, entering new policy details, and selecting "Create." This API creates new Allowlisting policies in your organization.

Ensure that the managedOrganizationId you use aligns with where the policy will be created as per what is entered into the computerGroupId field outlined below.

 

Once you have called this API to create your new policy, be sure to deploy policies in the organization where the policy was created, or for all organizations if a global policy was created. This can be done either through the Portal using the Deploy Policies button or through the API, documentation linked below.

/portalAPI/DeployPolicyQueue/* | ThreatLocker Help Center

• Required Body/Parameters
  • Fields

Note: These are the only fields required; however, without the isEnabled field set to true, the new policy will be created as inactive. Also, without the logAction field set to true, the new policy will not log to the Unified Audit when it is matched.

• • • applicationIdList: This field determines which applications will be added to the new policy. One or multiple applications can be added to the new policy. For each application, enter the applicationId in the format below. The Required body section formats the addition of two applications to a new policy.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • computerGroupId: This field determines where the new policy will be applied. This field corresponds to the Applies To section of the Create Application Policy sidebar in the Portal. Any valid organizationId, computerGroupId, or computerId can be entered. For instance, if looking to apply the policy at the entire organization level, enter the organizationId into this field.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • logAction: This field determines whether, when the new policy is matched, it will log to the Unified Audit. This field can only be set to false when policyActionId is set to 1. Otherwise, this field should be set to true to log to the Unified Audit.

      • Expects: true or false
    • name: This field specifies the name of the new policy. Any name can be entered, and the policyId will be automatically generated.

      • Expects: Any text input
    • osType: This field determines the OS Type that will be applied to the new policy. OSTypes to select from are listed below. This field expects the Integer associated with the OSType:

      • Windows = 1
      • MAC = 2
      • Linux = 3
      • Windows XP = 5
    • policyActionId: This field determines the policy action that will apply to the new policy. This field expects the Integer associated with the policy action to be entered:

      • Permit = 1
      • Deny = 2
      • Permit with Ringfencing = 6

• Optional Body/Parameters
  • Fields
    
    • allDevices: This field determines whether the new policy will apply to all interfaces or to a specific interface. When this field is omitted or set to true, the new policy will apply to all interfaces, and the deviceType field should not be used/included. When this field is set to false, the deviceType field must be used, so only one specific interface will affect the new policy.

      • Expects: true or false
    • allUserGroups: This field determines whether the new policy will apply to all users and groups or to selected users and groups. When this field is omitted or set to true, the policy will apply to all users and groups, and the userGroups field should not be used/included. When this field is set to false, the userGroups field must be used to ensure that only selected users and groups are affected by the new policy.

      • Expects: true or false
    • allowRequest: This field determines whether the new policy will allow the user to request access to a denied file via the ThreatLocker Tray prompt. It can only be used when the policyActionId field is set to 2. When this field is omitted or set to false, the user will not be able to request access. When this field is set to true, the user can request access via the ThreatLocker Tray prompt and send an Approval Request.

      • Expects: true or false

Note: ThreatLocker does not recommend using the applicationSelection field below unless you are creating a default deny policy. Improper use of this field could cause all applications to be permitted. A warning is displayed before creating a new policy associated with all applications, and to create a policy with this setting, the name must either contain "Permit All" or begin with "Default - "

• • • applicationSelection: This field determines whether the new policy will apply to selected applications or to all applications. When this field is omitted or set to 0, the applications in the applicationIdList field will be added to the policy. Only when this field is explicitly set to 1 will the policy be created to use all applications.

      • Expects: Integer value 0 or 1
    • comments: This field determines the text/comments that will be added to the File Path text box in the Ticket Details tab of the new policy in the ThreatLocker Portal. When this field is omitted, no comments will be added to the new policy. This field is typically used to indicate any file paths that may have been referenced during the creation of the new policy, but can be used as you see fit.

      • Expects: Any text input
    • description: This field determines the description that will be added to the new policy. When this field is omitted, or nothing is entered (null or ""), no description will be added to the new policy.

      • Expects: Any text input
    • deviceType: This field specifies which interface the new policy will apply to and can only be used when allDevices is set to false. When allDevices is set to true, anything entered in this field is ignored as the policy will apply to all devices. This field expects one of the following options to be entered exactly as they appear below:

      • USB
      • DVD
      • UNC
      • SCSI
      • SATA
      • IDE
    • elevationEndDate: This field, when Elevation will be applied to the new policy, determines when the Elevation will expire. When this field is omitted or null, and Elevation will be applied, it will never expire. When this field is used, and Elevation expires before the new permit policy does, two policies are created in the ThreatLocker Portal. One policy will be created with Elevation enabled, with the expiration specified in this field. The other policy will be created with no Elevation to continue permitting the application once the Elevation expires. This field only affects Elevation's expiration and does not affect the policy's expiration as a whole. The overall policy expiration configuration is completed with the policyScheduleStatus and endDate fields. This field expects a time entered in UTC in format "YYYY-MM-DDTHH:MM:SSZ", where YYYY is the year, the first MM is the month, DD is the day, HH are the hours, the second MM are the minutes, and SS are the seconds. The T must be included to designate the time and should not be changed or removed.

      • Expects expiration date and time in format: "YYYY-MM-DDTHH:MM:SSZ"
    • elevationStatus: This field determines whether Elevation will be applied to the new policy. When this field is omitted or set to 0, no Elevation will be applied to the new policy. When selecting the "Do not Elevate" or "Force the program to run as a standard user (Does not apply to administrators)" options, the elevationEndDate field should not be used, as no expiration can be specified with these options using this field. This field expects one of the corresponding Integer values to be entered.

      • Do not Elevate = 0
      • Elevate to run as local administrator (Notify User) = 1
      • Elevate to run as local administrator (Do Not Notify User) = 2
      • Force the program to run as a standard user (Does not apply to administrators) = 3
    • endDate: This field determines when a new policy will expire and can only be used when policyScheduleStatus is set to 1. When this field is omitted, the policy will never expire. This expects a time entered in UTC in format "YYYY-MM-DDTHH:MM:SSZ", where YYYY is the year, the first MM is the month, DD is the day, HH are the hours, the second MM are the minutes, and SS are the seconds. The T must be included to designate the time and should not be changed or removed.

      • Expects expiration date and time in format: "YYYY-MM-DDTHH:MM:SSZ"
    • isEnabled: This field determines whether the policy will be enabled when the new policy is created. When this field is omitted or set to false, the policy will not be enabled. When this field is set to true, the policy will be enabled.

      • Expects: true or false
    • killRunningProcesses: This field determines whether the new policy will kill any running processes, including the process that the file originated from, when the policy is matched. It can only be used when policyActionId is set to 2. When this field is omitted or set to false, kill running processes will not be enabled. When this field is set to true, kill running processes will be enabled.

      • Expects: true or false
    • monitorMode: This field determines the status that will be applied to the new policy. When this field is omitted or set to 0, the policy will be set to "Inherit Status From Computer", meaning the policy's behavior depends on the computer's Maintenance Mode. When this field is set to 1, the policy will be set to "Secured Mode", meaning that regardless of the computer's Maintenance Mode, the policy will behave as indicated by the policy action (Permit with Ringfence or Deny). When this field is set to 2, the policy will be set to "Monitor Only Mode", meaning that regardless of the computer's Maintenance Mode, the policy will behave as if the computer is in the "Application Control Monitor Only" Maintenance Mode. Setting this field to 2 is particularly useful when setting up Ringfencing for the first time, as it will monitor Ringfencing traffic passing through the policy without blocking anything. This field can only be used when policyActionId is set to 2 (Deny) or 6 (Permit with Ringfencing).
      • Expects: Integer value 0, 1, or 2
    • networkExclusions: This field determines the exclusions that will be added for Internet Ringfencing and can only be used when policyActionId is set to 6 and restrictNetworkAccess in ringfencingOptions is set to true. When this field is omitted, no exclusions will be added. One or multiple exclusions can be added. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:

      • tagPrefixTypeId: This field specifies what type of exclusion will be added: a domain, IPv4, or IPv6. This field expects one of the following Integer values to be entered, corresponding to the type of exclusion desired:

      • • Domain = 1
        • IPv4 = 2
        • IPv6 = 3

      • value: This field determines the domain, IPv4, or IPv6 value that will be applied to the new Ringfencing policy.

      • • Expects: Either a valid IPv4 or IPv6 address (in correct CIDR notation) or a valid domain
    • notifyOnRequest: This field determines whether the new policy will notify the listed ThreatLocker administrator(s) (in the requestEmailAddressesList field) through email/SMS of an Approval Request generated after the policy was matched. This field can only be used when policyActionId is set to 2, allowRequest is set to true, and the requestEmailAddressesList field contains at least one email. When this field is omitted or is set to false, no administrators will be notified. When this field is set to true, the administrators listed will be notified.

      • Expects: true or false
    • orderBefore: This field determines where the new policy will be placed in the policy order, depending on the level/location it will be applied. When this field is omitted or set to false, the policy will be added to the bottom of the policy order at the selected location. When this field is set to true, the policy will be added to the top of the policy order at the selected location.

      • Expects: true or false
    • parentProcessIdList: This field specifies the applications allowed to launch the application(s) associated with the new policy. One or multiple applications can be entered. The Optional body section formats the addition of two applications to the new policy. When using this field, ensure that the parentRestrictionEnabled field is set to true. For each application, enter the applicationId in the format below. Ensure that the applications specified in this field utilize the same osType as the policy.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • parentRestrictionEnabled: This field determines whether the new policy will restrict the application(s) permitted to launch the selected application(s) in the new policy. When this field is omitted or set to false, the parentProcessIdList field must not be used so that all applications can launch the application(s) associated with the new policy. When this field is set to true, the parentProcessIdList field must be used to ensure that only the selected application(s) can launch the application(s) associated with the new policy.

      • Expects: true or false
    • policySchedules: This field determines the schedule of the new policy and can only be used when policyScheduleStatus is set to 2. Each of the following fields is used for each defined policy schedule.

      • dayoftheWeek: This field determines the day of the week during which the new policy will be enabled. This field expects an Integer between 0 and 6, 0 being Sunday and 6 being Saturday.

      • • Expects: Any Integer value between 0 and 6

      • durationHours: This field determines the number of hours that the new policy will be enabled. This field expects any valid Integer value less than 24.

      • • Expects: Any Integer value between 0 and 23

      • durationMinutes: This field determines the number of minutes that the new policy will be enabled. This field expects any valid Integer value less than 60.

      • • Expects: Any Integer value between 0 and 59

      • startTime: This field expects the start time to be entered in a 24-hour format "YYYY-MM-DDTHH:MM:SSZ", where YYYY is the year, the first MM is the month, DD is the day, HH are the hours, the second MM are the minutes, and SS are the seconds. The T must be included to designate the time and should not be changed or removed.

      • • Expects start date and time in format: "YYYY-MM-DDTHH:MM:SSZ"
    • policyScheduleStatus: This field determines whether a policy expiration or a policy schedule will be applied to the new policy. When this field is omitted or set to 0, no policy expiration or schedule will be applied. When this field is set to 1, the endDate field must be used to specify an expiration date. When this field is set to 2, the policySchedules field must be used to specify the days, duration (in hours and minutes), and start time of the new policy.

      • Expects: Integer value 0, 1, or 2
    • requestEmailAddressesList: This field specifies the email address(es) of the ThreatLocker administrator(s) who will be notified when a request is sent in relation to the new policy and can only be used when the allowRequest and notifyOnRequest fields are set to true. One or multiple email addresses can be entered, as shown in the Optional body section below.

      • Expects: Any valid email address(es)
    • requestor: This field determines the text/requestor information that will be added to the Requestor text box in the Ticket Details tab of the new policy in the ThreatLocker Portal. When this field is omitted, no requestor information will be added to the new policy. This is typically used to indicate who requested the new policy to be implemented, but can be used as you see fit.

      • Expects: Any text input 
    • ringfencingOptions: This field specifies the conditions under which Ringfencing will be applied to the new policy. To apply Ringfencing, the policyActionId must be set to 6. The following fields can be combined to add the desired amount of Ringfencing and initial exclusions.

      • restrictApplication: This field determines whether Application Ringfencing will apply to the new policy and can only be used when restrictApplicationSpawning is omitted or set to false. When this field is omitted or set to false, Application Ringfencing will not be applied. When this field is set to true, all application interactions will be allowed except for those listed in the rfAssociatedApplicationPolicy field below.

      • • Expects: true or false

      • restrictApplicationSpawning: This field determines whether Application Ringfencing will apply to the new policy and can only be used when restrictApplication is omitted or set to false. When this field is omitted or set to false, Application Ringfencing will not be applied. When this field is set to true, all application interactions will be blocked except for those listed in the rfAssociatedApplicationPolicy field below.

      • • Expects: true or false

      • restrictFileAccess: This field determines whether File Ringfencing will apply to the new policy. When this field is omitted or set to false, File Ringfencing will not be applied. When this field is set to true, File Ringfencing will be applied to any monitored file path in Storage Control and any paths configured in the rfFilePolicy field.

      • • Expects: true or false

      • restrictNetworkAccess: This field determines whether Internet Ringfencing will apply to the new policy. When this field is omitted or set to false, Internet Ringfencing will not be applied. When this field is set to true, Internet Ringfencing will be applied to any internet/network interaction and will respond accordingly when entries match the networkExclusions or rfNetworkPolicy fields. If the interaction does not match either the networkExclusions or rfNetworkPolicy fields, the interaction will be blocked.

      • • Expects: true or false

      • restrictRegistryAccess: This field determines whether Registry Ringfencing will apply to the new policy. When this field is omitted or set to false, Registry Ringfencing will not be applied. When this field is set to true, Registry Ringfencing will be applied to any registry interaction and will respond accordingly when entries match the rfRegistryPolicy field. If the interaction does not match the rfRegistryPolicy field, the interaction will be blocked.

      • • Expects: true or false

      • rfAssociatedApplicationPolicy: This field determines which applications/exclusions will be blocked from interacting or allowed to interact, depending on whether the restrictApplication or restrictApplicationSpawning field is used. When this field is omitted, no application exclusions will be added. One or multiple exclusions can be added. As demonstrated in the Optional body section, each application/exclusion requires each of the fields listed below:

      • • applicationId: This field specifies the application that will be affected by Ringfencing.

      • • • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"

      • • osType: This field determines the OS Type of the application that will be Ringfenced. OSTypes to select from are listed below. This field expects the Integer associated with the OSType:

      • • • Windows = 1
          • MAC = 2
          • Linux = 3
          • Windows XP = 5

      • rfFilePolicy: This field determines the exclusions that will be added for File Ringfencing. When this field is omitted, no File Ringfencing exclusions will be applied. One or multiple exclusions can be added. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:

      • • action: This field determines the action that will be taken on the specified path below. This field expects an Integer value of either 1 or 2. The value of 1 will allow file interactions at the file path. The value of 2 will deny/block file interactions at the file path.

      • • • Expects: Integer value 1 or 2

      • • path: This field determines the file path that will be affected by the Ringfencing action taken. Be sure to use \\ instead of a single \ for the existing slashes in the path. Wildcards can be used in this field in the same way as in the ThreatLocker Portal, as shown in this example: c:\\users\\*\\documents\\*

      • • • Expects: Full file path or partial path with wildcards

      • • permission: This field determines whether the action of permit or deny will affect read, write, or both read and write actions taken on the specified file path. This field expects an Integer value of either 1 or 2. If the action is set to permit (1), an Integer value of 1 specifies that read actions will be permitted, and an Integer value of 2 specifies that read and write actions will be permitted. If the action is set to deny (2), an Integer value of 1 specifies that write actions will be denied, and an Integer value of 2 specifies that read and write actions will be denied.

      • • • Expects: Integer value 1 or 2

      • rfNetworkPolicy: This field determines the tags that will be added for Internet Ringfencing. When this field is omitted, no tag exclusions will be added. When no tags are added to this policy, this field should be removed from the body. One or multiple tags can be added. As demonstrated in the Optional body section, each tag requires each of the fields listed below:

      • • action: This field determines the action that will be taken on the specified tag. This field expects an Integer value of either 1 or 2. The value of 1 will allow the tag to interact with the application(s). The value of 2 will deny/block the tag interaction with the application(s).

      • • • Expects: Integer value 1 or 2

      • • port: This field determines the port number to which the tag will be applied. Only one port can be entered per tag; a range cannot be specified. The value of -1 will apply the tag to all ports.

      • • • Expects: An Integer value

      • • server: This field specifies the tagId/specific tag that this exclusion will apply to. This field expects the text "tag:", followed by the tagId of the tag being applied to the policy, as shown below.

      • • • Expects: "tag:00000000-0000-0000-0000-000000000000"

      • rfRegistryPolicy: This field determines the exclusions that will be added for Registry Ringfencing. When this field is omitted, no Registry exclusions will be added. One or multiple exclusions can be added. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:

      • • action: This field determines the action that will be taken on the specified path. This field expects an Integer value of either 1 or 2. The value of 1 will allow the Registry to interact with the path. The value of 2 will deny/block the Registry interaction with the path.

      • • • Expects: Integer value 1 or 2

      • • path: This field determines the Registry path that will be affected. Be sure to use \\ instead of a single \ for the existing slashes in the path. Wildcards can be used in this field like they can in the ThreatLocker Portal, as shown in this example: \\registry\\user\\software\\threatlocker\\*

      • • • Expects: Full file path or partial path with wildcards
    • ticketInfo: This field determines the text/comments that will be added to the Ticket text box in the Ticket Details tab of the new policy in the ThreatLocker Portal. When this field is omitted, no ticket information will be added to the new policy. This field is typically used to indicate any ticket number that may have been referenced during the creation of the new policy, but can be used as you see fit.

      • Expects: Any text input
    • userGroups: This field determines which users or groups the new policy will apply to and can only be used when allUserGroups is set to false. If allUserGroups is set to true, any input into this field will be ignored since the policy will apply to all users and groups. One or multiple users/groups can be entered. This field expects a username or group name in the format HOSTNAME\USERNAME or DOMAIN\USERNAME. For each user/group, enter the text and value fields. The Optional body section formats the addition of two users/groups to a new policy.

      • text: Expects: Any text input
      • value: Expects: Any text input

• Permission Requirements

  • Assign this permission:

  • • Edit Application Control Policies

   

PolicyInsertForCopyPolicies

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyInsertForCopyPolicies

• Method: POST
• Description: This API is used when navigating to the Application Control page, selecting the Policies tab, selecting the "Copy Existing Policies" button inside the "Policy Management" hamburger dropdown, selecting where and which policies you wish to copy, and then selecting the "Copy X Policy(s)" button, where this API is called. This API is responsible for copying Application Control policies in your organization.

Once you have called this API to copy your policy(s), be sure to deploy policies in the organization where the policy was copied into (or for all organizations if a global policy was copied). This can be done either through the Portal using the Deploy Policies button or through API, documentation linked below.

/portalAPI/DeployPolicyQueue/* | ThreatLocker Help Center

• Required Body/Parameters
  • Fields
    • osType: This field determines the OS Type of the policy that will be copied. Only one OS Type can be selected at a time, meaning a Windows policy and a MAC policy cannot be copied simultaneously. Ensure that the OS Type specified aligns with the policies and locations selected in the fields below. The available OSTypes are listed below. This field expects the Integer associated with the OSType:
      • Windows = 1
      • MAC = 2
      • Linux = 3
      • Windows XP = 5
    • policies: This field determines the policy(s) that will be copied. For each policy you wish to copy, enter the field below as shown in the Required body section.
      • policyId: This field determines which policy will be copied.
        • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • sourceAppliesToId: This field specifies the source organization, computer group, or computer from which the policy(s) will be copied. It is essential to note that only one sourceAppliesToId can be selected, meaning that each policy selected for copying must exist within the same source location within the same organization as the one specified below in the sourceOrganizationId field. For example, a computer group policy and a computer policy within the same organization cannot be copied simultaneously. Similarly, two computer group policies in separate organizations cannot be copied simultaneously either. However, two computer group policies within the same computer group and the same organization can be copied simultaneously.
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • sourceOrganizationId: This field specifies the source organization from which the policy(s) will be copied.
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • targetAppliesToIds: This field specifies the location(s) where the policy(s) will be copied to. One or multiple locations can be entered. Any organizationId, computerGroupId, or computerId can be entered. It is currently not possible to copy a policy up from a child organization to a parent organization if the policy uses a custom application that exists at the child organization. It is only possible to copy a policy down from a parent to a child and/or inside the organization where the policy already exists.

      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"

• Optional Body/Parameters
  • N/A
• Permissions Needed for User
  • Edit Application Control Policies

PolicyUpdateById

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyUpdateById

• Method: PUT
• Description: This API is used when navigating to the Apps icon and selecting the Policies page from the popout menu in the ThreatLocker Portal, then finding and selecting a policy you wish to change, making your changes, and selecting "Save". This API updates Allowlisting policies in your organization.

Ensure you review the Optional Body/Parameters section and review the current policy configuration of the policy you are making changes to. Many fields listed are not required to be entered/included in the call to this API. If some fields are not included, you may unintentionally make changes to your policy.

 

Ensure that the managedOrganizationId aligns with where the policy will be updated as per what is entered into the computerGroupId field outlined below.

Once you have called this API to edit your policy, be sure to deploy policies in the organization where the policy exists, or for all organizations if a global policy was edited. This can be done either through the Portal using the Deploy Policies button or through API, documentation linked below.

/portalAPI/DeployPolicyQueue/* | ThreatLocker Help Center

• Required Body/Parameters
  • Fields
    
    • applicationIdList: This field determines which applications will be applied to the policy. One or multiple applications can be added to the policy. The Required body section formats the addition/maintenance of two applications to the policy. To keep the same application(s) applied to the policy, enter the same applicationId(s) as those already applied. Ensure that the applications tied to the policy utilize the same osType as the policy.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • computerGroupId: This field determines where the policy will be applied. This field corresponds to the Applies To section of the Edit Application Policy sidebar in the Portal. Any valid organizationId, computerGroupId, or computerId can be entered. For instance, if looking to apply the policy at the entire organization level, enter the organizationId into this field. To keep the policy at the same level, enter the same computerGroupId that has already been applied to the policy.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • logAction: This field determines whether, when the policy is matched, it will log to the Unified Audit. This field can only be set to false when policyActionId is set to 1. Otherwise, this field should be set to true to log to the Unified Audit.

      • Expects: true or false
    • name: This field determines the name that will be applied to the policy. Any name can be entered. If you do not wish to change the policy's name, enter the existing name.

      • Expects: Any text input
    • osType: This field determines the OS Type that will be applied to the policy. The OS Type must match the policy's existing value; it cannot be changed after creation. This field expects the Integer associated with the OSType:

      • Windows = 1
      • MAC = 2
      • Linux = 3
      • Windows XP = 5
    • policyActionId: This field determines the policy action that will apply to the policy. If you do not wish to change the policy action, enter the same Integer value associated with the action currently applied to the policy. This field expects the Integer associated with the policy action to be entered:

      • Permit = 1
      • Deny = 2
      • Permit with Ringfence = 6
    • policyId: This field determines which policy will be updated. The policyId must match the policy's existing value; it cannot be changed after creation.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"

• Optional Body/Parameters
  •  Fields
    
    • allDevices: This field determines whether the policy will apply to all interfaces or to a specific interface. When this field is omitted or set to true, the policy will apply to all interfaces, and the deviceType field should not be used/included. When this field is set to false, the deviceType field must be used, so only one specific interface will affect the policy.

      • Expects: true or false
    • allUserGroups: This field determines whether the policy will apply to all users and groups or to selected users and groups. When this field is omitted or set to true, the policy will apply to all users and groups, and the userGroups field should not be used/included. When this field is set to false, the userGroups field must be used to ensure that only selected users and groups are affected by the policy.

      • Expects: true or false
    • allowRequest: This field determines whether the policy will allow the user to request access to a denied file via the ThreatLocker Tray prompt. It can only be used when the policyActionId field is set to 2. When this field is omitted or set to false, the user will not be able to request access. When this field is set to true, the user can request access via the ThreatLocker Tray prompt and send an Approval Request. If this field is omitted when calling this API and allowRequest is set to true, allowRequest will default to false, and the policy will not allow the user to request access.

      • Expects: true or false

Note: ThreatLocker does not recommend using the applicationSelection field below unless you are creating a default deny policy. Improper use of this field could cause all applications to be permitted. A warning is displayed before changing policies to use all applications, and to change a policy to use this setting, the name must contain either "Permit All" or begin with "Default - "

• • • applicationSelection: This field determines whether the policy will apply to selected applications or all applications. When this field is omitted or set to 0, the applications in the applicationIdList field will be added to the policy. Only when this field is explicitly set to 1 will the policy use all applications.

      • Expects: Integer value 0 or 1
    • comments: This field determines the text/comments that will be added to the File Path text box in the Ticket Details tab of the policy in the ThreatLocker Portal. When this field is omitted, no comments will be added to the policy, and if comments are already added, they will be removed. This field is typically used to indicate any file paths that may have been referenced during the creation or modification of the policy, but can be used as you see fit. If comments are already added to the policy, any text entered into this field will overwrite what is currently added. If you wish to keep the comments already added to the policy, enter the same comments.

      • Expects: Any text input
    • description: This field determines the description that will be added to the policy. When this field is omitted, or nothing is entered (null or ""), no description will be added to the policy; If a description is already added, it will be removed. If a description is already added to the policy, any text entered into this field will overwrite what is currently added. If you wish to keep the description already added to the policy, enter the same description.

      • Expects: Any text input
    • deviceType: This field determines which interface the policy will apply to when allDevices is set to false. When allDevices is set to true, anything entered in this field will be ignored as the policy will apply to all devices. If you wish to keep the same device type added to the policy, enter the same device type in this field and ensure that the allDevices field is used and set to false. This field expects one of the following options to be entered exactly as they appear below:

      • USB
      • DVD
      • UNC
      • SCSI
      • SATA
      • IDE
    • elevationStatus: This field determines whether Elevation will be applied to the policy. When this field is omitted or set to 0, no Elevation will be applied to the policy. Separate Elevation expiration and overall policy expiration cannot be configured, unlike when creating the policy using the elevationEndDate field through the API. To change or add an Elevation expiration after the policy has been created, set the policyScheduleStatus field to 1 and set the endDate field to the date the policy should expire. If Elevation is already applied and you do not wish to make changes, enter the same Integer value. Otherwise, Elevation will be changed/removed. This field expects one of the corresponding Integer values to be entered.

      • Do not Elevate = 0
      • Elevate to run as local administrator (Notify User) = 1
      • Elevate to run as local administrator (Do Not Notify User) = 2
      • Force the program to run as a standard user (Does not apply to administrators) = 3
    • endDate: This field is used when policyScheduleStatus is set to 1 and determines when the policy will expire. When this field is omitted, the policy will never expire. This expects a time entered in UTC in format "YYYY-MM-DDTHH:MM:SSZ", where YYYY is the year, the first MM is the month, DD is the day, HH are the hours, the second MM is the minutes, and SS are the seconds. The T must be included to designate the time and should not be changed or removed. If there is already a date and time specified in this field and you do not wish to make changes, enter the same date and time. Otherwise, your policy expiration will be changed/removed.

      • Expects expiration date and time in format: "YYYY-MM-DDTHH:MM:SSZ"
    • isEnabled: This field determines whether the policy will be enabled when it is modified. When this field is omitted or set to false, the policy will not be enabled. When this field is set to true, the policy will be enabled. If this field is omitted and isEnabled is set to true, isEnabled will be set to false, and the policy will be disabled.

      • Expects: true or false
    • killRunningProcesses: This field determines whether the policy will kill any running processes, including the process that the file originated from, when the policy is matched. It can only be used when policyActionId is set to 2. When this field is omitted or set to false, kill running processes will not be enabled. When this field is set to true, kill running processes will be enabled. If this field is omitted and killRunningProcesses is set to true, killRunningProcesses will be set to false, and the policy will not kill running processes.

      • Expects: true or false
    • monitorMode: This field determines the status that will be applied to the policy. When this field is omitted or set to 0, the policy will be set to "Inherit Status From Computer", meaning the policy's behavior depends on the computer's Maintenance Mode. When this field is set to 1, the policy will be set to "Secured Mode", meaning that regardless of the computer's Maintenance Mode, the policy will behave as indicated by the policy action (Permit with Ringfence or Deny). When this field is set to 2, the policy will be set to "Monitor Only Mode", meaning that regardless of the computer's Maintenance Mode, the policy will behave as if the computer is in the "Application Control Monitor Only" Maintenance Mode. Setting this field to 2 is particularly useful when setting up Ringfencing for the first time, as it will monitor Ringfencing traffic passing through the policy without blocking anything. This field can only be used when policyActionId is set to 2 (Deny) or 6 (Permit with Ringfencing). If there is already a status applied (Secured or Monitor) to the policy and you do not wish to make changes, enter the same Integer value. Otherwise, the status will be changed/removed.
      • Expects: Integer value 0, 1, or 2
    • networkExclusions: This field determines the exclusions that will be added for Internet Ringfencing and can only be used when policyActionId is set to 6 and restrictNetworkAccess in ringfencingOptions is set to true. When this field is omitted, no exclusions will be added. One or multiple exclusions can be added. If you want to make no changes, the same exclusions need to be added with all their fields. Otherwise, the exclusion(s) may be changed/removed. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:

      • tagPrefixTypeId: This field specifies what type of exclusion will be added: a domain, IPv4, or IPv6. This field expects one of the following Integer values to be entered, corresponding to the type of exclusion desired:

      • • Domain = 1
        • IPv4 = 2
        • IPv6 = 3

      • value: This field determines the domain, IPv4, or IPv6 value that will be applied to the Ringfencing policy.

      • • Expects: Either a valid IPv4 or IPv6 address (in correct CIDR notation) or a valid domain
    • notifyOnRequest: This field determines whether the policy will notify the listed ThreatLocker administrator(s) (in the requestEmailAddressesList field) through email/SMS of an Approval Request generated after the policy was matched. This field can only be used when policyActionId is set to 2, allowRequest is set to true, and the requestEmailAddressesList field contains at least one email. When this field is omitted or is set to false, no administrators will be notified. When this field is set to true, the administrators listed will be notified. If this field is omitted and notifyOnRequest is set to true, notifyOnRequest will be set to false, and the policy will not notify any administrators.

      • Expects: true or false
    • orderBy: This field determines in what order the policy can be matched in the currently assigned hierarchy. If your organization uses flat policy structure, negative numbers cannot be used. Review the KB articles below for more information regarding policy ordering/hierarchies. When this field is omitted, orderBy will be set to the Integer value 0 and overwrite any existing orderBy value. If you wish to keep your policy where it is currently placed, enter the same orderBy value that already applies to the policy.

      • Expects: Any positive Integer value

      Policy Order Changes

      Policy Hierarchy

    • parentProcessIdList: This field specifies the applications allowed to launch the application(s) associated with the policy. One or multiple applications can be entered. The Optional body section formats the addition/maintenance of two applications to the policy. When using this field, ensure that the parentRestrictionEnabled field is set to true. For each application, enter the applicationId in the format below. Ensure that the applications specified in this field utilize the same osType as the policy. To keep the same application(s) applied, enter the same applicationId(s) as those already applied.

      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • parentRestrictionEnabled: This field determines whether the policy will restrict the application(s) permitted to launch the selected application(s) in the policy. When this field is omitted or set to false, the parentProcessIdList field must not be used so that all applications can launch the application(s) associated with the policy. When this field is set to true, the parentProcessIdList field must be used to ensure that only the selected application(s) can launch the application(s) associated with the policy.

      • Expects: true or false
    • policySchedules: This field determines the schedule of the policy and can only be used when policyScheduleStatus is set to 2. If policy schedules are already specified in this field and you do not wish to make changes, enter the current policy schedules. Otherwise, your policy schedule will be changed/removed. Each of the following fields is used for each defined policy schedule.

      • dayoftheWeek: This field determines the day of the week during which the policy will be enabled. This field expects an Integer between 0 and 6, 0 being Sunday and 6 being Saturday.

      • • Expects: Any Integer value between 0 and 6

      • durationHours: This field determines the number of hours that the policy will be enabled. This field expects any valid Integer value less than 24.

      • • Expects: Any Integer value between 0 and 23

      • durationMinutes: This field determines the number of minutes that the policy will be enabled. This field expects any valid Integer value less than 60.

      • • Expects: Any Integer value between 0 and 59

      • startTime: This field expects the start time to be entered in a 24-hour format "YYYY-MM-DDTHH:MM:SSZ", where YYYY is the year, the first MM is the month, DD is the day, HH are the hours, the second MM are the minutes, and SS are the seconds. The T must be included to designate the time and should not be changed or removed.

      • • Expects start date and time in format: "YYYY-MM-DDTHH:MM:SSZ"
    • policyScheduleStatus: This field determines whether a policy expiration or a policy schedule will be applied to the policy. When this field is omitted or set to 0, no policy expiration or schedule will be applied. When this field is set to 1, the endDate field must be used to specify an expiration date. When this field is set to 2, the policySchedules field must be used to specify the days, duration (in hours and minutes), and start time of the policy. If a policy expiration or policy schedule has already been applied, ensure that this field is not omitted and the corresponding Integer is entered into this field. Otherwise, your policy expiration/schedule may be changed/removed. To remove a policy schedule/expiration, either omit this field or use the Integer value 0.

      • Expects: Integer value 0, 1, or 2
    • requestEmailAddressesList: This field specifies the email addresses of the ThreatLocker administrator(s) who will be notified when a request is sent regarding the policy. It can only be used when the allowRequest and notifyOnRequest fields are set to true. One or multiple email addresses can be entered, as shown in the Optional body section below. If you wish to keep the email addresses already added to the policy, enter the same email addresses.

      • Expects: Any valid email address(es)
    • requestor: This field determines the text/requestor information that will be added to the Requestor text box in the Ticket Details tab of the policy in the ThreatLocker Portal. When this field is omitted, no requestor information will be added to the policy, and if requestor information is already added, it will be removed. This is typically used to indicate who requested the policy to be created/modified, but can be used as you see fit. If requestor information is already in the policy, any text entered in this field will overwrite the existing information. If you wish to keep the requestor information already added to the policy, enter the same information.

      • Expects: Any text input
    • ringfencingOptions: This field specifies the conditions under which Ringfencing will be applied to the policy. To apply Ringfencing, the policyActionId must be set to 6. The following fields can be combined to add, modify, or remove the desired amount of Ringfencing and exclusions.

Note: For all the fields below involving Ringfencing, if you want to make no changes, the same selections and restrictions need to be added in their respective fields. Otherwise, either exclusion(s) or component(s) of Ringfencing may be changed/removed.

• • • • restrictApplication: This field determines whether Application Ringfencing will apply to the policy and can only be used when restrictApplicationSpawning is omitted or set to false. When this field is omitted or set to false, Application Ringfencing will not be applied. When this field is set to true, all application interactions will be allowed except for those listed in the rfAssociatedApplicationPolicy field below.

        • Expects: true or false
      • restrictApplicationSpawning: This field determines whether Application Ringfencing will apply to the policy and can only be used when restrictApplication is omitted or set to false. When this field is omitted or set to false, Application Ringfencing will not be applied. When this field is set to true, all application interactions will be blocked except for those listed in the rfAssociatedApplicationPolicy field below.

        • Expects: true or false
      • restrictFileAccess: This field determines whether File Ringfencing will apply to the policy. When this field is omitted or set to false, File Ringfencing will not be applied. When this field is set to true, File Ringfencing will be applied to any monitored file path in Storage Control and any paths configured in the rfFilePolicy field.

        • Expects: true or false
      • restrictNetworkAccess: This field determines whether Internet Ringfencing will apply to the policy. When this field is omitted or set to false, Internet Ringfencing will not be applied. When this field is set to true, Internet Ringfencing will be applied to any internet/network interaction and will respond accordingly when entries match the networkExclusions or rfNetworkPolicy fields. If the interaction does not match either the networkExclusions or rfNetworkPolicy fields, the interaction will be blocked.

        • Expects: true or false
      • restrictRegistryAccess: This field determines whether Registry Ringfencing will apply to the policy. When this field is omitted or set to false, Registry Ringfencing will not be applied. When this field is set to true, Registry Ringfencing will be applied to any registry interaction and will respond accordingly when entries match the rfRegistryPolicy field. If the interaction does not match the rfRegistryPolicy field, the interaction will be blocked.

        • Expects: true or false
      • rfAssociatedApplicationPolicy: This field determines which applications/exclusions will be blocked from interacting or allowed to interact, depending on whether the restrictApplication or restrictApplicationSpawning field is used. When this field is omitted, no application exclusions will be added. One or multiple exclusions can be added. As demonstrated in the Optional body section, each application/exclusion requires each of the fields listed below:

        • applicationId: This field specifies the application that will be affected by Ringfencing.

        • • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"

        • osType: This field determines the OS Type of the application that will be Ringfenced. OSTypes to select from are listed below. This field expects the Integer associated with the OSType:

        • • Windows = 1
          • MAC = 2
          • Linux = 3
          • Windows XP = 5
      • rfFilePolicy: This field determines the exclusions that will be added for File Ringfencing. When this field is omitted, no File Ringfencing exclusions will be applied. One or multiple exclusions can be added. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:
        • action: This field determines the action that will be taken on the specified path below. This field expects an Integer value of either 1 or 2. The value of 1 will allow file interactions at the file path. The value of 2 will deny/block file interactions at the file path.

          • Expects: Integer value 1 or 2
        • path: This field determines the file path that will be affected by the Ringfencing action taken. Be sure to use \\ instead of a single \ for the existing slashes in the path. Wildcards can be used in this field in the same way as in the ThreatLocker Portal, as shown in this example: c:\\users\\*\\documents\\*

          • Expects: Full file path or partial path with wildcards
        • permission: This field determines whether the action of permit or deny will affect read, write, or both read and write actions taken on the specified file path. This field expects an Integer value of either 1 or 2. If the action is set to permit (1), an Integer value of 1 specifies that read actions will be permitted, and an Integer value of 2 specifies that read and write actions will be permitted. If the action is set to deny (2), an Integer value of 1 specifies that write actions will be denied, and an Integer value of 2 specifies that read and write actions will be denied.

          • Expects: Integer value 1 or 2
      • rfNetworkPolicy: This field determines the tags that will be added for Internet Ringfencing. When this field is omitted, no tag exclusions will be added. When no tags are added to this policy, this field should be removed from the body. One or multiple tags can be added. As demonstrated in the Optional body section, each tag requires each of the fields listed below:

        • action: This field determines the action that will be taken on the specified tag. This field expects an Integer value of either 1 or 2. The value of 1 will allow the tag to interact with the application(s). The value of 2 will deny/block the tag interaction with the application(s).

        • • Expects: Integer value 1 or 2

        • port: This field determines the port number to which the tag will be applied. Only one port can be entered per tag; a range cannot be specified. The value of -1 will apply the tag to all ports.

        • • Expects: An Integer value

        • server: This field specifies the tagId/specific tag that this exclusion will apply to. This field expects the text "tag:", followed by the tagId of the tag being applied to the policy, as shown below.

        • • Expects: "tag:00000000-0000-0000-0000-000000000000"
      • rfRegistryPolicy: This field determines the exclusions that will be added for Registry Ringfencing. When this field is omitted, no Registry exclusions will be added. One or multiple exclusions can be added. As demonstrated in the Optional body section, each exclusion requires each of the fields listed below:

        • action: This field determines the action that will be taken on the specified path. This field expects an Integer value of either 1 or 2. The value of 1 will allow the Registry to interact with the path. The value of 2 will deny/block the Registry interaction with the path.

        • • Expects: Integer value 1 or 2

        • path: This field determines the Registry path that will be affected. Be sure to use \\ instead of a single \ for the existing slashes in the path. Wildcards can be used in this field like they can in the ThreatLocker Portal, as shown in this example: \\registry\\user\\software\\threatlocker\\*

        • • Expects: Full file path or partial path with wildcards
    • ticketInfo: This field determines the text/comments that will be added to the Ticket text box in the Ticket Details tab of the policy in the ThreatLocker Portal. When this field is omitted, no ticket information will be added to the policy, and if ticket information is already added, it will be removed. This field is typically used to indicate any ticket number that may have been referenced during the creation or modification of the policy, but can be used as you see fit. If ticket information is already in the policy, any text entered in this field will overwrite the existing information. If you wish to keep the ticket information already added to the policy, enter the same information.

      • Expects: Any text input
    • userGroups: This field determines which users or groups the policy will apply to and can only be used when allUserGroups is set to false. If allUserGroups is set to true, anything input into this field will be ignored since the policy will apply to all users and groups. One or multiple users/groups can be entered. This field expects a username or group name in the format HOSTNAME\USERNAME or DOMAIN\USERNAME. For each user/group, enter both the text and value fields. To keep the same users and groups applied, enter the same users and groups as those already applied. The Optional body section formats the addition of two users/groups to a policy.

      • text: Expects: Any text input
      • value: Expects: Any text input

• Permission Requirements
  • Assign this permission:
  • • Edit Application Control Policies

PolicyUpdateForDeleteByIds

https://portalapi.INSTANCE.threatlocker.com/portalapi/Policy/PolicyUpdateForDeleteByIds

• Method: PUT
• Description: This API is used in multiple locations throughout the ThreatLocker Portal to delete one or multiple Application Control policies. This API is responsible for deleting Application Control policies in your organization.

Once you have called this API to delete your policy or policies, be sure to deploy policies in the organization where the policy exists (or for all organizations if a global policy was deleted) either through the Portal using the Deploy Policies button or through API, documentation linked below.

/portalAPI/DeployPolicyQueue/* | ThreatLocker Help Center

 

For accurate System Audit logging of the deletion of the policy, please review the Optional Body/Parameters section below.

• Required Body/Parameters
  • Fields

Note: Each of the following fields needs to be entered for each policy you want to delete, as shown in the Required body section.

• • • organizationId: This field expects the organizationId of the organization where the policy that will be deleted exists.
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"
    • policyId: This field expects the policyId of the policy that will be deleted.
      • Expects: <GUID> in format "00000000-0000-0000-0000-000000000000"

• Optional Body/Parameters
  
  • Fields
    • name: This field determines the name that will be logged in the System Audit. This field should match the name of the policy that will be deleted.
      • Expects: Text of the policy's name

• Permissions Needed for User
  • Edit Application Control Policies