Dnsfilter

Adds a single application to the allow list of a policy in DNSFilter. Use this action when you need to permit a specific application through the filtering policy. The application will be added to the policy's allow_applications list and will be allowed regardless of other blocking rules. This is useful for whitelisting specific applications that need to function while maintaining strict filtering policies for other traffic.

Tool to bulk add one or more domains to one or more policies' allow lists. Use when you need to permit specific domains across multiple policies efficiently, bypassing filtering rules for trusted sites.

Tool to add a single category to a policy's blocklist. Use when you need to block a specific content category for a DNS filtering policy. The category will be added to the existing blacklist categories without affecting other policy settings.

Tool to add a single domain to a policy's blocklist. Use when you need to block a specific domain under a DNS filtering policy. The domain will be added to the policy's blacklist and blocked from access for users under that policy.

Adds a single application to the block list of a policy in DNSFilter. Use this action when you need to block a specific application through the filtering policy. The application will be added to the policy's block_applications list and will be blocked regardless of other allow rules. This is useful for blocking specific applications that should not be accessible while maintaining other filtering policies.

Tool to add one or more domains to the blocklist of multiple policies at once. Use when you need to block specific domains across multiple filtering policies efficiently. The operation applies all specified domains to all specified policies in a single API call.

Tool to add a single domain to a policy's allowlist. Use when you need to permit a specific domain for a policy, bypassing filtering rules for that trusted site.

Sets an organization as 'Canceled' in DNSFilter by its unique ID. Use this action when you need to cancel an organization's service. The organization will be marked as canceled but may not be immediately deleted depending on billing cycles.

Check if user agent attributes are mixed in a bulk selection. Use this to determine whether block pages, policies, sites, or tags differ across the selected user agents before performing bulk updates. This helps identify configuration inconsistencies and plan bulk update operations.

Creates a new API key in DNSFilter for authentication and API access. This action generates a new API key that can be used to authenticate API requests to DNSFilter. The API key is returned only once upon creation and should be stored securely. You can optionally set an expiration date to enforce key rotation policies. Use cases include: - Creating keys for automated integrations - Generating keys for third-party service access - Setting up keys with specific expiration policies IMPORTANT: The API key value is only returned in the creation response. Store it securely as it cannot be retrieved later.

Creates a CyberSight CSV export record to track export of CyberSight report information. This action initiates an export of CyberSight activity logs to CSV format. The export is processed asynchronously - the response includes a UUID to track the export status. Once processing is complete, the response will contain a presigned S3 URL to download the CSV file. Common use cases: - Exporting activity logs for compliance reporting - Downloading filtered CyberSight data for analysis - Creating scheduled reports of network activity The export can be filtered by organization, time range, activity type, and various other criteria. Required fields are report_type, start_at, and end_at. The export URL will be available once processing is complete (usually within a few minutes depending on data volume).

Creates a new IP address entry in DNSFilter for network filtering and policy enforcement. This action registers an IPv4 or IPv6 address with a specific network in DNSFilter, allowing that IP to be subject to the network's filtering policies. Common use cases include: - Adding gateway or router IP addresses - Registering office or branch location IPs - Including failover or WAN link IPs Prerequisites: - Must have a valid network_id (use LIST_NETWORKS to retrieve available networks) - The IP address must be a valid IPv4 or IPv6 format - User must have authorization to create IP addresses in the target network Returns the created IP address details including its unique ID and UUID for future reference.

Creates a new MAC address entry in DNSFilter with the specified data. This action registers a MAC address with a specific organization in DNSFilter, allowing that MAC address to be subject to custom filtering policies and block pages. Common use cases include: - Adding device MAC addresses for network access control - Assigning custom policies to specific devices - Managing device-level filtering in BYOD environments Prerequisites: - Must have a valid organization_id (use LIST_ORGANIZATIONS to retrieve available organizations) - The MAC address should be in valid format with colons (e.g., '00:11:22:33:44:55') - User must have authorization to create MAC addresses in the target organization Returns the created MAC address details including its unique ID for future reference.

Creates a new network with the specified configuration in DNSFilter. Networks represent locations or groups of devices that will be protected by DNSFilter's DNS filtering policies. Use this action to set up filtering for office locations, remote workers, or any group of devices that need DNS security. Required fields are network name and organization_id. Optional settings include custom block pages, IP addresses, local domain handling, and policy assignments. The action returns the complete network details including its unique ID and UUID for future operations.

Bulk create multiple networks in DNSFilter with a single API call. Use when you need to create multiple networks at once for efficiency. Each network requires at minimum a name; optional fields like physical address, coordinates, description, and policy assignment can be included for better organization.

Adds a new or existing user with the specified email to an organization in DNSFilter. This action creates a user association with a specific organization, assigning them a role (administrator or read_only). If the user email already exists in DNSFilter, it adds that existing user to the organization. If the email is new, it creates a new user account. Common use cases: - Adding administrators to manage organization settings - Granting read-only access to stakeholders or auditors - Managing multi-organization access with permission lists Prerequisites: - Must have a valid organization_id (use LIST_ORGANIZATIONS to retrieve) - User must have administrator permissions in the organization - Email must be valid and unique within the organization Returns the created user details including their ID, role, and contact information.

Creates a new DNS filtering policy with the specified configuration in DNSFilter. Policies define filtering rules including blocked/allowed categories, domain lists, safe search enforcement, and application controls. Use this action to create filtering policies that can be applied to networks, IP addresses, or MAC addresses for content filtering and security enforcement. Required fields are policy name and organization_id. Optional settings include category blocking, domain allow/block lists, safe search enforcement for multiple search engines, application controls, and YouTube restrictions.

Creates a new scheduled (time-based) policy in DNSFilter. Scheduled policies allow different filtering policies to be applied during different times of the week based on a weekly schedule divided into 15-minute intervals. Use this action to implement time-based filtering rules such as stricter policies during school/work hours and relaxed policies during evenings or weekends. The policy_ids array must contain exactly 672 integers representing each 15-minute block of the week starting from Monday 12:01am. Each policy ID can be reused for multiple time blocks to create consistent filtering periods.

Creates a scheduled report preview for an organization, triggering background generation of the report. This action initiates the generation of a preview for scheduled reports in DNSFilter. The preview includes filtered content statistics and threat summaries based on the organization's DNS filtering activity. Use this when you need to generate a sample report to review filtering effectiveness or prepare regular scheduled reports. The report generation happens asynchronously in the background after creation.

Creates a scheduled report in DNSFilter to automate regular delivery of network activity and security summaries. Use this to set up periodic reports that track web traffic, threats, and content filtering patterns for your organization. Required fields are organization_id and frequency. Optional settings include threat summaries, content category breakdowns, delivery schedules, and recipient lists. The scheduled report will be generated and sent automatically according to the specified frequency. Use this when you need regular visibility into network filtering activity without manual report generation.

Create a user agent bulk delete operation in DNSFilter. Use when you need to delete multiple user agents at once based on explicit IDs or filter criteria. This action allows you to either: 1. Delete specific agents by providing their IDs in the 'ids' parameter 2. Delete agents matching filter criteria (agent_state, network_ids, tags, etc.) 3. Combine filters with exclude_ids to protect specific agents from bulk deletion The 'queue_uninstall' parameter determines deletion behavior: - True: Hard delete with agent uninstallation - False: Soft delete (agent deactivation) Common use cases: - Remove all unprotected agents from a specific network - Delete agents that haven't received traffic recently - Clean up agents with a specific version or status - Bulk remove agents by tags or organization

Creates a user agent cleanup to track bulk deletion of inactive user agents in DNSFilter. This action initiates a cleanup process that identifies and deletes user agents that have been inactive for a specified number of days across one or more organizations. The cleanup helps maintain an accurate inventory by removing stale agent entries that are no longer in use. Use cases: - Removing outdated agents from decommissioned devices - Cleaning up test agents after evaluation periods - Maintaining accurate license counts by removing inactive agents Returns details about the cleanup operation including which agents will be deleted and the status of the cleanup process.

Tool to remove an API key by its ID. Use when you need to revoke or delete an existing API key from the DNSFilter system. Returns success on 204 No Content.

Removes an IP address from DNSFilter by its unique ID. Use this action when you need to unregister an IP address from a network, such as when decommissioning equipment or removing access.

Deletes a MAC address entry from DNSFilter by its ID. Use this action when you need to remove a MAC address from your network filtering configuration. You must provide the numeric ID of the MAC address to delete. The action returns the deleted resource information in JSON:API format, including the ID, type, and UUID of the removed MAC address.

Bulk destroy multiple networks in DNSFilter. Use when you need to delete multiple networks at once or all networks in an organization.

Deletes a DNS filtering policy from DNSFilter by its unique ID. Use this action when you need to remove a policy that is no longer needed. Note that the API performs a soft deletion, setting a deleted_at timestamp on the policy record.

Removes a scheduled policy from the DNSFilter database by its unique ID. Use this action when you need to delete a scheduled policy that is no longer needed or was created in error.

Tool to delete a scheduled report by its ID. Use when you need to remove a scheduled report from the DNSFilter system. Returns the deleted report data.

Tool to retrieve detailed information about a specific API key by its ID. Use when you need to display or verify the details of an existing API key.

Retrieves detailed information about a specific DNSFilter application category by its ID. Application categories group applications for filtering policies (e.g., Business, VPN And Proxy, GenAI & ML). Use LIST_APPLICATION_CATEGORIES to discover available category IDs first.

Retrieves the billing address for a specific DNSFilter organization. Use when you need to access or verify billing contact information, shipping addresses, or organization location details for invoicing purposes.

Retrieves billing records for a specific DNSFilter organization. Returns a list of billing records including amounts, payment status, and billing periods. Returns an empty list if no billing records exist for the organization. Use this when you need to access billing history, verify payment status, or generate billing reports.

Tool to get basic information of a specific category. Use when you need to retrieve details for a category by its ID.

Retrieves detailed information for a specific IP address record by its ID. Use this action when you need to fetch complete metadata, network relationships, and attributes for a particular IP address that you've already identified (e.g., from the List IP Addresses action). The response includes the IP address in both short and full notation, along with associated network and organization IDs.

Retrieves detailed information for a specific MAC address record by its ID. Use this action when you need to fetch complete metadata and attributes for a particular MAC address that you've already identified (e.g., from the List MAC Addresses action). The response includes the MAC address value, name/label, organization and location associations, and timestamps in JSON:API format.

Retrieves usage metrics for a DNSFilter organization over a specified date range. Returns DNS query counts, user statistics, and billing information. The maximum allowed date range is 365 days. Use this when you need to analyze organization activity, generate usage reports, or monitor DNS request volumes.

Retrieves detailed usage metrics for a specific DNSFilter organization. Use this when you need comprehensive usage statistics including user counts, WiFi networks, roaming clients, and DNS request volumes for a given time period. This endpoint fetches user_count and wifi_count directly from the database and includes roaming client counts.

Tool to retrieve the requester's IP address as reported by DNSFilter API. Use when you need to determine the public IP address from which API requests are being made.

Tool to check the status of a bulk network creation job. Use when you need to monitor the progress or completion of a bulk network creation operation, or to retrieve the results (successful, failed, and skipped counts) of a completed bulk job.

Check the status of a bulk network destroy operation. Use this action after initiating a bulk destroy to monitor progress and see which networks were successfully destroyed, failed, or skipped.

Check the status of a bulk network update job. Use this action to monitor the progress and results of a bulk update operation after initiating it. The response indicates completion status, success/failure counts, and IDs of affected networks.

Retrieves a networks CSV export by its ID. Use this action when you need to check the status of a CSV export or get the download URL for the exported data.

Tool to retrieve notes associated with a specific resource (policy, MSP, or organization) and domain. Use when you need to fetch allow/block notes for a particular domain within a given resource context.

Tool to get basic information of a specific organization by ID. Use when you need to retrieve detailed organization configuration, billing details, feature flags, and network relationships for a particular organization.

Tool to retrieve user details and permissions for a specific organization. Use when you need to fetch information about a particular user within an organization, including their role, contact details, and permission settings.

Tool to get basic information of the specified policy. Use when you need to retrieve details for a specific policy by its ID.

Tool to retrieve the permissive mode setting for a specific policy. Use when you need to check if a policy has permissive mode enabled or disabled.

Retrieves basic information for a specific Policy IP by its ID. Use this action when you need to fetch DNS server IP addresses (primary and secondary) associated with a particular policy. The response includes the Policy IP's UUID and the DNS server addresses that can be used for DNS filtering.

Tool to retrieve a specific scheduled report preview by its ID. Use when you need to view the preview data for a scheduled report before it's sent.

Tool to get basic information of a specified user by ID. Use when you need to retrieve user details such as email, name, role, and verification status.

Tool to get the specific user agent cleanup by ID. Use when you need to retrieve the status and details of a user agent cleanup process, including which agents are marked for deletion and whether the cleanup has completed.

Tool to retrieve a specific user agent CSV export by its ID. Use when you need to check the status of a CSV export and obtain the download URL once ready.

Tool to get the uninstall PIN for an organization's user agents. Use when you need to retrieve the PIN required to uninstall user agents protected by PIN authentication.

Get all agent local users associated with a user organization. Returns basic information about agent local users including their IDs, types, and relationships. Use filters to narrow results by collection membership, name, or organization.

Retrieves all block pages associated with the current user. Block pages are custom HTML pages displayed when users attempt to access blocked websites. Use this when you need a complete list of all configured block pages without pagination.

Retrieves one page of IP addresses across all networks in your organization. Pagination is caller-driven: pass `page` and `per_page` to fetch a specific page; inspect `has_next_page` / `next_page` in the response to advance. Exactly ONE DNSFilter API call is made per invocation.

Retrieves the list of API keys associated with the authenticated user. Use this to view all API keys, check their expiration status, or filter by specific criteria such as name or organization. Supports filtering by expiration, ID, name, organization, and last four characters of the token.

Retrieves all available application categories from DNSFilter. Application categories group SaaS applications and services (e.g., Business, Messaging, File Sharing, VPN And Proxy) and are used to apply filtering policies. Returns a list of categories with their IDs, names, UUIDs, and descriptions. Use this to discover available categories before configuring policies or filtering rules.

Tool to list all applications basic information including deleted ones. Use when you need a comprehensive list of all application entries without filtering out deleted applications.