---
title: "Isolate Agent"
method: POST
path: "/v1/agents/{id}/isolation"
tags: ["Agents"]
---

# Isolate Agent

`POST /v1/agents/{id}/isolation`

Schedules host isolation for a single Agent, cutting the host off from the
network while leaving Huntress connectivity intact. Isolation is asynchronous:
a successful request returns the Agent with a `firewall_status` of
"Pending Isolation" until the endpoint confirms isolation.

This endpoint requires an API key with permission to isolate agents.
**Note that the default account API key is read-only, so you'll need to create a
user-based API key with the appropriate permissions to access this endpoint.**

## Path parameters

- `id` integer, required

## Request body

- IsolateAgent — Isolate Agent
  - `reason` string — Reason recorded for the isolation.
  - `strict_isolation` boolean — Apply strict isolation. Only honored on Windows (WFP) and Linux (eBPF).

## Response `201`

Isolate Agent

- object
  - `agent` Agent — Agent model
    - `id` integer — A unique identifier for an agent.
    - `account_id` integer — The unique identifier of the account associated with the agent.
    - `arch` string — The architecture on the host machine.
    - `created_at` string, date-time — A timestamp for when the agent was created, formatted as per ISO-8601.
    - `domain_name` string — Domain that refers to the host machine.
    - `edr_version` string — The semantic versioning number of the Huntress EDR software installed on the machine or `null` if EDR is not installed.
    - `external_ip` string — The external IP of the host machine, if applicable.
    - `hostname` string — The hostname of the host machine.
    - `defender_policy_status` string — Policy status of Defender AV for Managed Antivirus.
    - `defender_status` string — Status of Defender AV Managed Antivirus.
    - `defender_substatus` string — Sub-status of Defender AV Managed Antivirus.
    - `firewall_status` string — Status of agent firewall. Can be one of Disabled, Enabled, Pending Isolation, Isolated, Pending Release
    - `tamper_protection_configured` boolean — The desired EDR tamper protection state for the agent. `null` when the agent does not support tamper protection.
    - `tamper_protection_actual` boolean — The tamper protection state most recently reported by the host. May lag `tamper_protection_configured` and is `null` until the host reports.
    - `ipv4_address` string — The internal IP of the host machine.
    - `ipv4_addresses` string[] — Every internal IPv4 address the host reports, one per network interface. When compared against `ipv4_address` attribute, `ipv4_address` is the primary address from this list.
    - `last_callback_at` string, date-time — A timestamp for when the last time Huntress was able to access the host machine.
    - `last_survey_at` string, date-time — A timestamp for when the last Microsoft Defender survey was received by Huntress for this host machine.
    - `mac_addresses` string[] — The unique media access control (MAC) addresses associated with the agent.
    - `service_pack_major` integer — The major version of the Windows service pack installed on the host machine.
    - `service_pack_minor` integer — The minor version of the Windows service pack installed on the host machine.
    - `organization_id` integer — The unique identifier of the organization associated with the agent.
    - `os` string — The operating system of the host machine.
    - `os_build_version` string — The operating system build number of the host machine corresponding to its platform (<a href='https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information'>windows</a> or <a href='https://developer.apple.com/news/releases/'>darwin</a>).
    - `os_major` integer — The major OS version of the host machine. Corresponds with the major releases of Windows operating systems. A list is accessible <a href='https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version'>here</a>.
    - `os_minor` integer — The minor OS version of the host machine. Refer to the `os_major` field details for further details.
    - `os_patch` integer — The patch version of the macOS update installed on the host machine, such as 1 in version 12.5.1.
    - `platform` string — The platform of the host machine (`darwin`, `windows`, or `linux`).
    - `serial_number` string — The serial number of the host machine as reported to the operating system.
    - `tags` string[] — User classifications on the host machine.
    - `updated_at` string, date-time — A timestamp for when the agent was last updated, formatted as per ISO-8601.
    - `version` string — The semantic versioning number of the agent installed on the host machine.
    - `version_number` integer — Windows version number.
    - `win_build_number` integer — The Windows Build Number. Should correspond to information on the <a href='https://docs.microsoft.com/en-us/windows/release-health/release-information'>Microsoft site</a>.

## Other responses

- `403` — There was an issue with your API credential or permissions.
- `404` — Agent not found.
- `409` — Agent does not support host isolation, or isolation could not be scheduled.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)