---
title: "List Agents"
method: GET
path: "/v1/agents"
tags: ["Agents"]
---

# List Agents

`GET /v1/agents`

Shows Agents associated with your account.

**Note:** This endpoint will also return a `pagination` key on the root level.  
Please refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.

## Query parameters

- `limit` integer
- `page_token` string
- `sort_field` 'id' | 'created_at' | 'updated_at'
- `sort_direction` 'asc' | 'desc'
- `organization_id` integer
- `platform` 'windows' | 'darwin' | 'linux'
- `hostname` string
- `os` string
- `version` string

## Response `200`

List Agents

- object
  - `agents` Agent[], required
    - `id` integer — A unique identifier for an agent.
    - `account_id` integer — The unique identifier of the account associated with the agent.
    - `arch` string — The architecture on the host machine.
    - `created_at` string, date-time — A timestamp for when the agent was created, formatted as per ISO-8601.
    - `domain_name` string — Domain that refers to the host machine.
    - `edr_version` string — The semantic versioning number of the Huntress EDR software installed on the machine or `null` if EDR is not installed.
    - `external_ip` string — The external IP of the host machine, if applicable.
    - `hostname` string — The hostname of the host machine.
    - `defender_policy_status` string — Policy status of Defender AV for Managed Antivirus.
    - `defender_status` string — Status of Defender AV Managed Antivirus.
    - `defender_substatus` string — Sub-status of Defender AV Managed Antivirus.
    - `firewall_status` string — Status of agent firewall. Can be one of Disabled, Enabled, Pending Isolation, Isolated, Pending Release
    - `tamper_protection_configured` boolean — The desired EDR tamper protection state for the agent. `null` when the agent does not support tamper protection.
    - `tamper_protection_actual` boolean — The tamper protection state most recently reported by the host. May lag `tamper_protection_configured` and is `null` until the host reports.
    - `ipv4_address` string — The internal IP of the host machine.
    - `ipv4_addresses` string[] — Every internal IPv4 address the host reports, one per network interface. When compared against `ipv4_address` attribute, `ipv4_address` is the primary address from this list.
    - `last_callback_at` string, date-time — A timestamp for when the last time Huntress was able to access the host machine.
    - `last_survey_at` string, date-time — A timestamp for when the last Microsoft Defender survey was received by Huntress for this host machine.
    - `mac_addresses` string[] — The unique media access control (MAC) addresses associated with the agent.
    - `service_pack_major` integer — The major version of the Windows service pack installed on the host machine.
    - `service_pack_minor` integer — The minor version of the Windows service pack installed on the host machine.
    - `organization_id` integer — The unique identifier of the organization associated with the agent.
    - `os` string — The operating system of the host machine.
    - `os_build_version` string — The operating system build number of the host machine corresponding to its platform (<a href='https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information'>windows</a> or <a href='https://developer.apple.com/news/releases/'>darwin</a>).
    - `os_major` integer — The major OS version of the host machine. Corresponds with the major releases of Windows operating systems. A list is accessible <a href='https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version'>here</a>.
    - `os_minor` integer — The minor OS version of the host machine. Refer to the `os_major` field details for further details.
    - `os_patch` integer — The patch version of the macOS update installed on the host machine, such as 1 in version 12.5.1.
    - `platform` string — The platform of the host machine (`darwin`, `windows`, or `linux`).
    - `serial_number` string — The serial number of the host machine as reported to the operating system.
    - `tags` string[] — User classifications on the host machine.
    - `updated_at` string, date-time — A timestamp for when the agent was last updated, formatted as per ISO-8601.
    - `version` string — The semantic versioning number of the agent installed on the host machine.
    - `version_number` integer — Windows version number.
    - `win_build_number` integer — The Windows Build Number. Should correspond to information on the <a href='https://docs.microsoft.com/en-us/windows/release-health/release-information'>Microsoft site</a>.
  - `pagination` Pagination, required — Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)