XFA

Returns the known vulnerabilities (CVEs) affecting a specific software version — public data from the National Vulnerability Database (NVD), via XFA's version catalog — up to 200 entries per call. Global — not scoped to any organization.

get_cves_for_version

Returns the security posture of a single device in the signed-in user's XFA organization, identified by the device_id returned from list_devices. Same curated fields as list_devices for one device, with CVE ID lists when include_cves is set. The organization is always the caller's own.

get_device

Returns where a specific software version sits in XFA's version catalog: whether it is the latest release overall (is_latest), the latest within its major line (is_latest_for_major), and the latest within its release channel (is_latest_for_channel), plus whether its major line is still supported (is_supported_major) and is a long-term-support line (is_long_term_supported_major) — each with the corresponding latest_version / latest_for_major / latest_for_channel to compare against. This is version-freshness data, NOT an organization's device-check pass/fail result. Global — not scoped to any organization.

get_software_version_info

Returns a handful of the organization's security-check figures over time — one data point per day — so you can compare them across a window and see the direction of travel. Each point has total_devices, disk_encryption_active/supported, screen_lock_active, and average days-outdated for OS and browsers. These are per-check posture figures, not policy-compliance counts (use get_compliance_summary for those), so there is no policy argument. Compute rates from the counts (e.g. disk-encryption rate = disk_encryption_active / disk_encryption_supported). Defaults to the last 30 days; pass start_date_unix / end_date_unix (seconds) for another window, capped at 180 days. The organization is always the caller's own.

get_posture_trends

Returns the organization's current posture in one call: how many devices are verified vs unverified, fully compliant vs not fully compliant against a policy (not-fully-compliant is devices_not_fully_compliant, which counts missing-info and unsupported devices too, not only ones that failed a check), how many users still have no verified device, and how many devices are exposed to specific threat-category vulnerabilities (ransomware / phishing / data-breach). Those exposure counts are NOT a count of devices with any CVE — a device can carry CVEs without falling into one of those threat categories, so these numbers are smaller than the per-device CVE lists you get from list_devices; do not treat the two as the same figure. Device and user figures are the rolling last 30 days; the vulnerability counts are point-in-time as of as_of_unix. Compute rates from the counts: verified % = verified_devices / (verified_devices + unverified_devices), compliant % = compliant_devices / (compliant_devices + devices_not_fully_compliant). Uses the organization's default policy unless you pass policy_id (from list_policies). The organization is always the caller's own.

get_compliance_summary

Returns the latest released version of a software title XFA tracks (browsers, OS, PDF readers, the XFA app, Slack, mobile). Global — not scoped to any organization. Use list_versioned_software_catalog for valid software_name values.

get_latest_version

Returns the signed-in user's identity and their role in the XFA organization bound to the access token: email, organization id, organization name, and role (administrator, a specific role like read_only, or unknown when the token carries no role entry for the organization). Always the caller's own identity — it takes no arguments and cannot be pointed at another user or organization.

get_current_user

Returns the XFA organization bound to the signed-in user's access token: its organization_id and name. Always your own organization — it cannot be pointed at a different one.

get_organization

Lists the active devices in the signed-in user's XFA organization (those seen in the last 30 days, the same set the XFA dashboard shows), with each device's security posture: OS and version and whether it is up to date, disk encryption, antivirus, firewall, screen lock, and other checks; a policy_status of compliant, not_compliant, missing_info, or unsupported (absent until the device is evaluated; read this for compliance questions); and an attestation of 'verified' (the XFA app is attesting the device) or 'discovered' (seen via an identity provider only). Returns one page of devices (verified devices first) plus next_cursor; to get the next page, call again with that value as the cursor argument (a page can be empty while next_cursor is still set, so keep paging until it is absent). Set include_cves to attach per-device CVE ID lists. The organization is always the caller's own — it takes no organization argument. Set user_email to get just one user's devices in a single response. Use this to answer questions like which devices are non-compliant, out of date, have a given CVE, are missing a security control, or what a specific user's devices look like.

list_devices

Lists the organization's policies: each policy_id, its name, and whether it is the default. Use this to find a policy_id to pass to get_compliance_summary, list_devices, or get_device when you want to evaluate against a specific policy rather than the default (get_posture_trends is policy-independent). It returns policy identity only, not the policy's rules. The organization is always the caller's own.

list_policies