Device posture JSON reference

The Policy editor's JSON tab and the REST API's policy.postures attribute use the same rule format. JSON provides access to individual provider fields, custom thresholds, and nested logic beyond the ready-made checks in the Simplified tab. See Device Posture for how these checks affect Resource access and when to use each editor.

Rule structure

A posture expression is a JSON object containing a single field comparison or an and, or, or not expression. The top-level value null means that the Policy has no posture requirements.

{
  "field": "intune.compliance_state",
  "op": "is",
  "value": "compliant"
}

An object cannot mix a logical operator with comparison keys, or contain several logical operators. Unknown keys are rejected.

Operators and values

Every type supports exists and does_not_exist. These test whether a field has a non-null value, rather than whether it is truthy or non-empty.

String comparisons and string-array membership are case-insensitive. enum_string uses the same operators as string; Firezone does not validate comparison values against a fixed enumeration. Use the values reported by your provider.

Regex matching runs against the lowercased field value, but the pattern is not lowercased. Patterns are not implicitly anchored; use ^ and $ when the whole value must match.

Versions are compared as numeric segments, so 14.4 equals 14.4.0 and 14.10 is greater than 14.9. @latest resolves to the current Firezone Client release for the device's platform when the rule is evaluated. It is not supported on provider OS or agent version fields.

before and after are strict comparisons. within_last includes a value exactly at the cutoff; not_within_last requires a value older than the cutoff. A date-only provider value is evaluated at midnight UTC. A passing within_last comparison contributes an expiry time to the authorization.

Evaluation behavior

Missing values and negation

A missing or null field fails every comparison except does_not_exist, including negative operators such as is_not. If no provider record matches, the comparison runs against an empty record. enrolled is a special computed field: it evaluates to false when no record matches.

not inverts the result of an expression, including a failure caused by missing data. For example, not around is true can pass when a boolean is missing; is false requires an explicit false value. Use positive comparisons when the provider must supply evidence.

Multiple records

Each comparison independently evaluates the device's matched records from enabled providers. With the default rows: "any", different comparisons in an and expression can be satisfied by different records from the same provider. rows: "all" requires every matched record to satisfy that comparison. It does not make an absent provider pass.

Platform applicability

Before evaluation, Firezone removes fields that do not apply to the device's platform. Logical branches with no applicable fields are also removed. If nothing remains, the posture expression passes. A Windows-only requirement therefore does not itself exclude macOS devices.

The platform comes from matched provider records first, then the Client's user agent. If it cannot be determined, no fields are removed. The attribute tables below give each provider's default platforms and any field-specific overrides.

Examples

These expressions can be used directly in the JSON tab or as the value of policy.postures in a REST API request.

Intune compliance and a check-in within 24 hours

Both checks must pass. Compared with the simplified Recently seen check, this expression selects Intune as the source and shortens the window from seven days to 24 hours.

{
  "and": [
    { "field": "intune.compliance_state", "op": "is", "value": "compliant" },
    { "field": "intune.last_sync_at", "op": "within_last", "value": "PT24H" }
  ]
}

Encryption from either provider, plus a current Firezone Client

The nested or accepts Intune encryption or Iru FileVault evidence on applicable platforms. The outer and also requires the latest Firezone Client version.

{
  "and": [
    {
      "or": [
        { "field": "intune.is_encrypted", "op": "is", "value": true },
        { "field": "iru.filevault_enabled", "op": "is", "value": true }
      ]
    },
    { "field": "firezone.last_seen_version", "op": "gte", "value": "@latest" }
  ]
}

No active threats across all matched SentinelOne records

On supported platforms, this requires every matched SentinelOne record to report zero active threats. Missing threat counts do not pass.

{
  "field": "sentinelone.active_threats",
  "op": "eq",
  "value": 0,
  "rows": "all"
}

REST API

The portal and REST API read and write the same posture expression; there is no separate API rule language. The REST API reference links to the OpenAPI schemas, and REST API setup covers token creation and bearer authentication. Device posture requires the Enterprise entitlement even though the REST API itself is available on all plans.

For example, the request body below updates a Policy to require Intune compliance and a check-in within 24 hours:

{
  "policy": {
    "postures": {
      "and": [
        { "field": "intune.compliance_state", "op": "is", "value": "compliant" },
        { "field": "intune.last_sync_at", "op": "within_last", "value": "PT24H" }
      ]
    }
  }
}

With that body saved as policy.json, the authenticated request is:

curl --fail-with-body --request PATCH \
  "https://rest-api.firezone.dev/policies/$POLICY_ID" \
  --header "Authorization: Bearer $FZ_TOKEN" \
  --header "Content-Type: application/json" \
  --data-binary @policy.json

Changing a Policy's posture expression revokes its active authorizations. Sessions relying on that Policy are interrupted until the Client reconnects. The API rejects non-null posture rules with 403 Forbidden when device posture is not enabled for the account, and invalid expressions with 422 Unprocessable Entity.

Limits

Strings and comparison value arrays must be non-empty. Relative durations must have no negative components and at least one positive component.

Complete attribute list

The tables below list all 339 supported attributes across six namespaces. Use the full name in field; a provider's API property name may differ from the name Firezone exposes here. A dash in the platform column means the provider's default platforms apply. Applicability does not guarantee the provider reports a value for every device.

External providers also expose two computed boolean attributes:

• enrolled: whether a matching provider record exists. This does not imply compliance, current activity, or MDM enrollment for an EDR provider.
• os_up_to_date: whether the reported OS meets the newest release of a supported release line. Android uses the latest monthly security patch level. It is null when the available OS data cannot be evaluated.

Provider bookkeeping and secrets are not posture attributes. In particular, synced_at is excluded: use the provider's device activity timestamps to check when it last heard from a device.

Firezone

Prefix: firezone. Default platforms: Windows, macOS, Linux, iOS/iPadOS, Android.

These fields come from the Firezone device record. ipv4 and ipv6 are the device’s Firezone tunnel addresses. The last_attested_* fields record past attestation evidence; their presence does not replace the Policy’s Require attestation condition for the current connection.

Microsoft Intune

Prefix: intune. Default platforms: Windows, macOS, iOS/iPadOS, Android.

Iru (Kandji)

Prefix: iru. Default platforms: macOS, iOS/iPadOS.

Microsoft Defender for Endpoint

Prefix: defender. Default platforms: Windows, macOS, Linux.

Defender records are matched through an Intune record with the same Microsoft Entra device ID. A Defender rule therefore needs a matching Intune record as well as Defender data.

Santa

Prefix: santa. Default platforms: macOS.

SentinelOne

Prefix: sentinelone. Default platforms: Windows, macOS, Linux.

Need help? See all support options.