Changelog

Version 3.7 November 2025

Features

New Secure Web Gateway module

The new Secure Web Gateway (SWG) module has been added to the modules parameter in the:

• GET response to the /subscriptions endpoint
• PUT request to the subscriptions endpoint
• POST response to the /subscriptions/bundleInfo endpoint

Metadata for tickets

A new metadata parameter is now supported in the POST request to the /tickets/{id}/actions endpoint. This parameter lets you include additional data required for the addToDataGovernancePermissions action, such as specifying selectedSubEventTriggers. These values correspond to one or more entries returned by the GET request to the /tickets, under the ticketDetails > violatedDataTypes parameter.

Version 3.6.1 September 2025

Features

New audit logs endpoint

You can now issue a GET request to the /audit-logs/search endpoint to obtain the audit log for a specified workspace.

API responses use pagination to reduce loading time, with a default page size of 20 records.

Ticket responses include audit log links for auto-remediated actions

The TicketReponse object now includes a _links parameter, providing links to audit log records for the most recent auto-remediation actions performed by Coro in connection with the ticket event.

Version 3.5 April 2025

Features

New Security Awareness Training module

The new Security Awareness Training (SAT) module is now an additional parameter returned in the modules property in the GET and PUT requests to the /subscriptions endpoint and the POST request to the /subscriptions/bundleInfo endpoint.

This module enables organizations to train employees to recognize phishing attempts and malicious content delivered via email, reducing the risk of unauthorized access to company resources and sensitive data. To learn more, see Security Awareness Training.

Version 3.4.2.1 April 2025

Features

New demo mode parameters

Two new demo mode parameters, demoModeEnabled and demoModeEndDate have been added to the response of the GET request to the /usage endpoint. These parameters indicate whether demo mode is active for the workspace and, if applicable, when it ended. Demo mode allows admin portal users to explore the Coro platform with pre-filled demo data before transitioning to a trial or subscription status.

New workspace creation parameter

The workspaceCreationType parameter is now returned in the responses of the GET and POST requests to the /workspaces endpoint. This parameter indicates how the workspace was created and by whom.

Version 3.4 January 2025

Features

New workspace search request

You can now use the /workspaces/search endpoint to search for all child workspaces of a specific channel workspace.

For more information about child and channel workspaces, see Welcome to the Coro developer portal.

Version 3.3 November 2024

Features

New subscription requests

You can now start and stop subscriptions with the following requests:

• a PUT request to the subscriptions/start endpoint, to start a subscription.
• a PUT request to the subscriptions/stop endpoint, to stop a subscription.

New webhook requests

You can now configure and manage webhooks for your workspaces. For more information about webhooks, see what are webhooks.

Webhooks requests include:

• a POST request to the settings/webhooks endpoint: Create a webhook configuration
• a GET request to the settings/webhooks/{id}/test endpoint: Test a webhook configuration
• a PUT request to the settings/webhooks/{id} endpoint: Update a webhook configuration
• a GET request to the settings/webhooks/{id} endpoint: Retrieve a webhook configuration
• a GET request to the settings/webhooks endpoint: Retrieve all webhook configurations
• a DELETE request to the settings/webhooks/{id} endpoint: Delete a webhook configuration

Enhancements

New parameters in request body when triggering a ticket action

When making a POST request to the tickets/{id}/actions endpoint, the following parameters are now included in the request body:

• eventAction > uiView: The name of the event as it appears in the Coro console.

• eventAction > type: The group type of the ticket, such as EDR or malware.

Version 3.2 June 2024

Features

New subscription requests

You can now send subscription calls which enable admin portal users to view and manage workspace subscriptions. The calls include:

• a GET request to the /subscriptions endpoint: Retrieve the subscription details of a specific workspace, including the modules and add-ons that are enabled and disabled.

• a PUT request to the /subscriptions endpoint: Update the subscription of a specific workspace. Modifying your subscription alters your billing amount. Required modules and add-ons must be enabled. To get the details of which modules and add-ons must be enabled for different bundles offered by Coro, use the POST request to the /subscriptions/bundleInfo endpoint.

• a POST request to the /subscriptions/bundleInfo endpoint: Retrieve the details of modules and add-ons included in specific bundles offered by Coro. These details can be used to update your subscription with the PUT request to the /subscriptions endpoint.

New archive workspace endpoint

You can now make a PUT request to the /workspaces/archive endpoint to archive an inactive workspace using the specified workspace ID. When a workspace is archived, any cloud applications are disconnected, and Inbound Gateway and Network settings are cleared. Admin portal users can’t sign into archived workspaces, and archived workspaces don’t appear in an MSP's list of workspaces.

New pendingAdminEmails parameter

The pendingAdminEmails parameter is now returned in the GET and POST requests to the /workspaces endpoint. The parameter lists the email addresses of all admin portal users invited to the workspace who have not yet activated their accounts.

Enhancements

role parameter returned in additional response

The role parameter is now returned in the GET request to the /portal-users endpoint. This is a read-only parameter, which can't be edited through the API. The role parameter reflects an admin portal user's role within the Coro console. All current and future admin portal users added through the API automatically receive a super admin role, granting them full permissions and access in the Coro console.

Improved descriptions

Descriptions for parameters and endpoints have been improved.

Version 3.1.1 March 2024

Features

New role parameter

The role parameter is now returned in the GET request to the /portal-users/{id} endpoint. This is a read-only parameter, which can't be edited through the API. The role parameter reflects an admin portal user's role within the Coro console. All current and future admin portal users automatically receive a super admin role, granting them full permissions and access in the Coro console.

Version 3.1 February 2024

Features

Multi-region deployment

Coro now allows users to store data in Canadian and German data centers, alongside existing US centers. This feature is essential for users in Canada and Europe, meeting local regulatory requirements to keep data within their operational region.

The environment for each region has a unique URL:

• US: api.secure.coro.net
• Canada: api.secure-ca.coro.net
• Germany: api.secure-eu.coro.net

New endpoint /devices/{enrollmentCode}/actions

You can now make GET and POST requests to the /devices/{enrollmentCode}/actionsendpoint.

For both requests, the device enrollment code is required. You can retrieve this by making a GET request to the /devices endpoint.

The GET request retrieves all supported actions for a device, while the POST request performs actions on the device.

The actions included are:

New endpoints for portal users

You can now make the following requests:

• GET request to the /portal-user endpoint: retrieve a list of portal users
• GET request to the /portal-user/{id} endpoint: retrieve a specific portal user
• POST request to the /portal-user endpoint: add a portal user to the workspace

Version 3.0.1 December 2023

Features

New parameters in GET /usage endpoint

The moduleStatistics object is now returned in the GET request to the /usage resource endpoint. This object contains details about the number of devices associated with each module. The object returned appears similar to:

 "moduleStatistics": {
        "deviceModules": {
          "endpointSecurity": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "endpointDataGovernance": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "edr": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "network": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "mdm": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          }
        },
        "mdmModules": {
          "active": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "disenrolled": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          },
          "inactive": {
            "windowsCount": 0,
            "macOsCount": 0,
            "androidCount": 0,
            "iosCount": 0
          }
        }
      }

The following table describes the parameters in the response:

Version 3.0 October 2023

Features

New GET /usage endpoint

You can now make a GET request to the /usage resource endpoint to view the usage of a workspace.

The request appears similar to:

curl -i -X GET \
  'http://api.secure.coro.net/v1/usage?start={start}&end={end}&page={page}&pageSize={pageSize}' \
  -H 'Authorization: Bearer <access_token>' \
  -H 'Workspace: Workspace1'

The following table describes the parameters in the request:

A successful response appears similar to:

HTTP/1.1 200 OK
Content-Type: application/json
Date: {date}
X-Coro-Trace-Id: {trace-id}
Transfer-Encoding: chunked

{
  "items": [
    {
      "workspaceId": "companyWorkspace",
      "parentWorkspaceId": "partnerWorkspace",
      "workspaceType": "child",
      "time": 1672545600000,
      "subscriptionType": "subscription",
      "trialStartDate": 1694009438802,
      "trialEndDate": 1694009438802,
      "connectedCloudApplications": [
        "Google_workspace"
      ],
      "modules": [
        "NETWORK"
      ],
      "addons": [
        "SECURED_WEB_GATEWAY"
      ],
      "bundles": [
        "MANAGED_SASE"
      ],
      "users": {
        "protectedUsers": 215,
        "protectableUsers": 130
      },
      "devices": {
        "protectedDevicesStats": {
          "windowsCount": 115,
          "macOsCount": 100,
          "androidCount": 115,
          "iosCount": 100
        }
      },
      "atcEnabledStats": {
        "windowsCount": 0
      }
    }
  ],
  "totalElements": 0
}

The following table describes the parameters in the response:

New parameters in the GET /workspaces and POST /workspaces calls

The 200 successful response of the GET and POST requests to the /workspaces resource endpoint now has additional parameters:

• mainAdminEmail - the initial admin email address provided when the workspace was created
• adminEmails - the email addresses of all admins associated with the workspace
• lastAdminLoginTime - the most recent login to the workspace by an admin user, in UNIX format, including milliseconds
• workspaceCreationTime - the date the workspace was created, in UNIX format, including milliseconds