Webroot
Every site under the GSM — protection, threats, DNS and agents — read and never written.
Webroot's Unity API covers the endpoint side of your book, and the answers you actually want out of it are spread across a console you have to log into site by site. Connect a GSM here and one question reaches all of it: which machines are protected and which are dark, what got caught and what it did, which DNS Protection policy is applied where, who holds admin rights, and how many endpoints you are really billing for. The connection is read-only in the structure of the code, not as a setting — there is no way to change a policy, quarantine a file, or push anything at an endpoint from here.
The story
What changes once it’s connected.
The Webroot console is not hard to use; it's hard to use forty times. The protection number for one client is two clicks away, and the same number for every client is an afternoon. Connect the GSM and the question is asked once instead: which endpoints haven't checked in this week and where, what threats landed at the law firm last month, which sites are still running an old agent, and how many seats the whole console is actually consuming.
The coverage follows how a GSM is really structured. The console and its sites, with the keycode-to-site-id translation the rest of the API insists on. Endpoints per site plus their groups and policy assignment, and — from SkyStatus — live agent status for the endpoint agent and the DNS Protection agent across the whole console. Threat history at three depths: a whole site, one group, one machine. Web Threat Shield URL blocks as daily counts and as individual rows. DNS Protection end to end: categories, policies, the mappings that decide which policy governs which network, blocked requests, and traffic totalled by category. Admin users and endpoint protection policies. And usage reporting for the billing conversation.
Two honest edges are worth knowing before you ask. Per-site figures come one site at a time — Webroot's API offers no batch form for them — so a console-wide roll-up of per-site protection, DNS or training stats is a sweep of many calls rather than a single one, and a very large GSM is answered site by site. And usage reporting keeps roughly forty days of history upstream; ask for a window older than that and the honest result is empty rather than invented. Everything else is exactly what the console holds, with no write path anywhere near it.
Things you can ask
Ask it like you’d ask a teammate.
Skills included
Every skill, in the open.
44 skills across 7 areas
Read-only, and structurally so rather than by policy. The HTTP client behind this agent implements a single method — GET — so no request that could change anything can even be constructed; every skill is typed as a read, which makes a write skill unrepresentable in the registry; and the MCP boundary checks that read scope again before a call runs. Nothing here quarantines a file, runs a scan, deactivates a site, edits a policy or a DNS Protection rule, creates or removes an admin, or sends any command to an endpoint — the command tools read the history of commands, they do not issue them. The credential is a GSM-scoped Unity API client plus a console login, so a session sees exactly the sites that login can see, and one connection is bound to one GSM console keycode.
Sites & estate10The shape of the console: what it is, which client sites hang off it, and the headline protection, DNS and training numbers at both levels.⊘ Reading only — no site is created, renamed, suspended, or deactivated, and no keycode is issued from here. The per-site figures are fetched a site at a time because Webroot exposes no batched form of them, so an estate-wide roll-up is many calls rather than one, and on a very large console it is answered progressively rather than instantly.›
gsm_infoThe console itself at a glance — what this GSM is called, the keycode behind it, and the status it's in.list_sitesEvery client site under the console in one pass, each with its keycode, site id, status and device count.get_siteOne site's record opened in full, pulled straight by its site id.lookup_siteTurn the keycode written on a client record into the site id the rest of this surface asks for — the translation step between console-speak and everything else.gsm_statsProtection counted across the whole console: how many devices, how many threats, and how the protection states break down.site_statsThe same protection breakdown narrowed to a single client site — one call per site, since there's no way to ask for several at once.gsm_dnsp_statsDNS Protection measured console-wide — requests seen, requests blocked, and how much of the estate is actually covered.site_dnsp_statsThat same DNS coverage picture for one client, which is the version worth putting in front of them.gsm_wsat_statsSecurity Awareness Training across the console: how many campaigns ran and how many people finished them.site_wsat_statsTraining campaign and completion figures for a single site on their own.
Endpoints9The machines themselves: what's on each site, how they're grouped and which policy they answer to, whether their agents are live right now, and what has been commanded at them.⊘ Nothing here touches a machine. No scan is started, no agent reinstalled or uninstalled, no endpoint moved between groups, and no command is issued — the command tools read a history that something else wrote. Site-scoped lists want a site id, so a keycode goes through lookup_site first. Endpoint lists are paged; the two SkyStatus tools ignore paging entirely and hand back roughly fifty records at a time with a continuation token to collect the rest.›
list_endpointsThe machines on a site — device name, protection status, OS, last seen — a page at a time, because a large site doesn't come back in one response.get_endpointA single machine in full: hostname, OS, whether it's protected, and when it last checked in.list_groupsHow a site's endpoints are grouped, and which policy each group is pointed at.get_groupOne group on its own — its name, the policy assigned to it, and how many machines sit inside.list_group_endpointsThe actual membership of a group, machine by machine.endpoint_statusLive agent status from SkyStatus for every endpoint under the console — online or not, last contact, agent version — narrowable to one machine or to records changed since a timestamp, and collected in ~50-record batches via a continuation token.dnsp_agent_statusThe same live check aimed at the DNS Protection agent rather than the endpoint agent, batched and continued the same way.list_site_commandsWhat has been commanded across a site and how it went — type, target, status, timestamp. A record to read, never a place to send one.list_endpoint_commandsThe command history for one machine, which is where 'did that ever actually run?' gets settled.
Threats & security5What Webroot caught and what it stopped: threat history at site, group and machine depth, plus Web Threat Shield's record of blocked URLs.⊘ It reports detections; it cannot act on them. No file is quarantined or restored, no threat marked reviewed, no scan triggered, and no URL added to an allow or block list. History is fetched per scope with an optional date window — there is no console-wide 'every threat everywhere' call, so an estate answer is built site by site.›
site_threat_historyEverything caught across one site over the window you name — the threat, the action taken against it, and when.group_threat_historyThe same record narrowed to a single group of machines, for when one department keeps showing up.endpoint_threat_historyOne machine's detections on their own — the answer when a single user seems to attract everything.blocked_urls_countsWeb Threat Shield totals day by day for a site: the shape of the trend before you go looking at rows.blocked_urls_dataThe rows behind those totals — which URL, what action was taken, on which endpoint, at what time.
DNS Protection9The DNS layer end to end: the categories policies are built from, the policies themselves, where each one is applied, and the traffic that resulted.⊘ Policies and mappings are readable and never writable — no category is toggled, no allow or block list edited, no policy created or pointed at a different network. Site traffic reports take an optional date window; only the traffic summary spans every site in one call, so the detailed views are still per-site.›
dnsp_categoriesThe category vocabulary a DNS Protection policy is built out of — what can be blocked or allowed in the first place.dnsp_policiesEvery DNS Protection policy defined on the console, with its id, name and the category rules it carries.dnsp_policyA single policy read out in detail, down to its allow and block lists.dnsp_mappingsWhich policy governs which network or group at a site — the wiring between a policy and the people it applies to.dnsp_block_reasonsThe block-reason list the traffic reports are written in, so a blocked row can be read rather than guessed at.dnsp_blocked_trafficThe individual requests DNS Protection stopped at a site — domain, category, reason and timestamp, over a window you choose.dnsp_traffic_by_categoryA site's DNS requests totalled up by category — where the browsing actually goes, which is worth knowing even when nothing was blocked.dnsp_traffic_summaryRequests and blocks for every site under the console side by side — the one DNS view that answers estate-wide in a single call.site_dnsp_traffic_summaryThose same two figures for one site, when only that client is in question.
Admins & policies6Who can get into the console and what the endpoint protection policies are set to — the governance layer behind everything else.⊘ Read-only in both halves. No admin is invited, promoted, demoted, or removed, and no site access is granted; no policy is created, edited, copied, or assigned to a group. What comes back is the current configuration, which is the evidence for a change someone else then makes in the console.›
list_adminsWho holds a login on the GSM console, with their id, name, email and role.get_adminOne admin opened up — role included, and the sites that account can actually reach.list_site_adminsThe admin accounts attached to a single site, which is how you check who at a client can log in.list_policiesThe global endpoint protection policies the console defines, by id, name and description.get_policyOne policy's settings in full — the record of what it is genuinely configured to do, not what it was named.list_site_policiesWhich of those policies a given site has available to it.
Usage reporting3The billing-shaped view: licensing and endpoint counts for the console, per site, and per machine.⊘ Webroot keeps roughly forty days of usage-report history upstream, so a window older than that comes back empty or short rather than reconstructed — for a longer trend you need your own periodic snapshot. These are point-in-time totals as of the report's effective date, not a log of activations, deactivations, or seat changes over time.›
usage_summaryWhere the console stands on its report date — license type and expiry, total sites and endpoints, trial split from paid. A snapshot, not a history of how it got there.usage_sitesEndpoint usage summarised site by site across the console — the figures a billing conversation runs on.usage_endpointsThe same usage counted machine by machine, paged so a big console can be walked through rather than swallowed whole.
Agent & session2What this connection is and whether the platform behind it is up — the two things to check first when an answer looks wrong.⊘ Read-only, and it reports the connection rather than repairing it: it cannot re-enter credentials, swap the GSM keycode, or mint a fresh token. A console login that has had 2FA switched on, or a rotated Unity API secret, shows up here as a connection that has stopped validating — fixing it means reconnecting.›
healthWhether the Webroot Unity API is answering at all and which version is running, merged from its own ping and version checks — the first thing to try when everything fails at once.whoamiWhat this session is wired to: the GSM console key, the stored connection's status and when it last validated, and when the current token expires. It answers even before a connection exists, because it makes no upstream call.
Connecting
Wire it in, in an afternoon.
How to connect
- 01In my.webrootanywhere.com, create a Unity API client under Settings → Unity API Access and keep the Client ID and Secret.
- 02Have a console login ready that can see this GSM — Webroot's API sign-in can't take a 2FA code, so 2FA has to be off on that account.
- 03Copy the Parent Keycode from Settings → Account Information and paste all five values here; the connection is validated against the GSM before it saves.
Patch your stack in.
Start the Switchboard free trial against your own environment — read-only, traced answers, live in an afternoon. The apps are on the shelf when you want them.