Trellix EDR uses OAuth 2.0 client credentials plus a tenant-scoped API key. You will need to create client credentials in the Trellix console, grant the required scopes, and supply your tenant ID and API key.

## Prerequisites

API access depends on **both** your Trellix license entitlements and the OAuth scopes on the client credential. Scopes alone do not unlock operations your tenant is not licensed for.

| License / product area | Operations available | Related scope(s) |
|  --- | --- | --- |
| **EPO** (endpoint management) | Query managed devices | `epo.device.r` |
| **Trellix EDR** | Query threat events and alerts; quarantine and unquarantine hosts; realtime searches | `soc.act.tg`, `soc.rts.c`, `soc.rts.r` |


A tenant licensed for **EPO only** can query devices. Threat, alert, remediation, and realtime search operations require a **Trellix EDR** license — **Trellix EDR Foundation (EDRF)** is the recommended minimum entitlement. Without EDR, those scopes may be unavailable in Client Credentials, and API calls for those operations return not authorized even if a scope is granted.

## 1. Create client credentials

### Step 1: Log in to the Trellix tenant

Log in to your Trellix tenant console.

### Step 2: Open Client Credentials

After log in, click the down arrow in the top right corner and select **Client Credentials**.

### Step 3: Add a new credential

1. Click **Add**
2. Give the credential a name and description
3. Select the required scopes (see below)
4. Save the generated **Client ID** and **Client Secret**


## 2. Add scopes

Grant **all** scopes in the table below on the client credential. Each scope maps to operations described in [Prerequisites](#prerequisites). Trellix checks license entitlements and scopes on every API call — missing either one causes that operation to be rejected as **not authorized**.

In **Client Credentials**, Trellix groups scopes by product area:

| Trellix console category | Scope(s) |
|  --- | --- |
| **Devices** | `epo.device.r` |
| **EDR Remediations** | `soc.act.tg` |
| **EDR Searches** | `soc.rts.c`, `soc.rts.r` |
| **EDR Threats** | `soc.act.tg` |


> **Note:** `soc.act.tg` appears under both **EDR Remediations** and **EDR Threats**. Grant it once.


### Required scopes

| Scope | Required for | Without this scope |
|  --- | --- | --- |
| `epo.device.r` | Querying managed endpoints | Cannot query endpoints; Trellix returns not authorized. |
| `soc.act.tg` | Querying threat events and alerts; quarantining and unquarantining hosts | Cannot query threat events or alerts; cannot quarantine or unquarantine hosts; Trellix returns not authorized. |
| `soc.rts.c` | Creating realtime searches | Cannot create realtime searches; Trellix returns not authorized. |
| `soc.rts.r` | Polling realtime search jobs and reading results | Cannot read realtime search results; Trellix returns not authorized. |


Realtime search scopes work as a pair
`soc.rts.c` and `soc.rts.r` are both required for any realtime search workflow — including quarantine verification on Windows, which uses a HostInfo search. If you grant `soc.rts.c` but omit `soc.rts.r`, the search can be created but reading results returns not authorized (`403`).

## 3. Configure the integration

**Client ID**: OAuth client ID from Client Credentials.

**Client Secret**: OAuth client secret from Client Credentials.

**Tenant ID**: Trellix tenant GUID for the customer tenancy. Click Tenant Settings for the Tenant Key

**API Key**: Tenant-scoped Trellix API key.

Trellix API requests also send `X-Tenant-Id`, `x-api-key`, and a bearer token from `https://iam.cloud.trellix.com/iam/v1.0/token`.