Get the last-scanned and staged sudoers for a Linux computer
GET/computers/:computerId/sudoers
Returns the sudoers last seen by a scan (lastScanSudoers) and the sudoers staged as the desired state for Protect mode (stagedSudoers).
Either is null when absent. When a staged document exists it is the one enforced once Protect is enabled; otherwise the last scanned document is used. Include files are flattened into one document. Timestamps are HTTP-date strings (Tue, 27 Oct 2026 22:03:28 GMT), not ISO 8601, and the blob has no trailing newline. createdById is null for a scan document and createdByName is absent then.
Returns 400 Can only request sudoers content for Linux systems for a non-Linux computer. Errors from the sudoers service are passed through with that
service's status and a {message} body.
The server returns 500 (generic {error} body) for every caller when the staged sudoers was created by the built-in secureone account, because that account is not a directory user; stage a new sudoers with a directory user to avoid it.
Required role: superadmin or admin.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- default
Sudoers documents.
Bad request. Access routes: InvalidQuery 'Invalid Access Duration Requested.' for a bad t. Any route: InvalidQuery 'illegal key "$ne" in query|body' when a query or body key starts with $. Malformed JSON gives an untyped {error} body. Sudoers routes: BadRequestError for a non-Linux computer, a missing or empty sudoers_blob, or a missing sudoersHash. Admin add/remove on Linux: BadRequestError carrying the sudoers service message. Missing or malformed ids on the admin routes are 422, not 400.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
Failure reported by the sudoers service, passed through with that service's HTTP status and a {message} body. A 500 is returned when the service fails unexpectedly (a missing Linux service-account password, or a non-string sudoers_blob).