Patch and Windows Update Status Monitoring

To monitor patch compliance, you need to query two endpoints.

The Update endpoint reports the status of operating system updates only (for example, Windows Update or macOS system updates).

It does not include updates for third-party applications installed through package managers such as Winget (Windows) or Homebrew (macOS).

To determine whether third-party applications have updates available, use the Software Inventory endpoint. It reports installed software and indicates whether a newer version is available.

System updates

Endpoint	What it returns
GET /api/v1/computers/stat/update/latest (fleet-wide, paged)	Returns the operating system update status for every managed device. Does not include Winget or Homebrew packages.
**GET /api/v1/computers/{hid}/stat/update/latest (single device)	Returns the same information for a specific device. Use this endpoint only when investigating an individual machine.

Third-party package updates (Winget / Homebrew)

Endpoint	What it returns
GET /api/v1/computers/stat/software/latest (fleet-wide, paged)	Returns the installed software inventory. If the availableVersion property is populated for an application, an update is available. This is the only endpoint that reports updates for Winget and Homebrew packages.

Recommended approach

To build an accurate patch compliance report:

Query the Update endpoint to determine the operating system update status for all devices. Query the Software Inventory endpoint to identify third-party applications with available updates by checking the availableVersion field. Combine the results into a single report.