API Key / Client ID + Secret Creation
You must log into the Check Point Infinity Portal or the Harmony Endpoint management console.
Navigate to the API Keys (External API / Service API) section.
When creating a new API key, the Service / Product option must be set to Harmony Endpoint.
Once the API key is created, the system will provide the Client ID and Secret / Access Key.
These credentials will be used for API authentication (for example, when obtaining an access token).
API Key Permissions (Scopes)
For the API key to function correctly, the following permissions must be assigned:
• fetch assets
• fetch vulnerabilities
• fetch events / logs / incidents
• fetch remediation status / results
• fetch quarantine items
If the API key is created with only the "asset fetch" permission, it will only be able to retrieve device and vulnerability information.
To retrieve quarantine, remediation, or event/log data, the relevant "data fetch / read-only" permissions must be granted.
Endpoint Agent and Module Requirements
Having an API key alone is not sufficient for retrieving data.
The following conditions must be met:
Harmony Endpoint Agent / Client must be installed on all endpoint machines.
The following protection modules must be enabled on the agent:
• Malware / Anti-Malware
• Forensics
• Quarantine
• Remediation
• Vulnerability Management
All of these modules must be licensed and active.
If these modules are not active, the relevant data types cannot be retrieved through the API.
Log Collection and Centralized Log Management
To retrieve logs via the API (events, quarantine, remediation, anti-malware, etc.):
The Log Collection / Central Logging feature must be enabled in the management console.
In the Harmony Endpoint Logs section, logs coming from endpoint devices must be visible.
If logs are not visible in the portal, they cannot be retrieved via the API.
Ensure that the log collection infrastructure is properly enabled before attempting API log queries.
Configure Integration in Logsign USO
Log in to your Logsign USO instance.
Go to Data Sources → Add New → API → Checkpoint Harmony
Enter the following fields:
- Client ID: the Client ID obtained when the API key was created.
- Secret / Access Key: the Secret (Access Key) obtained together with the Client ID. Logsign refers to this field as the API key's secret value, not a separate password.
- Base URL: the host address only of your Check Point Infinity Portal API gateway — for example https://cloudinfra-gw.portal.checkpoint.com.
In the Infinity Portal, Check Point displays this value as an Authentication URL (API Endpoint) that already ends with /auth/external. Do not paste that full path into this field: Logsign appends /auth/external to the Base URL itself, so the path would be sent twice and the request fails with HTTP 404. For the same reason, do not leave a trailing slash at the end. The host may differ per region/tenant, so always use the one shown in your own portal.
Click Save.
Troubleshooting
If the poller log shows Failed to get access token, check the HTTP status code reported on the line above it:
- 404 the Base URL is wrong. In almost every case /auth/external (or a trailing slash) was left on the end of the Base URL. Remove it and keep only the host, as described above.
- 401 / 403 the Client ID or Secret / Access Key is incorrect or expired, or the API key does not have the permissions listed above.
Also confirm that all three fields were copied from the Infinity Portal without stray spaces, and that the Base URL includes the https:// scheme.