I've put an issue, that may be by design (an awful design), whereby if you pull values via the API, they are all transposed with each two digit pair
For example, if I pull an event and it shows me an endpoint_id of: endpoint_id":"baee7c85-6cd5-4b85-ae84-cf90cf701757"
If I then want to query that endpoint or browse to it in the browser, I use this: https://central.sophos.com/manage/devices/computers/abeec758-c65d-b458-ea48-fc09fc077175/summary
You can see that the value's are different, each two-digit 'pair' are transposed in some weird way:
API says baee7c85-6cd5-4b85-ae84-cf90cf701757
URL says abeec758-c65d-b458-ea48-fc09fc077175
Why is this the case? Makes scripting stuff that has interactive links to the GUI all that much more challenging, for essentially no reason that I can see.
This isn't just for endpoints, it's the same for alerts and probably more.