---
title: "Device Claim Scripts"
slug: "device-claim-scripts-v6-5"
description: "Learn how Device Claim Scripts work, executing every five minutes to report changes and manage device claims in AppGate for secure access."
updated: 2025-10-31T18:24:03Z
published: 2025-10-31T18:24:00Z
canonical: "support.appgate.com/device-claim-scripts-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Claim Scripts

Device Claim Scripts are pushed to the Client which runs them every 5 minutes, and reports any changes to the claim. Device Claim Scripts create scripted (formerly on-demand) device Claims and are selected in Identity Providers.

Everything your device claims script returns will be treated as a string, including "Yes", "No", "True" etc. However built-in Boolean claims such as isFirewallUp etc use Boolean true/false. (So in this example, while setting access criteria in a Policy or Condition because the value returned is a Boolean the "is true" operand works.) However, for device claims, if you want to check the myvalidCertificate claim which has come from a device claim script and returned the value "True", then because this is a string, you can NOT use "is true" operand. So to set access criteria to use "is" operand and "True" value.

## Requirements/Considerations

The device claim script will execute on the user's device. Scripts run in the Client every 5 minutes and collect additional attributes which are sent back to the Controller or Gateway to set device claim values. The scripts are stored on the Appgate SDP system. During authentication the Client downloads device claim scripts if they have not already been downloaded when connecting at an earlier time.

- Device Claim Scripts will not be executed if the client is running in elevated/administrator mode.
- Device Claim Scripts need to able to execute on the target platform and run without the user needing admin rights.
- Device Claim Scripts should return a value/values via std out which will subsequently be evaluated for true/false.
- The following platform dependent script formats are supported: .exe, .sh, .bat, .vbs and .ps1. Others may run but are unsupported.

## Before you start

- Get a better understanding of [device claims](/v1/docs/device-claims) including details relating to [device claim scripts](/v1/docs/device-claims#device-claim-script)
- General background on the [use of scripts](/v1/docs/use-of-scripts)
- Refer to [claims in detail](/v1/docs/claims-in-detail) for information about all the claims used in the system.
- Prepare your device claims script ready for uploading
- Check the [Client compatibility matrix](/v1/docs/compatibilty-matrix) to make sure Device claim script can be used on your target platforms

Use the Device Claim Scripts form to:

- [Add a new](/v1/docs/configure-device-claim-scripts) device claim script
- [Edit](/v1/docs/configure-device-claim-scripts) an existing device claim script
- Perform actions using the action buttons provided (See below)

## Action Buttons

- ***Download Script***. There is a download button to download each script.

Key-value pairs related to the identity and content of the user or device and are specific to each session.

A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements.

The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.

An appliance that acts as an enforcement point, controlling user access to protected resources.

Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model.