diff --git a/device_posture_rule.go b/device_posture_rule.go
index c1d565c9a16..fc4e0657a51 100644
--- a/device_posture_rule.go
+++ b/device_posture_rule.go
@@ -167,13 +167,13 @@ type DevicePostureRuleMatch struct {
 type DevicePostureRuleInput struct {
 	ID               string               `json:"id,omitempty"`
 	Path             string               `json:"path,omitempty"`
-	Exists           bool                 `json:"exists,omitempty"`
+	Exists           *bool                `json:"exists,omitempty"`
 	Thumbprint       string               `json:"thumbprint,omitempty"`
 	Sha256           string               `json:"sha256,omitempty"`
-	Running          bool                 `json:"running,omitempty"`
-	RequireAll       bool                 `json:"requireAll,omitempty"`
+	Running          *bool                `json:"running,omitempty"`
+	RequireAll       *bool                `json:"requireAll,omitempty"`
 	CheckDisks       []string             `json:"checkDisks,omitempty"`
-	Enabled          bool                 `json:"enabled,omitempty"`
+	Enabled          *bool                `json:"enabled,omitempty"`
 	Version          string               `json:"version,omitempty"`
 	VersionOperator  string               `json:"versionOperator,omitempty"`
 	Overall          string               `json:"overall,omitempty"`
@@ -194,8 +194,8 @@ type DevicePostureRuleInput struct {
 	CommonName       string               `json:"cn,omitempty"`
 	ActiveThreats    int                  `json:"active_threats,omitempty"`
 	NetworkStatus    string               `json:"network_status,omitempty"`
-	Infected         bool                 `json:"infected,omitempty"`
-	IsActive         bool                 `json:"is_active,omitempty"`
+	Infected         *bool                `json:"infected,omitempty"`
+	IsActive         *bool                `json:"is_active,omitempty"`
 	EidLastSeen      string               `json:"eid_last_seen,omitempty"`
 	RiskLevel        string               `json:"risk_level,omitempty"`
 	State            string               `json:"state,omitempty"`
diff --git a/device_posture_rule_test.go b/device_posture_rule_test.go
index 4d7e25f6f0c..dbfa462574b 100644
--- a/device_posture_rule_test.go
+++ b/device_posture_rule_test.go
@@ -354,10 +354,10 @@ func TestDevicePostureRules(t *testing.T) {
 		Input: DevicePostureRuleInput{
 			ID:         "9e597887-345e-4a32-a09c-68811b129768",
 			Path:       "/tmp/data.zta",
-			Exists:     true,
+			Exists:     BoolPtr(true),
 			Thumbprint: "asdfasdfasdfasdf",
 			Sha256:     "D75398FC796D659DEB4170569DCFEC63E3897C71E3AE8642FD3139A554AEE21E",
-			Running:    true,
+			Running:    BoolPtr(true),
 		},
 	}}
 
@@ -413,7 +413,7 @@ func TestDevicePostureFileRule(t *testing.T) {
 		Match:       []DevicePostureRuleMatch{{Platform: "ios"}},
 		Input: DevicePostureRuleInput{
 			Path:   "/tmp/test",
-			Exists: true,
+			Exists: BoolPtr(true),
 			Sha256: "42b4daec3962691f5893a966245e5ea30f9f8df7254e7b7af43a171e3e29c857",
 		},
 	}
@@ -468,7 +468,7 @@ func TestDevicePostureDiskEncryptionRule(t *testing.T) {
 		Expiration:  "1h",
 		Match:       []DevicePostureRuleMatch{{Platform: "ios"}},
 		Input: DevicePostureRuleInput{
-			RequireAll: true,
+			RequireAll: BoolPtr(true),
 			CheckDisks: []string{"C", "D"},
 		},
 	}
@@ -680,8 +680,6 @@ func TestDevicePostureClientCertificateRuleV2(t *testing.T) {
 		`)
 	}
 
-	checkPrivateKey := true
-
 	want := DevicePostureRule{
 		ID:          "480f4f69-1a28-4fdd-9240-1ed29f0ac1db",
 		Name:        "My rule name",
@@ -693,7 +691,7 @@ func TestDevicePostureClientCertificateRuleV2(t *testing.T) {
 		Input: DevicePostureRuleInput{
 			CertificateID:    "d2c04b78-3ba2-4294-8efa-4e85aef0777f",
 			CommonName:       "example.com",
-			CheckPrivateKey:  &checkPrivateKey,
+			CheckPrivateKey:  BoolPtr(true),
 			ExtendedKeyUsage: []string{"clientAuth", "emailProtection"},
 			Locations: CertificateLocations{
 				TrustStores: []string{"system"},