Use Kandji Connector Action Cards with Okta Workflows

By Emalee Firestein

Integrate Kandji's Apple device management solution with Okta Workflows

You can use the Kandji connector to integrate Kandji device management with Okta Workflows to help automate critical components of the user lifecycle that are prone to friction or manual error.

The first step is to Authorize your Kandji tenant for Okta Workflows.

After you set up a Kandji connection, you can use the following Kandji connector action cards in a Workflow.

Action	Description
Clear Passcode	Clear the iOS or iPadOS device passcode.
Create Blueprint	Create a Blueprint.
Create Note	Create a note in Kandji for the device.
Erase Device	Send Erase Device MDM command.
Get ADE Integration	Given an Automated Device Enrollment (ADE) integration token, return information about the integration.
Get Activation Lock Bypass Codes	Get the Activation Lock Bypass Code for a Mac.
Get Blueprint	Get a Blueprint by Blueprint ID or by name.
Get Device	Given a Device ID, get high-level details about the device.
Get FileVault Recovery Key	Get the FileVault Recovery Key for a Mac.
Get (Mac) Unlock PIN	Get the unlock PIN for a locked Mac.
List ADE Integrations	Return a list of configured Automated Device Enrollment (ADE) integrations.
List ADE Devices	Given an Automated Device Enrollment (ADE) integration token, return a list of all devices associated with that token, as well as their enrollment status. When the mdm_device key value is null, this indicates that the device is awaiting enrollment into Kandji.
List Blueprints	List all Blueprints in the Kandji tenant.
List Device Apps	Given a Device ID, return a list of all apps installed on the device.
List Device Library Items	Given a Device ID, return a list of all the Library Items for the device and their statuses.
List Device Notes	Given a Device ID, return a list of all the notes in Kandji for the device.
List Devices>	Return a list of all enrolled devices. Optional query parameters can be used to filter the results.
Lock Device	Send Lock Device MDM command.
Manage Apple Remote Desktop	Use MDM to turn Apple Remote Desktop for a Mac on or off.
Play Lost Mode Sound	Use MDM to turn Apple Remote Desktop for a Mac on or off.
Reinstall Kandji Agent	Use MDM to reinstall the Kandji Agent on a Mac.
Restart Device	Send Restart MDM command.
Send MDM Blank Push	Send Blank Push MDM command.
Set Device Name	Send an MDM command to set the device name.
Shutdown Device	Send Shutdown MDM command.
Turn Off Lost Mode	Turn off Managed Lost Mode for an iOS or iPadOS device.
Turn On Lost Mode	Turn on Managed Lost Mode for a Supervised iOS or iPadOS device.
Unlock (Local) User Account	Send Unlock Account MDM command.
Update Device	Given a device, update its assigned Blueprint, user, or asset tag.
Update Inventory	Send Update Inventory MDM command.
Update Lost Mode Location	Send the MDM command to an iOS or iPadOS device in Lost Mode to update the location data.

Kandji Connector Action Card Details

Custom API Action

Make an authenticated HTTP request to the Kandji API.

This action is unlike other Kandji cards; refer to Kandji's API documentation.

Options

Field	Definition	Type	Required
Request Type	This is one of the supported HTTP request methods, or HTTP verbs, in a custom API call (see HTTP request methods). GET: Retrieves data from a web service based on parameters. This method requests a representation of the specified resource. If a request is successful, a 200 (OK) response message is returned with the requested content. POST: Sends data to a web service based on parameters (for example, uploading a file). Multiple POST requests may result in a different outcome than a single POST. Caution should be exercised to avoid sending multiple POST requests unintentionally. If a request is successful, a 200 (OK) response message is returned. PUT: Sends data to be stored at a specific location on a web server based on parameters (for example, uploading a file). Unlike POST requests, PUT requests are idempotent. For successful requests, the result of a single PUT request is the same as many identical PUT requests. If a request is successful, a 200 (OK), 201 (Created), or 204 (No Content) response message is returned. PATCH: Applies partial modifications to a resource on a web server based on parameters. PATCH is not idempotent. Multiple PATCH requests could have unintended consequences. If a PATCH is successful, a 200 (OK) or 204 (No Content) response message is returned. DELETE: Deletes the specified resource (if it exists) from the web server based on parameters. If a DELETE is successful, a 200 (OK) response message is returned.	Dropdown	TRUE

Inputs

Field	Definition	Type	Required
Relative URL	Specify the relative URL to the Kandji API. The input value is the text that follows /v1 in the URL. For example, if the full API endpoint URL is https://accuhive.api.kandji.io/api/v1/devices, then the input value is /devices. This is consistent with the API documentation relative path examples. You can specify query parameters in the relative URL using ? or specify the query parameters as an object key pair in the Query input.	String	TRUE
Query	Specify any additional query parameters that should be included in object format (key-value pairs).	Object	FALSE
Headers	Specify any headers required in addition to authorization or content-type (these are already handled by this connector).	Object	FALSE
Body	Specify a request body in JSON format.	Object	FALSE

Outputs

Field	Definition	Type
Status Code	Result of the operation. The Kandji connector returns the HTTP status and indicates whether the action taken by the card succeeded or failed.	Number
Headers	Detailed context for the status code unrelated to the output body. Response headers are dependent on your selected HTTP request option. Note that not all headers are response headers. This will usually be similar to {"Content-type":"application/json"}.	Object
Body	Data returned from the HTTP request. For example, the data from a GET request.	Object

Clear Passcode

Clear the iOS or iPadOS device passcode. An MDM command will be triggered. This is compatible only with iOS and iPadOS device types; all others will return a status code of 400.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

200 OK
400 Bad Request
- "Command already running" - The command may already be running in a Pending state waiting on the device.
- "Command is not allowed for current device" - The command may not be compatible with the target device.
401 Unauthorized
- Invalid access token. The HTTP request was not processed. This can happen if the token was revoked, the required permissions are missing, or the token has expired.
404 Not found
- Unable to locate the resource in the Kandji tenant.

For a full list of possible status codes, see HTTP status codes.

Text

Create Blueprint

Create a Blueprint.

Inputs

Field	Description	Type	Required
Name	Name of Blueprint. The name must be unique.	String	TRUE
Enrollment Code Is Active	Is the Blueprint enabled for manual device enrollment from the enrollment portal?	Boolean	TRUE
Enrollment Code	Optionally, set the enrollment code of the Blueprint. This key is not required and will function in the same way as the Kandji web app. If an enrollment code is not supplied in the payload body, it will be randomly generated. The enrollment code will be returned in the response and visible in the Kandji web app.	String	FALSE
Color	Set the color of the Blueprint icon. A list of possible color codes and their related HEX codes can be found here.	String	FALSE
Description	Description of the Blueprint.	String	FALSE
Icon	Set the Blueprint icon. A list of possible icon codes can be found here.	String	FALSE

Outputs

Field	Description	Type
Blueprint	JSON object for the new Blueprint.	Object
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example: 201 Created 400 Bad Request "This field must be unique.” - This means that the value has already been used. Make sure that the Blueprint name and enrollment code are unique. The enrollment code must be completely unique even if the associated Blueprint no longer exists in the Kandji tenant. 401 Unauthorized "Invalid access token." - This can happen if the token was revoked, the required permissions are missing, or the token has expired. 404 Not found Unable to locate the resource in the Kandji tenant.

Create Note

Create a note for a device.

Inputs

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the iOS or iPadOS device to send the MDM command to	String	TRUE
Note	Text contents of the note	String	TRUE

Outputs

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

201 Created
401 Unauthorized
- Invalid access token. This can happen if the token was revoked, the required permissions are missing, or the token has expired.
404 Not found
- Unable to locate the resource in the Kandji tenant.

For a full list of possible status codes, see HTTP status codes.

Number

Note

JSON object for the note

Object

Erase Device

Erase a device. An MDM command will be triggered. For a macOS device, you must provide a PIN which is exactly 6 digits.

Inputs

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the iOS or iPadOS device to send the MDM command to	String	TRUE
PIN	For macOS computers only: Unlock PIN, which will be required to use the device after an erase	Number, 6 digits	TRUE for macOS
PreserveDataPlan	For iOS and iPadOS only: Should the cellular data plan be preserved?	Boolean	TRUE for iOS and iPadOS
DisallowProximitySetup	For iOS and iPadOS only: Should proximity setup be allowed during Setup Assistant?	Boolean	TRUE for iOS and iPadOS

Outputs

Field

Description

Type

Unlock PIN

String

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

200 OK
400 Bad Request
- "Command already running" - The command may already be running in a Pending state waiting on the device.
- "Command is not allowed for current device" - The command may not be compatible with the target device.
401 Unauthorized
- Invalid access token. This can happen if the token was revoked, the required permissions are missing, or the token has expired.
404 Not found
- Unable to locate the resource in the Kandji tenant.

For a full list of possible status codes, see HTTP status codes.

Number

Get ADE Integration

Given an Automated Device Enrollment (ADE) integration token, return information about the integration.

Input

Field	Description	Type	Required
ADE Token ID	ID of Automated Device Enrollment Token	String	TRUE

Outputs

Field	Definition	Type
Default Blueprint ID	Blueprint ID	String
Default Blueprint Name	Blueprint name	String
Default Blueprint Color	Blueprint color	String
Default Blueprint Icon	Blueprint icon	String
Access Token Expiry	Token expiration	Date
Server Name	Name of server	String
Server UUID	Server universally unique identifier	String
Organization Name	Organization name	String
Organization Email	Organization email	String
Organization Phone	Organization phone	String
Stoken File Name	Stoken file name	String
Last Device Sync	Last sync	Date
Default Email	Email	String
Default Phone	Phone	String
Days Left	Amount of days left	Number
Status	Status	String
Status Reason	Status reason	String
Status Received At	Status received time	String
Apple TV Device Count	Number of Apple TV devices assigned	Number
iPad Device Count	Number of iPad devices assigned	Number
iPhone Device Count	Number of iPhone devices assigned	Number
Mac Device Count	Number of Mac devices assigned	Number
Total Device Count	Number of devices assigned	Boolean

Get Activation Lock Bypass Codes

Retrieve the Activation Lock Bypass code for a Mac.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of a Mac	String	TRUE

Outputs

Field	Description	Type
User-Based Activation Lock Bypass Code	User-based Activation Lock bypass code for when Activation Lock is enabled using a personal Apple ID and Find My	String
Device-Based Activation Lock Bypass Code	Device-based Activation Lock bypass code for when Activation Lock is enabled by the MDM server	String

Get Blueprint

Given a Blueprint ID, Blueprint name, or both, return the Blueprint.

Input

Field	Definition	Type	Required
Blueprint ID	ID of the Blueprint	String	FALSE
Blueprint Name	Blueprint name	String	FALSE

Outputs

Field	Definition	Type
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example: A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing. For a full list of possible status codes, see HTTP status codes.	String
ID	Blueprint ID	String
Name	Blueprint name	String
Icon	Blueprint icon	String
Color	Blueprint color	String
Description	Blueprint description	String
Parameters	JSON list of parameters for the Blueprint	List
Count	Number of devices assigned to the Blueprint	Number
Missing	Number of devices assigned to the Blueprint that are missing	Number
Enrollment Code	Enrollment code for manual enrollment	String
Enrollment Code Is Active	Whether the enrollment code is active	Boolean
Alerts Count	Number of alerts for the Blueprint	String

Get Device

Given a Device ID, return top-level or detailed information about the device.

Options

Field

Definition

Type

Required

Details

Choose the level of detail to return about the device.

Basic: Retrieves top-level details about the device
Full: Retries detailed information about the device

Dropdown

TRUE

Input

Field	Definition	Type	Required
Device ID	Kandji-specific device ID	String	TRUE

Outputs for Basic details option

Field	Definition	Type
Device
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Model	Device model	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
OS Version	Version of the OS	String
Last Check-in	Date of last MDM check-in	Date
Asset Tag	Asset tag	String
Blueprint ID	Blueprint ID the device is assigned to	String
MDM Enabled	Whether the device is enabled for MDM	Boolean
Agent Installed	Whether the Kandji Agent is installed	Boolean
Is Missing	Whether the device is missing from Kandji	Boolean
Is Removed	Whether the device was removed from Kandji	Boolean
Agent Version	Version of the Kandji Agent	String
First Enrollment	When the device was first enrolled with Kandji	Date
Last Enrollment	When the device was last enrolled with Kandji	Date
Blueprint Name	Name of the Blueprint the device is assigned to	String
User
Email	Email address of the user associated with the device	String
Name	Name of the user assigned to the device	String
User ID	Kandji-specific user ID of the user assigned to the device	Number
Is Archived	Whether the device is archived	Boolean

Outputs for Full details option

Field	Definition	Type
General
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Last Enrollment	Date of last enrollment	Date
First Enrollment	Date of first enrollment	Date
Model	Device model	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
OS Version	Version of the OS	String
System Version	Detailed version of the OS	String
Boot Volume	Name of boot volume	String
Time Since Boot	Time since last boot	Date
Last User	Name of the last user	String
Asset Tag	Asset tag	String
Assigned User	User assigned to the device	String
Blueprint Name	Name of the Blueprint the device is assigned to	String
Blueprint UUID	Unique ID of the Blueprint the device is assigned to	String
MDM
MDM Enabled	Whether the device is enabled for MDM	Boolean
Install Date	Date enrolled with MDM	Date
Last Check-in	Date of last MDM check-in	Date
MDM-enabled User	User enabled for MDM	Object
Activation Lock
Bypass Code Failed	Whether collecting the Activation Lock bypass code failed	Boolean
User Activation Lock Enabled	Whether user-level Activation Lock is enabled	Boolean
Device Activation Lock Enabled	Whether device-level Activation Lock is enabled	Boolean
Activation Lock Allowed While Supervised	Whether Activation Lock is allowed while the device is supervised	Boolean
Activation Lock Supported	Whether Activation Lock is supported for the device	Boolean
FileVault
FileVault Enabled	Whether FileVault is enabled	Boolean
FileVault Recovery Key Type	FileVault recovery key type (Personal or Institutional)	String
FileVault Personal Recovery Key Escrowed	Whether the FileVault personal recovery key is escrowed	Boolean
FileVault Next Rotation	When the FileVault recovery key should be rotated next	Date
FileVault Regeneration Required	Whether the FileVault recovery key needs to be regenerated and rotated	Boolean
Automated Device Enrollment
Auto Enroll Eligible	Whether the device is eligible for Automated Device Enrollment	Boolean
Auto Enrolled	Whether the device was enrolled using Automated Device Enrollment	Boolean
Kandji Agent
Agent Installed	Whether the Kandi Agent is installed	Boolean
Install Date	Date the Kandji Agent was installed	Date
Last Check-in	Date the Kandji Agent last checked in	Date
Agent Version	Version of the Kandji Agent	String
Hardware Overview
Model Name	Apple model name	String
Model Identifier	Apple model identifier	String
Processor Name	Name of the device processor	String
Processor Speed	Speed of the device processor	String
Number of Processors	Number of processors	String
Total Number of Cores	Number of cores	String
Memory	RAM memory	String
UDID	Unique device identifier	String
Volumes
Volumes	JSON list of volumes on the device	Object
Network
Local Hostname	Local hostname	String
MAC Address	MAC address	String
IP Address	IPv4 address	String
Public IP	IPv4 address (as appears to the Kandji service through Network Address Translation)	String
Recovery Information
Recovery Lock Enabled	Whether the Mac recovery lock is enabled	Boolean
Firmware Password Exists	Whether a firmware password is enabled for an Intel-based Mac	Boolean
Firmware Password Pending	Whether a firmware password is pending for an Intel-based Mac	Boolean
Password Rotation Scheduled	Date scheduled to rotate the firmware password for an Intel-based Mac	Date
Users
Regular Users	JSON list of non-system users	List
System Users	JSON list of system users	List
Installed Profiles
Installed Profiles	JSON list of profiles installed on the device	List
Apple Business Manager
Model	Model as defined in Apple Business Manager	String
Color	Color as defined in Apple Business Manager	String
Description	Description as defined in Apple Business Manager	String
Serial Number	Serial number of device	String
Device Family	Device family as defined in Apple Business Manager	String
OS	OS as defined in Apple Business Manager	String
Device Assigned Date	Date assigned to Kandji in Apple Business Manager	Date
Device Assigned By	Managed Apple ID in Apple Business Manager that assigned the device to Kandji	String
Apple Remote Desktop Turned On
Apple Remote Desktop Turned On	Whether Apple Remote Desktop is turned on for a Mac	Boolean

Get FileVault Recovery Key

Get the FileVault Recovery Key for a Mac.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of a Mac	String	TRUE

Output

Field	Description	Type
Key	FileVault recovery key	String

Get Unlock PIN

Get the PIN for a locked Mac.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of a Mac	String	TRUE

List ADE Integrations

Return a list of configured Automated Device Enrollment (ADE) integrations.

Options

Field

Definition

Type

Required

Result Set

Whether to return results directly or to stream results. Options include:

• First 200 Records.

• Stream All Records. If you choose streaming, you must select a Helper Flow to run for every ADE Integration.

Dropdown

TRUE

Outputs

Field

Definition

Type

Results

JSON list of objects, one object per ADE Integration

Appears when First 200 Records is selected from the Result Set option.

List

Record Count

Number of ADE Integrations
Appears when Stream All Records is selected from the Result Set option.

Number

List ADE Devices

Given an Automated Device Enrollment (ADE) integration token, return a list of all devices associated with that token, as well as their enrollment status. When the mdm_device key value is null, this indicates that the device is awaiting enrollment into Kandji.

Options

Field

Definition

Type

Required

Result Set

Whether to return results directly or to stream results. Options include:

• First 300 Records.

• Stream All Records. If you choose streaming, you must select a Helper Flow to run for every ADE Device.

Dropdown

TRUE

Inputs

Field	Description	Type	Required
ADE Token ID	ID of ADE Token	String	TRUE

Outputs

Field

Definition

Type

Results

JSON list of objects, one object per ADE Device

Appears when First 300 Records is selected from the Result Set option.

List

Record Count

Number of ADE Devices
Appears when Stream All Records is selected from the Result Set option.

Number

List Blueprints

List Blueprints.

Options

Field

Definition

Type

Required

Result Set

Whether to return results directly or to stream results. Options include:

• First 200 Records.

• Stream All Records. If you choose streaming, you must select a Helper Flow to run for every Blueprint.

Dropdown

TRUE

Outputs

Field

Definition

Type

Results

JSON list of objects, one object per Blueprint

Appears when First 200 Records is selected from the Result Set option.

List

Record Count

Number of Blueprints
Appears when Stream All Records is selected from the Result Set option.

Number

List Device Apps

Given a Device ID, return a list of all installed apps for the device. For iOS, iPadOS, and tvOS, this lists third-party apps installed on this device. Built-in iOS, iPadOS, and tvOS apps are not inventoried.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID	String	TRUE

Output

Field	Description	Type
Apps	List of JSON objects, one object per app	List

List Device Library Items

Given a Device ID, return a list of all the Library Items and their statuses for the device.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID	String	TRUE

Output

Field	Description	Type
Items List	List of JSON objects, one object per Library Item	List

List Device Notes

Given a Device ID, return a list of all the Library Items and their statuses for the device.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID	String	TRUE

Output

Field	Description	Type
Items List	List of JSON objects, one object per Library Item	List

List Devices

Get a list of all enrolled devices. Optional query parameters can be specified to filter the results. All search fields are optional.

Options

Field

Definition

Type

Required

Result Set

Whether to return results directly or to stream results. Options include:

• First Matching Record

• First 200 Matching Records

• Stream Matching Records. If you choose streaming, you must choose a Helper flow to run for every device.

Dropdown

TRUE

Inputs

Field	Description	Type	Required
User Email	Email address of the user associated with the device contains the specified string; this returns all email addresses that contain the string	String	FALSE
User Email - Exact	Exact email address of the user associated with the device	String	FALSE
User Name	Name of the user assigned to the device	String	FALSE
Kandji User ID	Kandji-specific user ID of the user assigned to the device	Number	FALSE
Device ID	Kandji-specific device ID	String	FALSE
Device Name	Device name	String	FALSE
Serial Number	Device serial number	String	FALSE
MAC Address	MAC Address of the primary network interface of the device	String	FALSE
Asset Tag	Asset tag	String	FALSE
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String	FALSE
Model	Device model	String	FALSE
OS Version	Version of the OS	String	FALSE
Blueprint ID	ID of the Blueprint the device is assigned to	String	FALSE

Outputs

Field	Definition	Type
The following appear when First Matching Record is selected from the Result Set field.
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Model	Device model	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
OS Version	Version of the OS	String
Last Check-in	Date of last MDM check-in	Date
User	JSON object for assigned Kandji user	Object
Asset Tag	Asset tag	String
Blueprint ID	Blueprint ID the device is assigned to	String
Agent Installed	Whether the Kandji Agent is installed	Boolean
Is Missing	Whether the device is missing from Kandji	Boolean
Is Removed	Whether the device was removed from Kandji	Boolean
Agent Version	Version of the Kandji Agent	String
First Enrollment	When the device was first enrolled with Kandji	Date
Last Enrollment	When the device was last enrolled with Kandji	Date
Blueprint Name	Name of the Blueprint the device is assigned to	String
Devices	JSON list of objects, one object per device Appears when First 200 Records is selected from the Result Set field.	List

Output for "First 200 Matching Records"

Field	Definition	Type
Devices	JSON list of objects, one object per device	List

Lock Device

Send an MDM command to lock a device. For a Mac computer, a 6-digit PIN will be returned.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the Mac computer to send the MDM command to	String	TRUE

Outputs

Field

Description

Type

Lock PIN for Mac computer

String

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

200 OK
400 Bad Request
- "Command already running" - The command may already be running in a Pending state waiting on the device.
401 Unauthorized
- Invalid access token. This can happen if the token was revoked, the required permissions are missing, or the token has expired.
404 Not found
- Unable to locate the resource in the Kandji tenant.

For a full list of possible status codes, see HTTP status codes.

Number

Manage Apple Remote Desktop

Use MDM to turn on or turn off Apple Remote Desktop for a Mac.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the Mac computer to send the MDM command to	String	TRUE
Manage Remote Desktop	Send an MDM command to control the Remote Management status on a Mac. This MDM command turns Remote Management on or off with Observe and Control permissions given to all users.	Dropdown	TRUE

Outputs

Field	Description	Type
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example: 200 OK 400 Bad Request See Body below 401 Unauthorized Invalid access token. This can happen if the token was revoked, the required permissions are missing, or the token has expired. 404 Not found Unable to locate the resource in the Kandji tenant. For a full list of possible status codes, see HTTP status codes.	String
Body	Potential explanation for a 400 Bad Requestresult: "Command already running": The command may already be running in a Pending state waiting on the device. "Command is not allowed for current device": Remote Desktop may already be in the desired configuration on the Mac or the command may not be compatible with the target device.	String

Play Lost Mode Sound

Send the MDM command to an iOS or iPadOS device in Lost Mode to play the Lost Mode sound. The sound plays until two minutes have elapsed, Lost Mode is turned off on the device or the user turns off the sound on the device.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of a Mac	String	TRUE

Outputs

Field	Description	Type
Device ID	Kandji-specific device ID of a Mac	String
Device Name	Device name	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
User Email	Email address of the user associated with the device	String
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed.	String
Message	Message	String

Reinstall Kandji Agent

Reinstall the Kandji Agent. An MDM command will be triggered. This request is only applicable to Mac computers.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the Mac computer to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Restart Device

Restart a device. An MDM command will be triggered.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Send MDM Blank Push

Initiate a blank MDM push. An MDM command will be triggered.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Set Device Name

Send an MDM command to set the device name.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE
Device Name	Name to assign to the device	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Shutdown Device

Shut down a device. An MDM command will be triggered.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Turn Off Lost Mode

Turn off Managed Lost Mode for an iOS or iPadOS device.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE
Device Name	Device name	String	TRUE
Serial Number	Serial number	String	TRUE
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String	TRUE
User Email	Email address of the user associated with the device	String	TRUE
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed.	String	TRUE
Message	Message to be displayed on the lock screen	String	TRUE

Turn On Lost Mode

Turn on Managed Lost Mode for an iOS or iPadOS device. In addition to providing the Device ID, you must enter at least a Lock Message or Phone Number.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE
Lock Message	Lock message	String	FALSE
Phone Number	Phone number	String	FALSE
Footnote	Footnote	String	FALSE

Output

Field	Description	Type
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
User Email	Email address of the user associated with the device	String
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed.	Number
Message	Message	String

Unlock User Account

Unlock a locked Mac user account. An MDM command will be triggered.

Inputs

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the Mac computer to send the MDM command to	String	TRUE
Username	User name of the local account to unlock	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Update Device

Update information about a device, including the assigned Blueprint, user, and asset tag. You must include the Device ID and one of the three optional inputs.

Inputs

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to update	String	TRUE
Blueprint ID	Blueprint ID to assign the device to	String	FALSE
Kandji User ID	Kandji-specific user ID of the user to assign the device to	Number	FALSE
Asset tag	Asset tag to assign to the device	String	FALSE

Outputs

Field	Description	Type
Device
Status	Status of the request	Number
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Model	Device model	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
OS Version	Version of the OS	String
Last Check-in	Date of last MDM check-in	Date
Asset Tag	Asset tag	String
Blueprint ID	Blueprint ID the device is assigned to	String
MDM Enabled	Whether the device is enabled for MDM	Boolean
Agent Installed	Whether the Kandji Agent is installed	Boolean
Is Missing	Whether the device is missing from Kandji	Boolean
Is Removed	Whether the device was removed from Kandji	Boolean
Agent Version	Version of the Kandji Agent	String
First Enrollment	When the device was first enrolled with Kandji	Date
Last Enrollment	When the device was last enrolled with Kandji	Date
Blueprint Name	Name of the Blueprint the device is assigned to	String
User
User Email	Email address of the user associated with the device	String
User Name	Name in Kandji of the user assigned to the device	String
User ID	Kandji-specific user ID of the user to assign the device to	Number
User is Archived	Whether the user is archived	Boolean

Update Inventory

Start an MDM check-in for a device, initiating the daily MDM commands and MDM logic.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number

Turn Off Lost Mode

Turn off Managed Lost Mode for an iOS or iPadOS device.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE
Device Name	Lock message	String	TRUE
Serial Number	Phone number	String	TRUE
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String	TRUE
User Email	Email address of the user associated with the device	String	TRUE
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed.	String	TRUE
Message	Message to be displayed on lock screen	String	TRUE

Update Lost Mode Location

Send the MDM command to an iOS or iPadOS device in Lost Mode to update the location data.

Input

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the device to send the MDM command to	String	TRUE

Output

Field	Description	Type
Device ID	Kandji-specific device ID	String
Device Name	Device name	String
Serial Number	Device serial number	String
Platform	Apple platform (such as Mac, iPhone, iPad, AppleTV)	String
User Email	Email address of the user associated with the device	String
Status Code	Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed.	Number
Message	Message	String

Unlock User Account

Unlock a locked Mac user account. An MDM command will be triggered.

Inputs

Field	Description	Type	Required
Device ID	Kandji-specific device ID of the Mac computer to send the MDM command to	String	TRUE
Username	User name of the local account to unlock	String	TRUE

Output

Field

Description

Type

Status Code

Result of the operation. The HTTP status code is returned by the connector and indicates whether the action taken by the card succeeded or failed. For example:

A 401 Unauthorized error indicates that the HTTP request was not processed because the necessary permissions were missing.

For a full list of possible status codes, see HTTP status codes.

Number