Depot catalog

Registers the read-only catalog routes on mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/settings/catalog

GETcatalog:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List setting catalog

Parameters

Name	In	Type	Required	Description
category	query	string	No
framework	query	string	No
includeDeprecated	query	string	No
os	query	string	No
q	query	string	No

Responses

Status	Body	Description
200	application/json, CatalogResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold catalog:read.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
countrequired	integer
loadedAt	string (date-time) or null
settingsrequired	array of SettingDefinitionView
settings[].allowedOptions	any	Arbitrary JSON.
settings[].backendsrequired	array of SettingBackendView
settings[].backends[].mechanismrequired	string
settings[].backends[].notes	string
settings[].backends[].osFamilyrequired	string
settings[].backends[].path	string
settings[].backends[].valueTransform	any	Arbitrary JSON.
settings[].baselinesrequired	array of SettingBaselineView
settings[].baselines[].citation	string
settings[].baselines[].enforcementrequired	string
settings[].baselines[].frameworkrequired	string
settings[].baselines[].level	string
settings[].baselines[].recommendedValuerequired	any	Arbitrary JSON.
settings[].catalogVersionrequired	integer
settings[].categoryrequired	string
settings[].defaultValuerequired	any	Arbitrary JSON.
settings[].descriptionrequired	string
settings[].isDeprecatedrequired	boolean
settings[].keyrequired	string
settings[].mandatoryablerequired	boolean
settings[].mdmEquivalentKey	string
settings[].mergeRulerequired	string
settings[].secretPathsrequired	array of string
settings[].valueSchema	any	Arbitrary JSON.
settings[].valueTyperequired	string
versionrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/settings/catalog?category=<category>&framework=<framework>&includeDeprecated=<includeDeprecated>&os=<os>&q=<q>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/settings/catalog?category=<category>&framework=<framework>&includeDeprecated=<includeDeprecated>&os=<os>&q=<q>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/settings/catalog"
params = {
    "category": "<category>",
    "framework": "<framework>",
    "includeDeprecated": "<includeDeprecated>",
    "os": "<os>",
    "q": "<q>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/settings/catalog?category=<category>&framework=<framework>&includeDeprecated=<includeDeprecated>&os=<os>&q=<q>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/settings/catalog");
url.searchParams.set("category", "<category>");
url.searchParams.set("framework", "<framework>");
url.searchParams.set("includeDeprecated", "<includeDeprecated>");
url.searchParams.set("os", "<os>");
url.searchParams.set("q", "<q>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/settings/catalog?category=<category>&framework=<framework>&includeDeprecated=<includeDeprecated>&os=<os>&q=<q>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/settings/catalog/{settingKey}

GETcatalog:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get setting catalog entry

Parameters

Name	In	Type	Required	Description
settingKey	path	string	Yes

Responses

Status	Body	Description
200	application/json, SettingDefinitionView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold catalog:read.
404	application/problem+json, ProblemDetails	No setting matches that key.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
allowedOptions	any	Arbitrary JSON.
backendsrequired	array of SettingBackendView
backends[].mechanismrequired	string
backends[].notes	string
backends[].osFamilyrequired	string
backends[].path	string
backends[].valueTransform	any	Arbitrary JSON.
baselinesrequired	array of SettingBaselineView
baselines[].citation	string
baselines[].enforcementrequired	string
baselines[].frameworkrequired	string
baselines[].level	string
baselines[].recommendedValuerequired	any	Arbitrary JSON.
catalogVersionrequired	integer
categoryrequired	string
defaultValuerequired	any	Arbitrary JSON.
descriptionrequired	string
isDeprecatedrequired	boolean
keyrequired	string
mandatoryablerequired	boolean
mdmEquivalentKey	string
mergeRulerequired	string
secretPathsrequired	array of string
valueSchema	any	Arbitrary JSON.
valueTyperequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/settings/catalog/<settingKey>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/settings/catalog/<settingKey>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/settings/catalog/<settingKey>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/settings/catalog/<settingKey>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/settings/catalog/<settingKey>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/settings/catalog/<settingKey>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());