Depot commands

Registers the command dispatch + status routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/endpoints/{agentID}/commands

GETendpoint:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List commands

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
200	application/json, PagedResultCommandSummary	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold endpoint:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
itemsrequired	array of CommandSummary
items[].commandIdrequired	string
items[].idempotencyKeyrequired	string
items[].staterequired	string
items[].targetAgentIdrequired	string
items[].typerequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/endpoints/<agentID>/commands?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/commands?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/commands"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/endpoints/<agentID>/commands?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/endpoints/<agentID>/commands");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/endpoints/<agentID>/commands?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/endpoints/{agentID}/commands

POSTcommand:executetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

enqueueCommand validates a run_script request, persists the Command, and pushes a CommandDispatch to the agent’s live stream, advancing the command to “dispatched” on delivery.

When the agent is offline the command is left “pending” and the response reports delivered=false.

A “pending” command IS delivered when the agent reconnects: the telemetry stream drains ListDeliverableCommandsForAgent on registration, and anything past its ExpiresAt flips to “expired” rather than being delivered late. The 202 still reports delivered=false so the console can say “waiting for the endpoint” instead of implying the script has already run.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
argsrequired	array of string
idempotencyKeyrequired	string
interpreterrequired	string
maxOutputBytesrequired	integer	int64.
paramValuesrequired	object
runAsSystemrequired	boolean
runAsUserrequired	string
scriptrequired	string
scriptIdrequired	string
timeoutSecondsrequired	integer
ttlHoursrequired	integer

Responses

Status	Body	Description
202	application/json, CommandAccepted	Accepted.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	Endpoint not found.
409	application/problem+json, ProblemDetails	That idempotency key already belongs to a command on a different endpoint. Use a key of its own for each endpoint you are dispatching to.
422	application/problem+json, ProblemDetails	The request was refused.
500	application/problem+json, ProblemDetails	No client context in request.
502	application/problem+json, ProblemDetails	Could not dispatch command to agent.
503	application/problem+json, ProblemDetails	The script library is not available on this Depot.

202 response body

Field	Type	Description
commandIdrequired	string
deliveredrequired	boolean
staterequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/commands' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "args": [
    "string"
  ],
  "idempotencyKey": "string",
  "interpreter": "string",
  "maxOutputBytes": 0,
  "paramValues": {
    "key": "string"
  },
  "runAsSystem": false,
  "runAsUser": "string",
  "script": "string",
  "scriptId": "string",
  "timeoutSeconds": 0,
  "ttlHours": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "args": [
    "string"
  ],
  "idempotencyKey": "string",
  "interpreter": "string",
  "maxOutputBytes": 0,
  "paramValues": {
    "key": "string"
  },
  "runAsSystem": false,
  "runAsUser": "string",
  "script": "string",
  "scriptId": "string",
  "timeoutSeconds": 0,
  "ttlHours": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/commands' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/commands"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "args": [
        "string",
    ],
    "idempotencyKey": "string",
    "interpreter": "string",
    "maxOutputBytes": 0,
    "paramValues": {
        "key": "string",
    },
    "runAsSystem": False,
    "runAsUser": "string",
    "script": "string",
    "scriptId": "string",
    "timeoutSeconds": 0,
    "ttlHours": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "args": [
    "string"
  ],
  "idempotencyKey": "string",
  "interpreter": "string",
  "maxOutputBytes": 0,
  "paramValues": {
    "key": "string"
  },
  "runAsSystem": false,
  "runAsUser": "string",
  "script": "string",
  "scriptId": "string",
  "timeoutSeconds": 0,
  "ttlHours": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/commands", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/commands";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "args": [
      "string"
    ],
    "idempotencyKey": "string",
    "interpreter": "string",
    "maxOutputBytes": 0,
    "paramValues": {
      "key": "string"
    },
    "runAsSystem": false,
    "runAsUser": "string",
    "script": "string",
    "scriptId": "string",
    "timeoutSeconds": 0,
    "ttlHours": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "args": [
    "string"
  ],
  "idempotencyKey": "string",
  "interpreter": "string",
  "maxOutputBytes": 0,
  "paramValues": {
    "key": "string"
  },
  "runAsSystem": false,
  "runAsUser": "string",
  "script": "string",
  "scriptId": "string",
  "timeoutSeconds": 0,
  "ttlHours": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/commands");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/endpoints/{agentID}/commands/{commandID}

GETendpoint:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get command

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
commandID	path	string	Yes

Responses

Status	Body	Description
200	application/json, CommandDetail	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold endpoint:read.
404	application/problem+json, ProblemDetails	Command not found.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
commandIdrequired	string
idempotencyKeyrequired	string
paramsrequired	any	Arbitrary JSON.
result	CommandResultView	commandResultView is the terminal (or in-progress) result of a command.
result.completedAt	string (date-time) or null
result.exitCoderequired	integer
result.startedAt	string (date-time) or null
result.staterequired	string
result.stderrrequired	string
result.stdoutrequired	string
staterequired	string
targetAgentIdrequired	string
typerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/endpoints/<agentID>/commands/<commandID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());