Depot maintenance

Registers the planned-work routes on the TENANT mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/maintenance-windows

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMaintenanceWindows pages the schedule, furthest-future first.

THE TOTAL IS THE FILTERED TOTAL, which is the difference between this and what it replaced: the envelope used to report the page’s own length, so a search matching three hundred windows still said fifty and the pager stopped one page in.

Parameters

Name	In	Type	Required	Description
dir	query	string, one of asc, desc	No	Sort direction.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
sort	query	string, one of created, scheduled, title, updated	No	Sort key.

Responses

Status	Body	Description
200	application/json, PagedResultMaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
itemsrequired	array of MaintenanceWindowView
items[].autoTransitionrequired	boolean
items[].body	string
items[].completedAt	string (date-time) or null
items[].components	array of StatusComponentView
items[].components[].createdAtrequired	string (date-time)
items[].components[].description	string
items[].components[].groupName	string
items[].components[].namerequired	string
items[].components[].publicIdrequired	string
items[].components[].showUptimerequired	boolean
items[].components[].sortOrderrequired	integer
items[].components[].statusrequired	string
items[].components[].updatedAtrequired	string (date-time)
items[].createdAtrequired	string (date-time)
items[].publicIdrequired	string
items[].scheduledEndAtrequired	string (date-time)
items[].scheduledStartAtrequired	string (date-time)
items[].startedAt	string (date-time) or null
items[].statusrequired	string
items[].titlerequired	string
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/maintenance-windows"
params = {
    "dir": "asc",
    "page": "0",
    "pageSize": "0",
    "q": "<q>",
    "sort": "created",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/maintenance-windows");
url.searchParams.set("dir", "asc");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("q", "<q>");
url.searchParams.set("sort", "created");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/maintenance-windows?dir=asc&page=0&pageSize=0&q=<q>&sort=created");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/maintenance-windows

POSTincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create maintenance window

Request body

Required, sent as application/json.

Field	Type	Description
autoTransition	boolean or null
body	string or null
componentIdsrequired	array of string
scheduledEndAt	string (date-time) or null
scheduledStartAt	string (date-time) or null
title	string or null

Responses

Status	Body	Description
201	application/json, MaintenanceWindowView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
503	application/problem+json, ProblemDetails	The request was refused.

201 response body

Field	Type	Description
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/maintenance-windows' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/maintenance-windows' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/maintenance-windows"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "autoTransition": False,
    "body": "string",
    "componentIds": [
        "string",
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/maintenance-windows", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/maintenance-windows";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "autoTransition": false,
    "body": "string",
    "componentIds": [
      "string"
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/maintenance-windows");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/maintenance-windows/{maintenanceId}

GETincident:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getMaintenanceWindow answers the detail read, components included.

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/maintenance-windows/{maintenanceId}

PATCHincident:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

patchMaintenanceWindow edits the announcement.

It cannot move the status; see decision 1 in the file header.

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
autoTransition	boolean or null
body	string or null
componentIdsrequired	array of string
scheduledEndAt	string (date-time) or null
scheduledStartAt	string (date-time) or null
title	string or null

Responses

Status	Body	Description
200	application/json, MaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "autoTransition": False,
    "body": "string",
    "componentIds": [
        "string",
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "autoTransition": false,
    "body": "string",
    "componentIds": [
      "string"
    ],
    "scheduledEndAt": "2026-01-01T00:00:00Z",
    "scheduledStartAt": "2026-01-01T00:00:00Z",
    "title": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "autoTransition": false,
  "body": "string",
  "componentIds": [
    "string"
  ],
  "scheduledEndAt": "2026-01-01T00:00:00Z",
  "scheduledStartAt": "2026-01-01T00:00:00Z",
  "title": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/maintenance-windows/{maintenanceId}/transition

POSTincident:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

transitionMaintenanceWindow moves a window and stamps what actually happened.

A refused move is 409 and not 400: nothing about the request is malformed, and the same body would have been accepted before somebody else pressed the button.

Parameters

Name	In	Type	Required	Description
maintenanceId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
at	string (date-time) or null
status	string or null

Responses

Status	Body	Description
200	application/json, MaintenanceWindowView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold incident:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
503	application/problem+json, ProblemDetails	The request was refused.

200 response body

Field	Type	Description
autoTransitionrequired	boolean
body	string
completedAt	string (date-time) or null
components	array of StatusComponentView
components[].createdAtrequired	string (date-time)
components[].description	string
components[].groupName	string
components[].namerequired	string
components[].publicIdrequired	string
components[].showUptimerequired	boolean
components[].sortOrderrequired	integer
components[].statusrequired	string
components[].updatedAtrequired	string (date-time)
createdAtrequired	string (date-time)
publicIdrequired	string
scheduledEndAtrequired	string (date-time)
scheduledStartAtrequired	string (date-time)
startedAt	string (date-time) or null
statusrequired	string
titlerequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "at": "2026-01-01T00:00:00Z",
    "status": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "at": "2026-01-01T00:00:00Z",
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "at": "2026-01-01T00:00:00Z",
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/maintenance-windows/<maintenanceId>/transition");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());