---
title: "Depot mdmactions"
description: "Every mdmactions operation in the Depot API, with parameters, responses and code samples in six languages."
url: "https://support.outpostplatform.com/api/generated/depot/mdmactions/"
product: "depot"
type: "reference"
status: "reviewed"
last_reviewed: 2026-11-06
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/depot/mdmactions.mdx"
license: "CC BY 4.0"
---

# Depot mdmactions

Registers the device action, destructive, bulk lock and activate routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

### POST `/api/v1/endpoints/{agentID}/mdm/actions/{action}` {#depot.mdmactions.postMdmAction}

**postMdmAction sends an everyday MDM command (restart, lock, locate, lost mode, rename, ...) to a device and returns the queued command.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `action` | path | string | Yes |  |
| `agentID` | path | string | Yes | A uuid. |

#### Request body

Required, sent as `application/json`.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, MdmDiagnosticsRequested | Success. |
| `202` | `application/json`, MdmAgentActionResult | Accepted. |
| `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold mdm:command. |
| `404` | `application/problem+json`, ProblemDetails | No such device action. |
| `409` | `application/problem+json`, ProblemDetails | This device is not enrolled in device management. |
| `500` | `application/problem+json`, ProblemDetails | No client context in request. |
| `503` | `application/problem+json`, ProblemDetails | Collecting diagnostics needs file storage and the device management address configured on this Depot. |

#### Request samples

```bash
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}'
```

```powershell
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "params": {
        "deviceName": "string",
        "disallowProximitySetup": False,
        "footnote": "string",
        "keepUserData": False,
        "message": "string",
        "notifyUser": False,
        "phoneNumber": "string",
        "pin": "string",
        "preserveDataPlan": False,
        "protected": False,
        "returnToService": False,
        "type": "string",
        "wipeExternalStorage": False,
    },
    "reason": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := []byte(`{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}`)

	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-CSRF-Token", "<csrf-token>")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-CSRF-Token": "<csrf-token>",
		"Accept": "application/json",
		"Content-Type": "application/json",
	},
	credentials: "include",
	body: JSON.stringify({
		"params": {
			"deviceName": "string",
			"disallowProximitySetup": false,
			"footnote": "string",
			"keepUserData": false,
			"message": "string",
			"notifyUser": false,
			"phoneNumber": "string",
			"pin": "string",
			"preserveDataPlan": false,
			"protected": false,
			"returnToService": false,
			"type": "string",
			"wipeExternalStorage": false
		},
		"reason": "string"
	}),
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/actions/<action>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/v1/endpoints/{agentID}/mdm/activate` {#depot.mdmactions.postMdmActivate}

**postMdmActivate activates a device held over the plan's mobile cap (R83).**

The cap is asked again, without the held device in the count: still no room is the plan's 402 and nothing changes. With room the enrollment goes active, is audited, is handed to the reconciler so Outpost's policy reaches it, and its held alert resolves. A device that is not held is 409.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes | A uuid. |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, MdmEnrollmentView | Success. |
| `400` | `application/problem+json`, ProblemDetails | One or more validation errors occurred. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold mdm:manage. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |
| `409` | `application/problem+json`, ProblemDetails | This device is not enrolled in device management. |
| `500` | `application/problem+json`, ProblemDetails | No client context in request. |

#### Request samples

```bash
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'
```

```powershell
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-CSRF-Token", "<csrf-token>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-CSRF-Token": "<csrf-token>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/activate");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/v1/endpoints/{agentID}/mdm/destructive/{action}` {#depot.mdmactions.postMdmDestructive}

**postMdmDestructive requests a wipe, Activation Lock clear, passcode clear, unenroll or Fresh Start.**

200 with the command when it may run now; 202 with the approval when the practice's two-person rule needs a second technician. A Windows wipe or Fresh Start ends the PC's device management once the PC acknowledges it (R112c). For Fresh Start: the PC will need to enroll in MDM again afterwards. If the Outpost agent is installed, it stays, and you can re-enroll it with Enroll in Windows MDM.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `action` | path | string | Yes |  |
| `agentID` | path | string | Yes | A uuid. |

#### Request body

Required, sent as `application/json`.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, MdmActionResult | Success. |
| `202` | `application/json`, MdmApprovalResult | Accepted. |
| `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold mdm:wipe. |
| `404` | `application/problem+json`, ProblemDetails | No such device action. |
| `409` | `application/problem+json`, ProblemDetails | This device is not enrolled in device management. |
| `500` | `application/problem+json`, ProblemDetails | No client context in request. |

#### Request samples

```bash
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}'
```

```powershell
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "params": {
        "deviceName": "string",
        "disallowProximitySetup": False,
        "footnote": "string",
        "keepUserData": False,
        "message": "string",
        "notifyUser": False,
        "phoneNumber": "string",
        "pin": "string",
        "preserveDataPlan": False,
        "protected": False,
        "returnToService": False,
        "type": "string",
        "wipeExternalStorage": False,
    },
    "reason": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := []byte(`{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}`)

	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-CSRF-Token", "<csrf-token>")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-CSRF-Token": "<csrf-token>",
		"Accept": "application/json",
		"Content-Type": "application/json",
	},
	credentials: "include",
	body: JSON.stringify({
		"params": {
			"deviceName": "string",
			"disallowProximitySetup": false,
			"footnote": "string",
			"keepUserData": false,
			"message": "string",
			"notifyUser": false,
			"phoneNumber": "string",
			"pin": "string",
			"preserveDataPlan": false,
			"protected": false,
			"returnToService": false,
			"type": "string",
			"wipeExternalStorage": false
		},
		"reason": "string"
	}),
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "params": {
    "deviceName": "string",
    "disallowProximitySetup": false,
    "footnote": "string",
    "keepUserData": false,
    "message": "string",
    "notifyUser": false,
    "phoneNumber": "string",
    "pin": "string",
    "preserveDataPlan": false,
    "protected": false,
    "returnToService": false,
    "type": "string",
    "wipeExternalStorage": false
  },
  "reason": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/destructive/<action>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/v1/mdm/bulk-actions/lock` {#depot.mdmactions.postMdmBulkLock}

**postMdmBulkLock locks up to 500 devices.**

Below the practice's bulk lock threshold the locks go out now (200); at or above it a second technician must approve (202).

#### Request body

Required, sent as `application/json`.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, BulkLockResult | Success. |
| `202` | `application/json`, MdmApprovalResult | Accepted. |
| `400` | `application/problem+json`, ProblemDetails | The request body is not valid JSON. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold mdm:wipe. |
| `404` | `application/problem+json`, ProblemDetails | Endpoint not found. |
| `409` | `application/problem+json`, ProblemDetails | This device is not enrolled in device management. |
| `500` | `application/problem+json`, ProblemDetails | No client context in request. |

#### Request samples

```bash
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/bulk-actions/lock' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "agentIds": [
    "string"
  ],
  "message": "string",
  "phoneNumber": "string",
  "reason": "string"
}'
```

```powershell
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "agentIds": [
    "string"
  ],
  "message": "string",
  "phoneNumber": "string",
  "reason": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/bulk-actions/lock' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/bulk-actions/lock"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "agentIds": [
        "string",
    ],
    "message": "string",
    "phoneNumber": "string",
    "reason": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := []byte(`{
  "agentIds": [
    "string"
  ],
  "message": "string",
  "phoneNumber": "string",
  "reason": "string"
}`)

	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/bulk-actions/lock", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-CSRF-Token", "<csrf-token>")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/bulk-actions/lock";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-CSRF-Token": "<csrf-token>",
		"Accept": "application/json",
		"Content-Type": "application/json",
	},
	credentials: "include",
	body: JSON.stringify({
		"agentIds": [
			"string"
		],
		"message": "string",
		"phoneNumber": "string",
		"reason": "string"
	}),
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "agentIds": [
    "string"
  ],
  "message": "string",
  "phoneNumber": "string",
  "reason": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/bulk-actions/lock");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```