Depot mdmapprovals

Registers the approval inbox and decision routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/mdm/approvals

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmApprovals lists two-person approval requests, newest first.

?state= narrows by state (comma-separated).

Parameters

Name	In	Type	Required	Description
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
state	query	string, one of approved, canceled, executed, expired, overridden, pending, rejected	No	Comma-separated set. An unrecognised value is refused.

Responses

Status	Body	Description
200	application/json, PagedResultApprovalView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mdm:read.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
itemsrequired	array of ApprovalView
items[].amountCents	integer or null	int64.
items[].awaitingrequired	array of ApprovalAwaitingView
items[].awaiting[].memberIdrequired	string
items[].awaiting[].namerequired	string
items[].bodyrequired	string
items[].canDeciderequired	boolean
items[].canRespondrequired	boolean
items[].consentTextrequired	string
items[].consentVersionrequired	integer
items[].currency	string or null
items[].dueAt	string (date-time) or null
items[].idrequired	string
items[].kindrequired	string
items[].projectId	string or null
items[].quorumrequired	string
items[].raisedAtrequired	string (date-time)
items[].raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
items[].raisedBy.kindrequired	string
items[].raisedBy.label	string or null
items[].raisedBy.refrequired	string
items[].resolvedAt	string (date-time) or null
items[].responsesrequired	array of ApprovalResponseView
items[].responses[].comment	string or null
items[].responses[].decisionrequired	string
items[].responses[].idrequired	string
items[].responses[].memberIdrequired	string
items[].responses[].memberNamerequired	string
items[].responses[].respondedAtrequired	string (date-time)
items[].responses[].signatureMethodrequired	string
items[].responses[].signerNamerequired	string
items[].routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
items[].route.kindrequired	string
items[].route.memberIdsrequired	array of string
items[].route.roleId	string or null
items[].sourcerequired	string
items[].sourceError	string or null
items[].sourceLabel	string or null
items[].sourceRef	string or null
items[].statusrequired	string
items[].titlerequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/approvals?page=0&pageSize=0&state=approved' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals?page=0&pageSize=0&state=approved' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals"
params = {
    "page": "0",
    "pageSize": "0",
    "state": "approved",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/approvals?page=0&pageSize=0&state=approved", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mdm/approvals");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("state", "approved");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/approvals?page=0&pageSize=0&state=approved");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mdm/approvals/{publicId}

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getMdmApproval reads one approval request.

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mdm:read.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/approvals/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals/<publicId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/approvals/<publicId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/approvals/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mdm/approvals/{publicId}/approve

POSTmdm:approvetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

approveMdmApproval approves another technician’s request and runs it.

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
note	string or null
rowVersion	integer or null	int64.

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Only the technician who made this request can cancel it.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This request changed since you loaded it. Reload and try again.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "note": "string",
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "note": "string",
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "note": "string",
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "note": "string",
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "note": "string",
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "note": "string",
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/approve");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mdm/approvals/{publicId}/cancel

POSTmdm:wipetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

cancelMdmApproval withdraws your own pending request.

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
note	string or null
rowVersion	integer or null	int64.

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Only the technician who made this request can cancel it.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This request changed since you loaded it. Reload and try again.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "note": "string",
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "note": "string",
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "note": "string",
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "note": "string",
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "note": "string",
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "note": "string",
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/cancel");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mdm/approvals/{publicId}/override

POSTmdm:approvetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

overrideMdmApproval lets an owner run a pending request without a second technician.

It needs acknowledgeWarning true and a fresh second factor (428 step-up-required otherwise; prove it at POST /api/v1/auth/step-up). The other owners are notified.

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
acknowledgeWarningrequired	boolean
note	string or null
rowVersion	integer or null	int64.

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Only the technician who made this request can cancel it.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This request changed since you loaded it. Reload and try again.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/override' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "acknowledgeWarning": false,
  "note": "string",
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "acknowledgeWarning": false,
  "note": "string",
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/override' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/override"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "acknowledgeWarning": False,
    "note": "string",
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "acknowledgeWarning": false,
  "note": "string",
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/override", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/override";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "acknowledgeWarning": false,
    "note": "string",
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "acknowledgeWarning": false,
  "note": "string",
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/override");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mdm/approvals/{publicId}/reject

POSTmdm:approvetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

rejectMdmApproval rejects another technician’s request.

Parameters

Name	In	Type	Required	Description
publicId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
note	string or null
rowVersion	integer or null	int64.

Responses

Status	Body	Description
200	application/json, ApprovalView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Only the technician who made this request can cancel it.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This request changed since you loaded it. Reload and try again.
500	application/problem+json, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
amountCents	integer or null	int64.
awaitingrequired	array of ApprovalAwaitingView
awaiting[].memberIdrequired	string
awaiting[].namerequired	string
bodyrequired	string
canDeciderequired	boolean
canRespondrequired	boolean
consentTextrequired	string
consentVersionrequired	integer
currency	string or null
dueAt	string (date-time) or null
idrequired	string
kindrequired	string
projectId	string or null
quorumrequired	string
raisedAtrequired	string (date-time)
raisedByrequired	ApprovalActorView	ApprovalActorView is who raised a request.
raisedBy.kindrequired	string
raisedBy.label	string or null
raisedBy.refrequired	string
resolvedAt	string (date-time) or null
responsesrequired	array of ApprovalResponseView
responses[].comment	string or null
responses[].decisionrequired	string
responses[].idrequired	string
responses[].memberIdrequired	string
responses[].memberNamerequired	string
responses[].respondedAtrequired	string (date-time)
responses[].signatureMethodrequired	string
responses[].signerNamerequired	string
routerequired	ApprovalRouteView	ApprovalRouteView is who a request is routed to.
route.kindrequired	string
route.memberIdsrequired	array of string
route.roleId	string or null
sourcerequired	string
sourceError	string or null
sourceLabel	string or null
sourceRef	string or null
statusrequired	string
titlerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "note": "string",
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "note": "string",
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "note": "string",
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "note": "string",
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "note": "string",
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "note": "string",
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/approvals/<publicId>/reject");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mdm/practice/settings

GETmdm:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getMdmPracticeSettings reads the practice’s two-person rule for destructive MDM actions.

Responses

Status	Body	Description
200	application/json, MdmPracticeSettingsView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mdm:read.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	Practice settings are not available on this Depot.

200 response body

Field	Type	Description
apnsStrategyrequired	string
approvalTtlMinutesrequired	integer
bulkLockThresholdrequired	integer
ownerOverrideAllowedrequired	boolean
rowVersionrequired	integer	int64.
twoPersonActionsrequired	array of string
twoPersonRulerequired	boolean
unapprovedAppActionrequired	string
updatedAtrequired	string (date-time)
updatedByUserId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/practice/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/practice/settings' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/practice/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/practice/settings", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/practice/settings";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/practice/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/mdm/practice/settings

PUTmdm:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

putMdmPracticeSettings replaces the practice’s two-person rule.

409 when rowVersion is stale.

Request body

Required, sent as application/json.

Field	Type	Description
apnsStrategy	string or null
approvalTtlMinutes	integer or null
bulkLockThreshold	integer or null
ownerOverrideAllowed	boolean or null
rowVersion	integer or null	int64.
twoPersonActionsrequired	array of string
twoPersonRule	boolean or null
unapprovedAppAction	string or null

Responses

Status	Body	Description
200	application/json, MdmPracticeSettingsView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mdm:manage.
404	application/problem+json, ProblemDetails	Practice settings not found.
409	application/problem+json, ProblemDetails	The practice settings changed since you loaded them. Reload and try again.
500	application/problem+json, ProblemDetails	Could not save the practice settings.
503	application/problem+json, ProblemDetails	Practice settings are not available on this Depot.

200 response body

Field	Type	Description
apnsStrategyrequired	string
approvalTtlMinutesrequired	integer
bulkLockThresholdrequired	integer
ownerOverrideAllowedrequired	boolean
rowVersionrequired	integer	int64.
twoPersonActionsrequired	array of string
twoPersonRulerequired	boolean
unapprovedAppActionrequired	string
updatedAtrequired	string (date-time)
updatedByUserId	string or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/mdm/practice/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "apnsStrategy": "string",
  "approvalTtlMinutes": 0,
  "bulkLockThreshold": 0,
  "ownerOverrideAllowed": false,
  "rowVersion": 0,
  "twoPersonActions": [
    "string"
  ],
  "twoPersonRule": false,
  "unapprovedAppAction": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "apnsStrategy": "string",
  "approvalTtlMinutes": 0,
  "bulkLockThreshold": 0,
  "ownerOverrideAllowed": false,
  "rowVersion": 0,
  "twoPersonActions": [
    "string"
  ],
  "twoPersonRule": false,
  "unapprovedAppAction": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/mdm/practice/settings' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/practice/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "apnsStrategy": "string",
    "approvalTtlMinutes": 0,
    "bulkLockThreshold": 0,
    "ownerOverrideAllowed": False,
    "rowVersion": 0,
    "twoPersonActions": [
        "string",
    ],
    "twoPersonRule": False,
    "unapprovedAppAction": "string",
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "apnsStrategy": "string",
  "approvalTtlMinutes": 0,
  "bulkLockThreshold": 0,
  "ownerOverrideAllowed": false,
  "rowVersion": 0,
  "twoPersonActions": [
    "string"
  ],
  "twoPersonRule": false,
  "unapprovedAppAction": "string"
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/mdm/practice/settings", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/practice/settings";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "apnsStrategy": "string",
    "approvalTtlMinutes": 0,
    "bulkLockThreshold": 0,
    "ownerOverrideAllowed": false,
    "rowVersion": 0,
    "twoPersonActions": [
      "string"
    ],
    "twoPersonRule": false,
    "unapprovedAppAction": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "apnsStrategy": "string",
  "approvalTtlMinutes": 0,
  "bulkLockThreshold": 0,
  "ownerOverrideAllowed": false,
  "rowVersion": 0,
  "twoPersonActions": [
    "string"
  ],
  "twoPersonRule": false,
  "unapprovedAppAction": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/mdm/practice/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());