Depot mdmapps

View as Markdown Open in ChatGPT Open in Claude

Registers the app catalog routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET `/api/v1/mdm/apps`

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmApps lists the catalog across platforms, filtered by platform, source and a search over name, store id and bundle id, with each app’s install count from device reports.

Parameters

Name	In	Type	Required	Description
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
`platform`	query	string, one of android, darwin, ios, tvos, windows	No	Comma-separated set. An unrecognised value is refused.
`q`	query	string	No	Free-text search term.
`source`	query	string, one of enterprise, managed_play, msi, msix, vpp, windows_store	No	Comma-separated set. An unrecognised value is refused.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultMdmAppView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
`items`required	`array of MdmAppView`
`items[].approved`required	`boolean`
`items[].bundleId`	`string or null`
`items[].createdAt`required	`string (date-time)`
`items[].iconUrl`	`string or null`
`items[].installedCount`required	`integer`
`items[].licenseTotal`	`integer or null`
`items[].licenseUsed`	`integer or null`
`items[].managedConfigSchema`required	`any`	Arbitrary JSON.
`items[].name`required	`string`
`items[].packageSha256`	`string or null`
`items[].packageUrl`	`string or null`
`items[].platform`required	`string`
`items[].publicId`required	`string`
`items[].publisher`	`string or null`
`items[].rowVersion`required	`integer`	int64.
`items[].signerCertificatePem`	`string or null`
`items[].softwarePackageRef`	`string or null`
`items[].source`required	`string`
`items[].storeId`required	`string`
`items[].version`	`string or null`
`items[].vppTokenId`	`string or null`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/apps?page=0&pageSize=0&platform=android&q=<q>&source=enterprise' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/apps?page=0&pageSize=0&platform=android&q=<q>&source=enterprise' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps"
params = {
    "page": "0",
    "pageSize": "0",
    "platform": "android",
    "q": "<q>",
    "source": "enterprise",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/apps?page=0&pageSize=0&platform=android&q=<q>&source=enterprise", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mdm/apps");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("platform", "android");
url.searchParams.set("q", "<q>");
url.searchParams.set("source", "enterprise");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/apps?page=0&pageSize=0&platform=android&q=<q>&source=enterprise");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/apps`

POSTmdm:managetenant facehosteditmspremoteIdempotentNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

createMdmApp adds a hand-entered app: an Apple in-house (enterprise) app, a Microsoft Store app or an MSI.

Apps and Books apps come from import-vpp and Managed Google Play apps from approve-play.

Request body

Required, sent as application/json.

Field	Type	Description
`approved`	`boolean or null`
`bundleId`required	`string`
`iconUrl`required	`string`
`licenseTotal`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`required	`string`
`packageSha256`required	`string`
`packageUrl`required	`string`
`platform`required	`string`
`publisher`required	`string`
`signerCertificatePem`required	`string`
`softwarePackageRef`required	`string`
`source`required	`string`
`storeId`required	`string`
`version`required	`string`

Responses

Status	Body	Description
`200`	`application/json`, MdmAppView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	The app changed since it was read, or the catalog already has it. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
`approved`required	`boolean`
`bundleId`	`string or null`
`createdAt`required	`string (date-time)`
`iconUrl`	`string or null`
`installedCount`required	`integer`
`licenseTotal`	`integer or null`
`licenseUsed`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`required	`string`
`packageSha256`	`string or null`
`packageUrl`	`string or null`
`platform`required	`string`
`publicId`required	`string`
`publisher`	`string or null`
`rowVersion`required	`integer`	int64.
`signerCertificatePem`	`string or null`
`softwarePackageRef`	`string or null`
`source`required	`string`
`storeId`required	`string`
`version`	`string or null`
`vppTokenId`	`string or null`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/apps' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "platform": "string",
  "publisher": "string",
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "source": "string",
  "storeId": "string",
  "version": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "platform": "string",
  "publisher": "string",
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "source": "string",
  "storeId": "string",
  "version": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/apps' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "approved": False,
    "bundleId": "string",
    "iconUrl": "string",
    "licenseTotal": 0,
    "managedConfigSchema": "string",
    "name": "string",
    "packageSha256": "string",
    "packageUrl": "string",
    "platform": "string",
    "publisher": "string",
    "signerCertificatePem": "string",
    "softwarePackageRef": "string",
    "source": "string",
    "storeId": "string",
    "version": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "platform": "string",
  "publisher": "string",
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "source": "string",
  "storeId": "string",
  "version": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/apps", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "approved": false,
    "bundleId": "string",
    "iconUrl": "string",
    "licenseTotal": 0,
    "managedConfigSchema": "string",
    "name": "string",
    "packageSha256": "string",
    "packageUrl": "string",
    "platform": "string",
    "publisher": "string",
    "signerCertificatePem": "string",
    "softwarePackageRef": "string",
    "source": "string",
    "storeId": "string",
    "version": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "platform": "string",
  "publisher": "string",
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "source": "string",
  "storeId": "string",
  "version": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/apps");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/mdm/apps/{publicId}`

GETmdm:readtenant facehosteditmspremoteIdempotentNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

getMdmApp reads one catalog app.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes

Responses

Status	Body	Description
`200`	`application/json`, MdmAppView	Success.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	The app changed since it was read, or the catalog already has it. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
`approved`required	`boolean`
`bundleId`	`string or null`
`createdAt`required	`string (date-time)`
`iconUrl`	`string or null`
`installedCount`required	`integer`
`licenseTotal`	`integer or null`
`licenseUsed`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`required	`string`
`packageSha256`	`string or null`
`packageUrl`	`string or null`
`platform`required	`string`
`publicId`required	`string`
`publisher`	`string or null`
`rowVersion`required	`integer`	int64.
`signerCertificatePem`	`string or null`
`softwarePackageRef`	`string or null`
`source`required	`string`
`storeId`required	`string`
`version`	`string or null`
`vppTokenId`	`string or null`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/apps/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/<publicId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/apps/<publicId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps/<publicId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/apps/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH `/api/v1/mdm/apps/{publicId}`

PATCHmdm:managetenant facehosteditmspremoteIdempotentNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

updateMdmApp edits a catalog app under its rowVersion.

Its platform, source and store id never change, and an Apps and Books app’s license counts stay Apple’s.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
`approved`	`boolean or null`
`bundleId`	`string or null`
`iconUrl`	`string or null`
`licenseTotal`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`	`string or null`
`packageSha256`	`string or null`
`packageUrl`	`string or null`
`publisher`	`string or null`
`rowVersion`required	`integer`	int64.
`signerCertificatePem`	`string or null`
`softwarePackageRef`	`string or null`
`version`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, MdmAppView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	The app changed since it was read, or the catalog already has it. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
`approved`required	`boolean`
`bundleId`	`string or null`
`createdAt`required	`string (date-time)`
`iconUrl`	`string or null`
`installedCount`required	`integer`
`licenseTotal`	`integer or null`
`licenseUsed`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`required	`string`
`packageSha256`	`string or null`
`packageUrl`	`string or null`
`platform`required	`string`
`publicId`required	`string`
`publisher`	`string or null`
`rowVersion`required	`integer`	int64.
`signerCertificatePem`	`string or null`
`softwarePackageRef`	`string or null`
`source`required	`string`
`storeId`required	`string`
`version`	`string or null`
`vppTokenId`	`string or null`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/mdm/apps/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "publisher": "string",
  "rowVersion": 0,
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "version": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "publisher": "string",
  "rowVersion": 0,
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "version": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/<publicId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "approved": False,
    "bundleId": "string",
    "iconUrl": "string",
    "licenseTotal": 0,
    "managedConfigSchema": "string",
    "name": "string",
    "packageSha256": "string",
    "packageUrl": "string",
    "publisher": "string",
    "rowVersion": 0,
    "signerCertificatePem": "string",
    "softwarePackageRef": "string",
    "version": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "publisher": "string",
  "rowVersion": 0,
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "version": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/mdm/apps/<publicId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps/<publicId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "approved": false,
    "bundleId": "string",
    "iconUrl": "string",
    "licenseTotal": 0,
    "managedConfigSchema": "string",
    "name": "string",
    "packageSha256": "string",
    "packageUrl": "string",
    "publisher": "string",
    "rowVersion": 0,
    "signerCertificatePem": "string",
    "softwarePackageRef": "string",
    "version": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "approved": false,
  "bundleId": "string",
  "iconUrl": "string",
  "licenseTotal": 0,
  "managedConfigSchema": "string",
  "name": "string",
  "packageSha256": "string",
  "packageUrl": "string",
  "publisher": "string",
  "rowVersion": 0,
  "signerCertificatePem": "string",
  "softwarePackageRef": "string",
  "version": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/mdm/apps/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE `/api/v1/mdm/apps/{publicId}`

DELETEmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteMdmApp removes an app from the catalog.

Profiles that assign it keep the entry until they are edited; translators report it as missing. An Apps and Books app cannot be deleted here, because the next sync brings it back while Apple still holds its licenses.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes

Responses

Status	Body	Description
`204`	None	Success, with no body.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	The app changed since it was read, or the catalog already has it. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mdm/apps/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/<publicId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/mdm/apps/<publicId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps/<publicId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/mdm/apps/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/mdm/apps/{publicId}/licenses`

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmAppLicenses lists the device licenses Apps and Books holds for an app, most recently changed first.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultMdmVppLicenseView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	The app changed since it was read, or the catalog already has it. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client context in request.

200 response body

Field	Type	Description
`items`required	`array of MdmVppLicenseView`
`items[].agentId`required	`string`
`items[].appId`required	`string`
`items[].lastError`	`string or null`
`items[].serialNumber`required	`string`
`items[].state`required	`string`
`items[].updatedAt`required	`string (date-time)`
`items[].vppEventId`	`string or null`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/apps/<publicId>/licenses?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/apps/approve-play`

POSTmdm:managetenant facehosteditmspremoteIdempotentNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

response-status

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

approveMdmPlayApp records an app approved in the Managed Google Play page, with its title, developer, icon and managed configuration schema read from Google.

Approving an app already in the catalog refreshes it (200); otherwise it is added (201).

Request body

Required, sent as application/json.

Field	Type	Description
`packageName`required	`string`

Responses

Status	Body	Description
`200`	`application/json`, MdmAppView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No app in the catalog has that id.
`409`	`application/problem+json`, ProblemDetails	Connect Android Enterprise before approving Managed Google Play apps.
`500`	`application/problem+json`, ProblemDetails	No client context in request.
`503`	`application/problem+json`, ProblemDetails	The public device management address is not configured on this Depot, so Android Enterprise cannot be connected yet.

200 response body

Field	Type	Description
`approved`required	`boolean`
`bundleId`	`string or null`
`createdAt`required	`string (date-time)`
`iconUrl`	`string or null`
`installedCount`required	`integer`
`licenseTotal`	`integer or null`
`licenseUsed`	`integer or null`
`managedConfigSchema`required	`any`	Arbitrary JSON.
`name`required	`string`
`packageSha256`	`string or null`
`packageUrl`	`string or null`
`platform`required	`string`
`publicId`required	`string`
`publisher`	`string or null`
`rowVersion`required	`integer`	int64.
`signerCertificatePem`	`string or null`
`softwarePackageRef`	`string or null`
`source`required	`string`
`storeId`required	`string`
`version`	`string or null`
`vppTokenId`	`string or null`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/apps/approve-play' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "packageName": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "packageName": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/approve-play' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/approve-play"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "packageName": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "packageName": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/apps/approve-play", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps/approve-play";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "packageName": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "packageName": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/apps/approve-play");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/apps/import-vpp`

POSTmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

importMdmVppApps syncs Apps and Books locations now (one, or every one), writing their apps and license counts into the catalog.

Each location’s outcome, including one another service manages, is on its token.

Request body

Required, sent as application/json.

Field	Type	Description
`vppTokenId`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, MdmVppImportResult	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No Apps and Books token has that id.
`409`	`application/problem+json`, ProblemDetails	Upload an Apps and Books content token first.
`500`	`application/problem+json`, ProblemDetails	No client context in request.
`503`	`application/problem+json`, ProblemDetails	Apps and Books is not available on this Depot.

200 response body

Field	Type	Description
`failed`required	`integer`
`tokens`required	`array of VppTokenView`
`tokens[].countryCode`	`string or null`
`tokens[].expiresInDays`	`integer or null`
`tokens[].lastSyncAt`	`string (date-time) or null`
`tokens[].lastSyncError`	`string or null`
`tokens[].locationName`	`string or null`
`tokens[].notAfter`	`string (date-time) or null`
`tokens[].orgName`	`string or null`
`tokens[].publicId`required	`string`
`tokens[].rowVersion`required	`integer`	int64.
`tokens[].state`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/apps/import-vpp' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "vppTokenId": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "vppTokenId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/apps/import-vpp' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/apps/import-vpp"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "vppTokenId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "vppTokenId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/apps/import-vpp", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/apps/import-vpp";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "vppTokenId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "vppTokenId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/apps/import-vpp");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot mdmapps

GET /api/v1/mdm/apps

Parameters

Responses

Request samples

POST /api/v1/mdm/apps

Request body

Responses

Request samples

GET /api/v1/mdm/apps/{publicId}

Parameters

Responses

Request samples

PATCH /api/v1/mdm/apps/{publicId}

Parameters

Request body

Responses

Request samples

DELETE /api/v1/mdm/apps/{publicId}

Parameters

Responses

Request samples

GET /api/v1/mdm/apps/{publicId}/licenses

Parameters

Responses

Request samples

POST /api/v1/mdm/apps/approve-play

Request body

Responses

Request samples

POST /api/v1/mdm/apps/import-vpp

Request body

Responses

Request samples

GET `/api/v1/mdm/apps`

POST `/api/v1/mdm/apps`

GET `/api/v1/mdm/apps/{publicId}`

PATCH `/api/v1/mdm/apps/{publicId}`

DELETE `/api/v1/mdm/apps/{publicId}`

GET `/api/v1/mdm/apps/{publicId}/licenses`

POST `/api/v1/mdm/apps/approve-play`

POST `/api/v1/mdm/apps/import-vpp`