Skip to content

Depot mdmcompliance

Registers the compliance routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmComplianceConnectors lists conditional-access connectors with each kind’s platform support and approval status.

Secrets are never returned.

NameInTypeRequiredDescription
pagequeryintegerNoOne-based page number. Defaults to 1.
pageSizequeryintegerNoRows per page, 1 to 200. Defaults to 50.
StatusBodyDescription
200application/json, PagedResultDcComplianceConnectorViewSuccess.
400application/problem+json, ProblemDetailsOne or more validation errors occurred.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:read.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
itemsrequiredarray of DcComplianceConnectorView
items[].approvalRequiredrequiredboolean
items[].configrequiredany

Arbitrary JSON.

items[].displayNamerequiredstring
items[].hasSecretrequiredboolean
items[].jwksUrlstring or null
items[].kindrequiredstring
items[].lastErrorstring or null
items[].lastPushAtstring (date-time) or null
items[].noterequiredstring
items[].platformsrequiredarray of string
items[].publicIdrequiredstring
items[].rowVersionrequiredinteger

int64.

items[].staterequiredstring
items[].verifiedrequiredboolean
pagerequiredinteger
pageSizerequiredinteger
totalrequiredinteger
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/compliance/connectors?page=0&pageSize=0' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

POSTmdm:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMdmComplianceConnector adds a conditional-access connector.

An Okta connector gets a fresh signing key; a Google connector starts disabled until Google approves Outpost as a partner.

Required, sent as application/json.

FieldTypeDescription
configany

Arbitrary JSON.

displayNamestring or null
enabledboolean or null
kindrequiredstring
rowVersionrequiredinteger

int64.

secretstring or null
StatusBodyDescription
201application/json, DcComplianceConnectorViewCreated.
400application/problem+json, ProblemDetailsThe request body is not valid JSON.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo resource matches.
409application/problem+json, ProblemDetailsThe connector could not be saved.
500application/problem+json, ProblemDetailsNo client context in request.

201 response body

FieldTypeDescription
approvalRequiredrequiredboolean
configrequiredany

Arbitrary JSON.

displayNamerequiredstring
hasSecretrequiredboolean
jwksUrlstring or null
kindrequiredstring
lastErrorstring or null
lastPushAtstring (date-time) or null
noterequiredstring
platformsrequiredarray of string
publicIdrequiredstring
rowVersionrequiredinteger

int64.

staterequiredstring
verifiedrequiredboolean
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/compliance/connectors' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-b 'outpost_console=<console-session>' \
--data '{
"config": "string",
"displayName": "string",
"enabled": false,
"kind": "string",
"rowVersion": 0,
"secret": "string"
}'

PATCH /api/v1/mdm/compliance/connectors/{publicId}

Section titled “PATCH /api/v1/mdm/compliance/connectors/{publicId}”

PATCHmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

updateMdmComplianceConnector edits a connector’s name, config or secret, or turns it on or off.

A Google connector cannot be turned on.

NameInTypeRequiredDescription
publicIdpathstringYes

Required, sent as application/json.

FieldTypeDescription
configany

Arbitrary JSON.

displayNamestring or null
enabledboolean or null
kindrequiredstring
rowVersionrequiredinteger

int64.

secretstring or null
StatusBodyDescription
200application/json, DcComplianceConnectorViewSuccess.
400application/problem+json, ProblemDetailsThe request body is not valid JSON.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such connector.
409application/problem+json, ProblemDetailsSomeone else changed this connector. Reload it and try again.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
approvalRequiredrequiredboolean
configrequiredany

Arbitrary JSON.

displayNamerequiredstring
hasSecretrequiredboolean
jwksUrlstring or null
kindrequiredstring
lastErrorstring or null
lastPushAtstring (date-time) or null
noterequiredstring
platformsrequiredarray of string
publicIdrequiredstring
rowVersionrequiredinteger

int64.

staterequiredstring
verifiedrequiredboolean
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/mdm/compliance/connectors/<publicId>' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-b 'outpost_console=<console-session>' \
--data '{
"config": "string",
"displayName": "string",
"enabled": false,
"kind": "string",
"rowVersion": 0,
"secret": "string"
}'

DELETE /api/v1/mdm/compliance/connectors/{publicId}

Section titled “DELETE /api/v1/mdm/compliance/connectors/{publicId}”

DELETEmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteMdmComplianceConnector removes a connector and its push history.

NameInTypeRequiredDescription
publicIdpathstringYes
StatusBodyDescription
204NoneSuccess, with no body.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such connector.
500application/problem+json, ProblemDetailsNo client context in request.
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mdm/compliance/connectors/<publicId>' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

POST /api/v1/mdm/compliance/connectors/{publicId}/test

Section titled “POST /api/v1/mdm/compliance/connectors/{publicId}/test”

POSTmdm:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

testMdmComplianceConnector checks the connector’s configured endpoint accepts Outpost (Okta: a verification event; Entra: a token and a read).

A pass makes a pending or failing connector active; a failure marks it error.

NameInTypeRequiredDescription
publicIdpathstringYes
StatusBodyDescription
200application/json, DcConnectorTestViewSuccess.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such connector.
500application/problem+json, ProblemDetailsNo client context in request.
503application/problem+json, ProblemDetailsConnector testing is not configured on this server.

200 response body

FieldTypeDescription
detailrequiredstring
okrequiredboolean
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/compliance/connectors/<publicId>/test' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmComplianceExceptions lists compliance exceptions, soonest expiry first.

?agentId= narrows to one device; ?includeInactive=true adds revoked and expired ones.

NameInTypeRequiredDescription
agentIdquerystringNo
includeInactivequerystringNo
pagequeryintegerNoOne-based page number. Defaults to 1.
pageSizequeryintegerNoRows per page, 1 to 200. Defaults to 50.
StatusBodyDescription
200application/json, PagedResultDcComplianceExceptionViewSuccess.
400application/problem+json, ProblemDetailsOne or more validation errors occurred.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:read.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
itemsrequiredarray of DcComplianceExceptionView
items[].activerequiredboolean
items[].agentIdrequiredstring
items[].createdAtrequiredstring (date-time)
items[].createdByUserIdstring or null
items[].expiresAtrequiredstring (date-time)
items[].hostnamerequiredstring
items[].publicIdrequiredstring
items[].reasonrequiredstring
items[].revokedAtstring (date-time) or null
items[].ruleIdstring or null
items[].ruleNamestring or null
pagerequiredinteger
pageSizerequiredinteger
totalrequiredinteger
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/compliance/exceptions?agentId=<agentId>&includeInactive=<includeInactive>&page=0&pageSize=0' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

POSTmdm:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMdmComplianceException excuses one device from one rule (or every rule) until expiresAt, at most 90 days away.

Required, sent as application/json.

FieldTypeDescription
agentIdrequiredstring
expiresAtrequiredstring (date-time)
reasonrequiredstring
ruleIdstring or null
StatusBodyDescription
201application/json, DcComplianceExceptionViewCreated.
400application/problem+json, ProblemDetailsThe request body is not valid JSON.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo resource matches.
409application/problem+json, ProblemDetailsAn exception lasts at most 90 days and must end in the future.
500application/problem+json, ProblemDetailsNo client context in request.

201 response body

FieldTypeDescription
activerequiredboolean
agentIdrequiredstring
createdAtrequiredstring (date-time)
createdByUserIdstring or null
expiresAtrequiredstring (date-time)
hostnamerequiredstring
publicIdrequiredstring
reasonrequiredstring
revokedAtstring (date-time) or null
ruleIdstring or null
ruleNamestring or null
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/compliance/exceptions' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-b 'outpost_console=<console-session>' \
--data '{
"agentId": "string",
"expiresAt": "2026-01-01T00:00:00Z",
"reason": "string",
"ruleId": "string"
}'

DELETE /api/v1/mdm/compliance/exceptions/{publicId}

Section titled “DELETE /api/v1/mdm/compliance/exceptions/{publicId}”

DELETEmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

revokeMdmComplianceException ends an exception now.

NameInTypeRequiredDescription
publicIdpathstringYes
StatusBodyDescription
204NoneSuccess, with no body.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such active exception.
500application/problem+json, ProblemDetailsNo client context in request.
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mdm/compliance/exceptions/<publicId>' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmComplianceRules lists device compliance rules by name, disabled ones included.

NameInTypeRequiredDescription
pagequeryintegerNoOne-based page number. Defaults to 1.
pageSizequeryintegerNoRows per page, 1 to 200. Defaults to 50.
StatusBodyDescription
200application/json, PagedResultDcComplianceRuleViewSuccess.
400application/problem+json, ProblemDetailsOne or more validation errors occurred.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:read.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
itemsrequiredarray of DcComplianceRuleView
items[].actionsrequiredany

Arbitrary JSON.

items[].conditionrequiredany

Arbitrary JSON.

items[].createdAtrequiredstring (date-time)
items[].createdByUserIdstring or null
items[].descriptionstring or null
items[].enabledrequiredboolean
items[].graceSecondsrequiredinteger
items[].namerequiredstring
items[].platformsrequiredarray of string
items[].publicIdrequiredstring
items[].rowVersionrequiredinteger

int64.

items[].scopeIdstring or null
items[].scopeTyperequiredstring
pagerequiredinteger
pageSizerequiredinteger
totalrequiredinteger
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/compliance/rules?page=0&pageSize=0' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

POSTmdm:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMdmComplianceRule adds a device compliance rule.

Required, sent as application/json.

FieldTypeDescription
actionsany

Arbitrary JSON.

conditionany

Arbitrary JSON.

descriptionstring or null
enabledboolean or null
graceSecondsinteger or null
namestring or null
platformsarray of string or null
rowVersionrequiredinteger

int64.

scopeIdstring or null
scopeTypestring or null
StatusBodyDescription
201application/json, DcComplianceRuleViewCreated.
400application/problem+json, ProblemDetailsThe request body is not valid JSON.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo resource matches.
409application/problem+json, ProblemDetailsThe rule could not be saved.
500application/problem+json, ProblemDetailsNo client context in request.

201 response body

FieldTypeDescription
actionsrequiredany

Arbitrary JSON.

conditionrequiredany

Arbitrary JSON.

createdAtrequiredstring (date-time)
createdByUserIdstring or null
descriptionstring or null
enabledrequiredboolean
graceSecondsrequiredinteger
namerequiredstring
platformsrequiredarray of string
publicIdrequiredstring
rowVersionrequiredinteger

int64.

scopeIdstring or null
scopeTyperequiredstring
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/compliance/rules' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-b 'outpost_console=<console-session>' \
--data '{
"actions": "string",
"condition": "string",
"description": "string",
"enabled": false,
"graceSeconds": 0,
"name": "string",
"platforms": [
"string"
],
"rowVersion": 0,
"scopeId": "string",
"scopeType": "string"
}'

PATCH /api/v1/mdm/compliance/rules/{publicId}

Section titled “PATCH /api/v1/mdm/compliance/rules/{publicId}”

PATCHmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

updateMdmComplianceRule edits a compliance rule; rowVersion must be current.

NameInTypeRequiredDescription
publicIdpathstringYes

Required, sent as application/json.

FieldTypeDescription
actionsany

Arbitrary JSON.

conditionany

Arbitrary JSON.

descriptionstring or null
enabledboolean or null
graceSecondsinteger or null
namestring or null
platformsarray of string or null
rowVersionrequiredinteger

int64.

scopeIdstring or null
scopeTypestring or null
StatusBodyDescription
200application/json, DcComplianceRuleViewSuccess.
400application/problem+json, ProblemDetailsThe request body is not valid JSON.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such compliance rule.
409application/problem+json, ProblemDetailsSomeone else changed this rule. Reload it and try again.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
actionsrequiredany

Arbitrary JSON.

conditionrequiredany

Arbitrary JSON.

createdAtrequiredstring (date-time)
createdByUserIdstring or null
descriptionstring or null
enabledrequiredboolean
graceSecondsrequiredinteger
namerequiredstring
platformsrequiredarray of string
publicIdrequiredstring
rowVersionrequiredinteger

int64.

scopeIdstring or null
scopeTyperequiredstring
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/mdm/compliance/rules/<publicId>' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-b 'outpost_console=<console-session>' \
--data '{
"actions": "string",
"condition": "string",
"description": "string",
"enabled": false,
"graceSeconds": 0,
"name": "string",
"platforms": [
"string"
],
"rowVersion": 0,
"scopeId": "string",
"scopeType": "string"
}'

DELETE /api/v1/mdm/compliance/rules/{publicId}

Section titled “DELETE /api/v1/mdm/compliance/rules/{publicId}”

DELETEmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteMdmComplianceRule removes a compliance rule and its device results.

NameInTypeRequiredDescription
publicIdpathstringYes
StatusBodyDescription
204NoneSuccess, with no body.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:manage.
404application/problem+json, ProblemDetailsNo such compliance rule.
500application/problem+json, ProblemDetailsNo client context in request.
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mdm/compliance/rules/<publicId>' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmComplianceStates lists each device’s compliance posture with its per-rule results, most recently changed first.

?state= filters by posture (comma-separated).

NameInTypeRequiredDescription
pagequeryintegerNoOne-based page number. Defaults to 1.
pageSizequeryintegerNoRows per page, 1 to 200. Defaults to 50.
statequerystring, one of compliant, excepted, in_grace, noncompliant, not_measuredNoComma-separated set. An unrecognised value is refused.
StatusBodyDescription
200application/json, PagedResultDcComplianceDeviceViewSuccess.
400application/problem+json, ProblemDetailsOne or more validation errors occurred.
401application/problem+json, ProblemDetailsNo signed-in identity.
403application/problem+json, ProblemDetailsThe identity does not hold mdm:read.
500application/problem+json, ProblemDetailsNo client context in request.

200 response body

FieldTypeDescription
itemsrequiredarray of DcComplianceDeviceView
items[].agentIdrequiredstring
items[].changedAtrequiredstring (date-time)
items[].evaluatedAtrequiredstring (date-time)
items[].hostnamerequiredstring
items[].osFamilyrequiredstring
items[].ownershiprequiredstring
items[].rulesrequiredarray of DcComplianceRuleStateView
items[].rules[].detailrequiredany

Arbitrary JSON.

items[].rules[].evaluatedAtrequiredstring (date-time)
items[].rules[].firstFailedAtstring (date-time) or null
items[].rules[].graceEndsAtstring (date-time) or null
items[].rules[].ruleIdrequiredstring
items[].rules[].ruleNamerequiredstring
items[].rules[].staterequiredstring
items[].staterequiredstring
pagerequiredinteger
pageSizerequiredinteger
totalrequiredinteger
Terminal window
# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/compliance/states?page=0&pageSize=0&state=compliant' \
-H 'X-CSRF-Token: <csrf-token>' \
-H 'Accept: application/json' \
-b 'outpost_console=<console-session>'

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.