Depot mdmenrollagent

View as Markdown Open in ChatGPT Open in Claude

Registers the enroll-through-the-agent action.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

POST `/api/v1/endpoints/{agentID}/mdm/enroll`

POSTmdm:enrolltenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

enrollMdmViaAgent asks a Windows PC’s Outpost agent to enroll the PC in Windows MDM.

The agent fetches a single-use enrollment ticket and registers the device with Outpost’s Windows MDM, so the device keeps its one endpoint record. Windows enrolls it only while someone is signed in; the mdm_enroll command’s result says whether it did.

Parameters

Name	In	Type	Required	Description
`agentID`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`202`	`application/json`, MdmEnrollAgentView	Accepted.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:enroll.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client context in request.
`503`	`application/problem+json`, ProblemDetails	The request was refused.

202 response body

Field	Type	Description
`commandId`required	`string`
`delivered`required	`boolean`
`detail`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/mdm/enroll");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/mdm/windows/bulk-tokens`

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmBulkTokens lists the Windows bulk enrollment tokens, newest first.

Revoked tokens are included with includeRevoked=true.

Parameters

Name	In	Type	Required	Description
`includeRevoked`	query	string	No
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultMdmBulkTokenView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`items`required	`array of MdmBulkTokenView`
`items[].createdAt`required	`string (date-time)`
`items[].createdByUserId`	`string or null`
`items[].expiresAt`required	`string (date-time)`
`items[].lastUsedAt`	`string (date-time) or null`
`items[].maxUses`required	`integer`
`items[].name`required	`string`
`items[].publicId`required	`string`
`items[].revokedAt`	`string (date-time) or null`
`items[].revokedByUserId`	`string or null`
`items[].rowVersion`required	`integer`	int64.
`items[].secret`	`string or null`
`items[].siteId`	`string or null`
`items[].status`required	`string`
`items[].upn`required	`string`
`items[].usedCount`required	`integer`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens?includeRevoked=<includeRevoked>&page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens?includeRevoked=<includeRevoked>&page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/windows/bulk-tokens"
params = {
    "includeRevoked": "<includeRevoked>",
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens?includeRevoked=<includeRevoked>&page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mdm/windows/bulk-tokens");
url.searchParams.set("includeRevoked", "<includeRevoked>");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens?includeRevoked=<includeRevoked>&page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/windows/bulk-tokens`

POSTmdm:enrolltenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMdmBulkToken creates a Windows bulk enrollment token: a name, an optional site the PCs it enrolls join, an optional cap on how many PCs it enrolls (0 or absent: no cap) and how many days it lasts (default 30, at most 365).

The response carries the token’s secret and user name once, for scripted enrollment; the provisioning package route embeds them.

Request body

Required, sent as application/json.

Field	Type	Description
`expiresInDays`	`integer or null`
`maxUses`	`integer or null`
`name`required	`string`
`siteId`	`string or null`

Responses

Status	Body	Description
`201`	`application/json`, MdmBulkTokenView	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:enroll.
`404`	`application/problem+json`, ProblemDetails	Bulk enrollment token not found.
`409`	`application/problem+json`, ProblemDetails	The bulk enrollment token could not be created.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

201 response body

Field	Type	Description
`createdAt`required	`string (date-time)`
`createdByUserId`	`string or null`
`expiresAt`required	`string (date-time)`
`lastUsedAt`	`string (date-time) or null`
`maxUses`required	`integer`
`name`required	`string`
`publicId`required	`string`
`revokedAt`	`string (date-time) or null`
`revokedByUserId`	`string or null`
`rowVersion`required	`integer`	int64.
`secret`	`string or null`
`siteId`	`string or null`
`status`required	`string`
`upn`required	`string`
`usedCount`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "expiresInDays": 0,
  "maxUses": 0,
  "name": "string",
  "siteId": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "expiresInDays": 0,
  "maxUses": 0,
  "name": "string",
  "siteId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mdm/windows/bulk-tokens"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "expiresInDays": 0,
    "maxUses": 0,
    "name": "string",
    "siteId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "expiresInDays": 0,
  "maxUses": 0,
  "name": "string",
  "siteId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/windows/bulk-tokens";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "expiresInDays": 0,
    "maxUses": 0,
    "name": "string",
    "siteId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "expiresInDays": 0,
  "maxUses": 0,
  "name": "string",
  "siteId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/windows/bulk-tokens/{publicId}/revoke`

POSTmdm:enrolltenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

revokeMdmBulkToken revokes a bulk enrollment token: no further PC enrolls with it or with any provisioning package that carries it.

PCs it already enrolled stay enrolled. rowVersion, when sent, must be the token’s current one.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`rowVersion`	`integer or null`	int64.

Responses

Status	Body	Description
`200`	`application/json`, MdmBulkTokenView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:enroll.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	The token is already revoked or was changed by someone else. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`createdAt`required	`string (date-time)`
`createdByUserId`	`string or null`
`expiresAt`required	`string (date-time)`
`lastUsedAt`	`string (date-time) or null`
`maxUses`required	`integer`
`name`required	`string`
`publicId`required	`string`
`revokedAt`	`string (date-time) or null`
`revokedByUserId`	`string or null`
`rowVersion`required	`integer`	int64.
`secret`	`string or null`
`siteId`	`string or null`
`status`required	`string`
`upn`required	`string`
`usedCount`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "rowVersion": 0
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/windows/bulk-tokens/<publicId>/revoke");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/windows/enroll-agents`

POSTmdm:enrolltenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

enrollMdmViaAgents asks the Outpost agent on each listed Windows PC (up to 500) to enroll it in Windows device management, as the single-device action does.

Each PC gets its own result: delivered (the agent took it now), queued (on reconnect), refused with a reason (not Windows, no agent, already enrolled), not_found or failed. The request succeeds whatever the mix. Delivered is not enrolled: Windows enrolls a PC only while someone is signed in to it, and each command’s result says whether it did.

Request body

Required, sent as application/json.

Field	Type	Description
`agentIds`required	`array of string`

Responses

Status	Body	Description
`200`	`application/json`, MdmEnrollAgentsView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:enroll.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`results`required	`array of MdmEnrollAgentResult`
`results[].agentId`required	`string`
`results[].commandId`	`string`
`results[].detail`	`string`
`results[].reason`	`string`
`results[].status`required	`string`
`sent`required	`integer`
`skipped`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/windows/enroll-agents' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "agentIds": [
    "string"
  ]
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "agentIds": [
    "string"
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/windows/enroll-agents' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mdm/windows/enroll-agents"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "agentIds": [
        "string",
    ],
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "agentIds": [
    "string"
  ]
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/windows/enroll-agents", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/windows/enroll-agents";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "agentIds": [
      "string"
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "agentIds": [
    "string"
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/windows/enroll-agents");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/windows/ppkg`

POSTmdm:enrolltenant facehosteditmspremotedownloadNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

generateMdmPpkg builds a Windows provisioning package (.ppkg) for a live bulk enrollment token, optionally joining Wi-Fi networks (open, WPA2 or WPA3 personal) and trusting root certificates first, and returns it as a download.

The package is not signed: Windows asks once whether it comes from a trusted source, and Install-ProvisioningPackage -QuietInstall, run elevated, applies it without asking.

Request body

Required, sent as application/json.

Field	Type	Description
`rootCertificatesPem`required	`string`
`tokenId`required	`string`
`wifi`required	`array of MdmPpkgWiFi`
`wifi[].hidden`required	`boolean`
`wifi[].passphrase`required	`string`
`wifi[].security`required	`string`
`wifi[].ssid`required	`string`

Responses

Status	Body	Description
`200`	`application/octet-stream`, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:enroll.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/windows/ppkg' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "rootCertificatesPem": "string",
  "tokenId": "string",
  "wifi": [
    {
      "hidden": false,
      "passphrase": "string",
      "security": "string",
      "ssid": "string"
    }
  ]
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "rootCertificatesPem": "string",
  "tokenId": "string",
  "wifi": [
    {
      "hidden": false,
      "passphrase": "string",
      "security": "string",
      "ssid": "string"
    }
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/windows/ppkg' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mdm/windows/ppkg"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "rootCertificatesPem": "string",
    "tokenId": "string",
    "wifi": [
        {
            "hidden": False,
            "passphrase": "string",
            "security": "string",
            "ssid": "string",
        },
    ],
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "rootCertificatesPem": "string",
  "tokenId": "string",
  "wifi": [
    {
      "hidden": false,
      "passphrase": "string",
      "security": "string",
      "ssid": "string"
    }
  ]
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/windows/ppkg", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/windows/ppkg";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "rootCertificatesPem": "string",
    "tokenId": "string",
    "wifi": [
      {
        "hidden": false,
        "passphrase": "string",
        "security": "string",
        "ssid": "string"
      }
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "rootCertificatesPem": "string",
  "tokenId": "string",
  "wifi": [
    {
      "hidden": false,
      "passphrase": "string",
      "security": "string",
      "ssid": "string"
    }
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/windows/ppkg");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot mdmenrollagent

POST /api/v1/endpoints/{agentID}/mdm/enroll

Parameters

Responses

Request samples

GET /api/v1/mdm/windows/bulk-tokens

Parameters

Responses

Request samples

POST /api/v1/mdm/windows/bulk-tokens

Request body

Responses

Request samples

POST /api/v1/mdm/windows/bulk-tokens/{publicId}/revoke

Parameters

Request body

Responses

Request samples

POST /api/v1/mdm/windows/enroll-agents

Request body

Responses

Request samples

POST /api/v1/mdm/windows/ppkg

Request body

Responses

Request samples

POST `/api/v1/endpoints/{agentID}/mdm/enroll`

GET `/api/v1/mdm/windows/bulk-tokens`

POST `/api/v1/mdm/windows/bulk-tokens`

POST `/api/v1/mdm/windows/bulk-tokens/{publicId}/revoke`

POST `/api/v1/mdm/windows/enroll-agents`

POST `/api/v1/mdm/windows/ppkg`