Depot mdmmigrations

View as Markdown Open in ChatGPT Open in Claude

Registers the migration routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET `/api/v1/mdm/migrations`

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMdmMigrations lists migration batches, newest first, with each one’s device counts by state.

Parameters

Name	In	Type	Required	Description
`page`	query	integer	No	One-based page number. Defaults to 1.
`pageSize`	query	integer	No	Rows per page, 1 to 200. Defaults to 50.

Responses

Status	Body	Description
`200`	`application/json`, PagedResultMdmMigrationView	Success.
`400`	`application/problem+json`, ProblemDetails	One or more validation errors occurred.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`items`required	`array of MdmMigrationView`
`items[].abmTokenId`	`string or null`
`items[].adeProfileId`	`string or null`
`items[].completedAt`	`string (date-time) or null`
`items[].createdByUserId`	`string or null`
`items[].deadlineAt`	`string (date-time) or null`
`items[].devices`	`array of MdmMigrationDeviceView`
`items[].devices[].agentId`	`string or null`
`items[].devices[].reasonCode`	`string or null`
`items[].devices[].serialNumber`required	`string`
`items[].devices[].state`required	`string`
`items[].devices[].updatedAt`required	`string (date-time)`
`items[].method`required	`string`
`items[].name`required	`string`
`items[].progress`required	`object`
`items[].publicId`required	`string`
`items[].rowVersion`required	`integer`	int64.
`items[].sourceMdm`required	`string`
`items[].startedAt`	`string (date-time) or null`
`items[].state`required	`string`
`page`required	`integer`
`pageSize`required	`integer`
`total`required	`integer`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/migrations?page=0&pageSize=0' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/migrations?page=0&pageSize=0' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/migrations"
params = {
    "page": "0",
    "pageSize": "0",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/migrations?page=0&pageSize=0", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mdm/migrations");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/migrations?page=0&pageSize=0");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/migrations`

POSTmdm:managetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMdmMigration creates a draft migration batch from a list of serial numbers.

ABM-coordinated batches name the Apple Business Manager token.

Request body

Required, sent as application/json.

Field	Type	Description
`abmTokenId`required	`string`
`adeProfileId`required	`string`
`deadlineAt`	`string (date-time) or null`
`method`required	`string`
`name`required	`string`
`serials`required	`array of string`
`sourceMdm`required	`string`

Responses

Status	Body	Description
`201`	`application/json`, MdmMigrationView	Created.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches.
`409`	`application/problem+json`, ProblemDetails	The migration could not be saved.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

201 response body

Field	Type	Description
`abmTokenId`	`string or null`
`adeProfileId`	`string or null`
`completedAt`	`string (date-time) or null`
`createdByUserId`	`string or null`
`deadlineAt`	`string (date-time) or null`
`devices`	`array of MdmMigrationDeviceView`
`devices[].agentId`	`string or null`
`devices[].reasonCode`	`string or null`
`devices[].serialNumber`required	`string`
`devices[].state`required	`string`
`devices[].updatedAt`required	`string (date-time)`
`method`required	`string`
`name`required	`string`
`progress`required	`object`
`publicId`required	`string`
`rowVersion`required	`integer`	int64.
`sourceMdm`required	`string`
`startedAt`	`string (date-time) or null`
`state`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mdm/migrations' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "abmTokenId": "string",
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "method": "string",
  "name": "string",
  "serials": [
    "string"
  ],
  "sourceMdm": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "abmTokenId": "string",
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "method": "string",
  "name": "string",
  "serials": [
    "string"
  ],
  "sourceMdm": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/migrations' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mdm/migrations"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "abmTokenId": "string",
    "adeProfileId": "string",
    "deadlineAt": "2026-01-01T00:00:00Z",
    "method": "string",
    "name": "string",
    "serials": [
        "string",
    ],
    "sourceMdm": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "abmTokenId": "string",
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "method": "string",
  "name": "string",
  "serials": [
    "string"
  ],
  "sourceMdm": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/migrations", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/migrations";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "abmTokenId": "string",
    "adeProfileId": "string",
    "deadlineAt": "2026-01-01T00:00:00Z",
    "method": "string",
    "name": "string",
    "serials": [
      "string"
    ],
    "sourceMdm": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "abmTokenId": "string",
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "method": "string",
  "name": "string",
  "serials": [
    "string"
  ],
  "sourceMdm": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/migrations");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET `/api/v1/mdm/migrations/{publicId}`

GETmdm:readtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getMdmMigration returns one migration with every device’s progress.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes	A uuid.

Responses

Status	Body	Description
`200`	`application/json`, MdmMigrationView	Success.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:read.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`abmTokenId`	`string or null`
`adeProfileId`	`string or null`
`completedAt`	`string (date-time) or null`
`createdByUserId`	`string or null`
`deadlineAt`	`string (date-time) or null`
`devices`	`array of MdmMigrationDeviceView`
`devices[].agentId`	`string or null`
`devices[].reasonCode`	`string or null`
`devices[].serialNumber`required	`string`
`devices[].state`required	`string`
`devices[].updatedAt`required	`string (date-time)`
`method`required	`string`
`name`required	`string`
`progress`required	`object`
`publicId`required	`string`
`rowVersion`required	`integer`	int64.
`sourceMdm`required	`string`
`startedAt`	`string (date-time) or null`
`state`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mdm/migrations/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mdm/migrations/<publicId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mdm/migrations/<publicId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mdm/migrations/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH `/api/v1/mdm/migrations/{publicId}`

PATCHmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

updateMdmMigration edits a draft, adds serials to it, skips or retries devices, or cancels the migration (state “canceled”).

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`abmTokenId`	`string or null`
`addSerials`required	`array of string`
`adeProfileId`	`string or null`
`deadlineAt`	`string (date-time) or null`
`name`	`string or null`
`retrySerials`required	`array of string`
`rowVersion`required	`integer`	int64.
`skipSerials`required	`array of string`
`state`	`string or null`

Responses

Status	Body	Description
`200`	`application/json`, MdmMigrationView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	The migration changed since it was read. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`abmTokenId`	`string or null`
`adeProfileId`	`string or null`
`completedAt`	`string (date-time) or null`
`createdByUserId`	`string or null`
`deadlineAt`	`string (date-time) or null`
`devices`	`array of MdmMigrationDeviceView`
`devices[].agentId`	`string or null`
`devices[].reasonCode`	`string or null`
`devices[].serialNumber`required	`string`
`devices[].state`required	`string`
`devices[].updatedAt`required	`string (date-time)`
`method`required	`string`
`name`required	`string`
`progress`required	`object`
`publicId`required	`string`
`rowVersion`required	`integer`	int64.
`sourceMdm`required	`string`
`startedAt`	`string (date-time) or null`
`state`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/mdm/migrations/<publicId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "abmTokenId": "string",
  "addSerials": [
    "string"
  ],
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "name": "string",
  "retrySerials": [
    "string"
  ],
  "rowVersion": 0,
  "skipSerials": [
    "string"
  ],
  "state": "string"
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "abmTokenId": "string",
  "addSerials": [
    "string"
  ],
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "name": "string",
  "retrySerials": [
    "string"
  ],
  "rowVersion": 0,
  "skipSerials": [
    "string"
  ],
  "state": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/mdm/migrations/<publicId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "abmTokenId": "string",
    "addSerials": [
        "string",
    ],
    "adeProfileId": "string",
    "deadlineAt": "2026-01-01T00:00:00Z",
    "name": "string",
    "retrySerials": [
        "string",
    ],
    "rowVersion": 0,
    "skipSerials": [
        "string",
    ],
    "state": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "abmTokenId": "string",
  "addSerials": [
    "string"
  ],
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "name": "string",
  "retrySerials": [
    "string"
  ],
  "rowVersion": 0,
  "skipSerials": [
    "string"
  ],
  "state": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/mdm/migrations/<publicId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "abmTokenId": "string",
    "addSerials": [
      "string"
    ],
    "adeProfileId": "string",
    "deadlineAt": "2026-01-01T00:00:00Z",
    "name": "string",
    "retrySerials": [
      "string"
    ],
    "rowVersion": 0,
    "skipSerials": [
      "string"
    ],
    "state": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "abmTokenId": "string",
  "addSerials": [
    "string"
  ],
  "adeProfileId": "string",
  "deadlineAt": "2026-01-01T00:00:00Z",
  "name": "string",
  "retrySerials": [
    "string"
  ],
  "rowVersion": 0,
  "skipSerials": [
    "string"
  ],
  "state": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/mdm/migrations/<publicId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST `/api/v1/mdm/migrations/{publicId}/start`

POSTmdm:managetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

startMdmMigration starts a draft migration.

An ABM-coordinated batch is scheduled until Apple Business Manager accepts the reassignment; a re-enrollment batch is in progress at once.

Parameters

Name	In	Type	Required	Description
`publicId`	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
`rowVersion`required	`integer`	int64.

Responses

Status	Body	Description
`200`	`application/json`, MdmMigrationView	Success.
`400`	`application/problem+json`, ProblemDetails	The request body is not valid JSON.
`401`	`application/problem+json`, ProblemDetails	No signed-in identity.
`403`	`application/problem+json`, ProblemDetails	The identity does not hold mdm:manage.
`404`	`application/problem+json`, ProblemDetails	No resource matches that id.
`409`	`application/problem+json`, ProblemDetails	The migration changed since it was read. Reload and try again.
`500`	`application/problem+json`, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
`abmTokenId`	`string or null`
`adeProfileId`	`string or null`
`completedAt`	`string (date-time) or null`
`createdByUserId`	`string or null`
`deadlineAt`	`string (date-time) or null`
`devices`	`array of MdmMigrationDeviceView`
`devices[].agentId`	`string or null`
`devices[].reasonCode`	`string or null`
`devices[].serialNumber`required	`string`
`devices[].state`required	`string`
`devices[].updatedAt`required	`string (date-time)`
`method`required	`string`
`name`required	`string`
`progress`required	`object`
`publicId`required	`string`
`rowVersion`required	`integer`	int64.
`sourceMdm`required	`string`
`startedAt`	`string (date-time) or null`
`state`required	`string`

Request samples

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mdm/migrations/<publicId>/start' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "rowVersion": 0
}'

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mdm/migrations/<publicId>/start' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>/start"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mdm/migrations/<publicId>/start", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mdm/migrations/<publicId>/start";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mdm/migrations/<publicId>/start");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.

Depot mdmmigrations

GET /api/v1/mdm/migrations

Parameters

Responses

Request samples

POST /api/v1/mdm/migrations

Request body

Responses

Request samples

GET /api/v1/mdm/migrations/{publicId}

Parameters

Responses

Request samples

PATCH /api/v1/mdm/migrations/{publicId}

Parameters

Request body

Responses

Request samples

POST /api/v1/mdm/migrations/{publicId}/start

Parameters

Request body

Responses

Request samples

GET `/api/v1/mdm/migrations`

POST `/api/v1/mdm/migrations`

GET `/api/v1/mdm/migrations/{publicId}`

PATCH `/api/v1/mdm/migrations/{publicId}`

POST `/api/v1/mdm/migrations/{publicId}/start`