Depot portaladmin

Registers the client portal’s MSP admin routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/clients/{clientID}/portal/groups

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listGroups lists the client’s portal groups.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PageGroupView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of GroupView
items[].descriptionrequired	string
items[].directoryGroupRef	string or null
items[].directorySource	string or null
items[].idrequired	string
items[].memberCountrequired	integer
items[].namerequired	string
items[].roleIdsrequired	array of string
items[].rowVersionrequired	integer	int64.
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/groups

POSTclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

createGroup creates a portal group with roles.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
name	string or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Responses

Status	Body	Description
201	application/json, GroupView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
descriptionrequired	string
directoryGroupRef	string or null
directorySource	string or null
idrequired	string
memberCountrequired	integer
namerequired	string
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "name": "string",
    "roleIds": [
        "string",
    ],
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "name": "string",
    "roleIds": [
      "string"
    ],
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/groups/{groupID}

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getGroup reads one portal group.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
groupID	path	string	Yes

Responses

Status	Body	Description
200	application/json, GroupView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
descriptionrequired	string
directoryGroupRef	string or null
directorySource	string or null
idrequired	string
memberCountrequired	integer
namerequired	string
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/clients/{clientID}/portal/groups/{groupID}

PATCHclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

patchGroup renames or redescribes a portal group.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
groupID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
name	string or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Responses

Status	Body	Description
200	application/json, GroupView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
descriptionrequired	string
directoryGroupRef	string or null
directorySource	string or null
idrequired	string
memberCountrequired	integer
namerequired	string
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "name": "string",
    "roleIds": [
        "string",
    ],
    "rowVersion": 0,
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "name": "string",
    "roleIds": [
      "string"
    ],
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "name": "string",
  "roleIds": [
    "string"
  ],
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/clients/{clientID}/portal/groups/{groupID}

DELETEclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

deleteGroup deletes a portal group and the remote grants made to it.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
groupID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/clients/{clientID}/portal/groups/{groupID}/members

PUTclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putGroupMembers replaces a portal group’s hand-added members.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
groupID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
memberIdsrequired	array of string

Responses

Status	Body	Description
200	application/json, GroupView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
descriptionrequired	string
directoryGroupRef	string or null
directorySource	string or null
idrequired	string
memberCountrequired	integer
namerequired	string
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "memberIds": [
    "string"
  ]
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "memberIds": [
    "string"
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "memberIds": [
        "string",
    ],
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "memberIds": [
    "string"
  ]
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "memberIds": [
      "string"
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "memberIds": [
    "string"
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/members");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/clients/{clientID}/portal/groups/{groupID}/roles

PUTclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putGroupRoles replaces a portal group’s roles.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
groupID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
roleIdsrequired	array of string

Responses

Status	Body	Description
200	application/json, GroupView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
descriptionrequired	string
directoryGroupRef	string or null
directorySource	string or null
idrequired	string
memberCountrequired	integer
namerequired	string
roleIdsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "roleIds": [
    "string"
  ]
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "roleIds": [
    "string"
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "roleIds": [
        "string",
    ],
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "roleIds": [
    "string"
  ]
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "roleIds": [
      "string"
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "roleIds": [
    "string"
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/clients/<clientID>/portal/groups/<groupID>/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/members

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listMembers lists the client’s portal members, every status.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PageMemberView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of MemberView
items[].activatedAt	string (date-time) or null
items[].createdByrequired	ActorView	ActorView is who made a change.
items[].createdBy.kindrequired	string
items[].createdBy.label	string or null
items[].createdBy.refrequired	string
items[].displayNamerequired	string
items[].emailrequired	string
items[].groupIdsrequired	array of string
items[].idrequired	string
items[].identityIdrequired	string
items[].invitedAtrequired	string (date-time)
items[].lastSignInAt	string (date-time) or null
items[].namedUser	NamedUserRef	NamedUserRef is the linked person on a member.
items[].namedUser.displayNamerequired	string
items[].namedUser.idrequired	string
items[].namedUserId	string or null
items[].offboardedAt	string (date-time) or null
items[].roleIdsrequired	array of string
items[].rowVersionrequired	integer	int64.
items[].statusrequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/members' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/members", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/members");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/members

POSTclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

inviteMember invites a person to the client’s portal by email.

The first person invited with no roles is the client’s owner.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
displayNamerequired	string
emailrequired	string
namedUserId	string or null
roleIdsrequired	array of string

Responses

Status	Body	Description
201	application/json, MemberView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
activatedAt	string (date-time) or null
createdByrequired	ActorView	ActorView is who made a change.
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
displayNamerequired	string
emailrequired	string
groupIdsrequired	array of string
idrequired	string
identityIdrequired	string
invitedAtrequired	string (date-time)
lastSignInAt	string (date-time) or null
namedUser	NamedUserRef	NamedUserRef is the linked person on a member.
namedUser.displayNamerequired	string
namedUser.idrequired	string
namedUserId	string or null
offboardedAt	string (date-time) or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.
statusrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/members' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "displayName": "string",
  "email": "string",
  "namedUserId": "string",
  "roleIds": [
    "string"
  ]
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "displayName": "string",
  "email": "string",
  "namedUserId": "string",
  "roleIds": [
    "string"
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "displayName": "string",
    "email": "string",
    "namedUserId": "string",
    "roleIds": [
        "string",
    ],
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "displayName": "string",
  "email": "string",
  "namedUserId": "string",
  "roleIds": [
    "string"
  ]
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/members", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "displayName": "string",
    "email": "string",
    "namedUserId": "string",
    "roleIds": [
      "string"
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "displayName": "string",
  "email": "string",
  "namedUserId": "string",
  "roleIds": [
    "string"
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/members");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/members/{memberID}

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getMember reads one portal member.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Responses

Status	Body	Description
200	application/json, MemberView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
activatedAt	string (date-time) or null
createdByrequired	ActorView	ActorView is who made a change.
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
displayNamerequired	string
emailrequired	string
groupIdsrequired	array of string
idrequired	string
identityIdrequired	string
invitedAtrequired	string (date-time)
lastSignInAt	string (date-time) or null
namedUser	NamedUserRef	NamedUserRef is the linked person on a member.
namedUser.displayNamerequired	string
namedUser.idrequired	string
namedUserId	string or null
offboardedAt	string (date-time) or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.
statusrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/clients/{clientID}/portal/members/{memberID}

PATCHclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

patchMember renames a member, links them to a named user, or suspends or reinstates them.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
displayName	string or null
namedUserId	string or null
rowVersionrequired	integer	int64.
status	string or null

Responses

Status	Body	Description
200	application/json, MemberView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
activatedAt	string (date-time) or null
createdByrequired	ActorView	ActorView is who made a change.
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
displayNamerequired	string
emailrequired	string
groupIdsrequired	array of string
idrequired	string
identityIdrequired	string
invitedAtrequired	string (date-time)
lastSignInAt	string (date-time) or null
namedUser	NamedUserRef	NamedUserRef is the linked person on a member.
namedUser.displayNamerequired	string
namedUser.idrequired	string
namedUserId	string or null
offboardedAt	string (date-time) or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.
statusrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "displayName": "string",
  "namedUserId": "string",
  "rowVersion": 0,
  "status": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "displayName": "string",
  "namedUserId": "string",
  "rowVersion": 0,
  "status": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "displayName": "string",
    "namedUserId": "string",
    "rowVersion": 0,
    "status": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "displayName": "string",
  "namedUserId": "string",
  "rowVersion": 0,
  "status": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "displayName": "string",
    "namedUserId": "string",
    "rowVersion": 0,
    "status": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "displayName": "string",
  "namedUserId": "string",
  "rowVersion": 0,
  "status": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/clients/{clientID}/portal/members/{memberID}

DELETEclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

offboardMember ends a member’s portal access at once: grants, open invites, live remote sessions, and their sessions when this was their last organization.

The MSP may remove a departing client’s last owner.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/members/{memberID}/effective-permissions

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

memberEffective previews a member (“view as”): the permissions they hold now, and what their roles grant that the ceiling clips.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Responses

Status	Body	Description
200	application/json, EffectiveView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
clippedrequired	array of string
grantedrequired	array of string
memberIdrequired	string
permissionsrequired	array of string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/effective-permissions");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/members/{memberID}/resend

POSTclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

resendInvite mails a fresh invitation and revokes the previous link.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/resend");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/clients/{clientID}/portal/members/{memberID}/roles

PUTclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putMemberRoles replaces a member’s roles.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
memberID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
roleIdsrequired	array of string

Responses

Status	Body	Description
200	application/json, MemberView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
activatedAt	string (date-time) or null
createdByrequired	ActorView	ActorView is who made a change.
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
displayNamerequired	string
emailrequired	string
groupIdsrequired	array of string
idrequired	string
identityIdrequired	string
invitedAtrequired	string (date-time)
lastSignInAt	string (date-time) or null
namedUser	NamedUserRef	NamedUserRef is the linked person on a member.
namedUser.displayNamerequired	string
namedUser.idrequired	string
namedUserId	string or null
offboardedAt	string (date-time) or null
roleIdsrequired	array of string
rowVersionrequired	integer	int64.
statusrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "roleIds": [
    "string"
  ]
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "roleIds": [
    "string"
  ]
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "roleIds": [
        "string",
    ],
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "roleIds": [
    "string"
  ]
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "roleIds": [
      "string"
    ]
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "roleIds": [
    "string"
  ]
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/clients/<clientID>/portal/members/<memberID>/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/named-users

GETclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

searchNamedUsers finds the client’s people for linking a portal member (the “assigned to me” remote grant goes through the link).

Names and addresses only; q matches the start of a word in either.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No

Responses

Status	Body	Description
200	application/json, PageNamedUserHit	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of NamedUserHit
items[].displayNamerequired	string
items[].email	string or null
items[].idrequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/named-users?page=0&pageSize=0&q=<q>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/named-users?page=0&pageSize=0&q=<q>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/named-users"
params = {
    "page": "0",
    "pageSize": "0",
    "q": "<q>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/named-users?page=0&pageSize=0&q=<q>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/clients/<clientID>/portal/named-users");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("q", "<q>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/named-users?page=0&pageSize=0&q=<q>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/permissions

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listPermissions lists the portal permission catalog, marking what the client’s ceiling allows: the ceiling editor’s checkbox tree.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, array of PermissionView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
[].allowedByCeilingrequired	boolean
[].arearequired	string
[].coderequired	string
[].descriptionrequired	string
[].impliesrequired	array of string
[].namerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/permissions' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/permissions' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/permissions"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/permissions", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/permissions";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/permissions");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/roles

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

listRoles lists the client’s portal roles, with codes the ceiling clips.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PageRoleView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
itemsrequired	array of RoleView
items[].clippedPermissionsrequired	array of string
items[].code	string or null
items[].descriptionrequired	string
items[].idrequired	string
items[].isSystemrequired	boolean
items[].memberCountrequired	integer
items[].namerequired	string
items[].permissionsrequired	array of string
items[].rowVersionrequired	integer	int64.
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/clients/{clientID}/portal/roles

POSTclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

createRole creates a custom portal role within the ceiling.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
name	string or null
permissions	array of string or null
rowVersionrequired	integer	int64.

Responses

Status	Body	Description
201	application/json, RoleView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

201 response body

Field	Type	Description
clippedPermissionsrequired	array of string
code	string or null
descriptionrequired	string
idrequired	string
isSystemrequired	boolean
memberCountrequired	integer
namerequired	string
permissionsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "name": "string",
    "permissions": [
        "string",
    ],
    "rowVersion": 0,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "name": "string",
    "permissions": [
      "string"
    ],
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/roles/{roleID}

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getRole reads one portal role.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
roleID	path	string	Yes

Responses

Status	Body	Description
200	application/json, RoleView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
clippedPermissionsrequired	array of string
code	string or null
descriptionrequired	string
idrequired	string
isSystemrequired	boolean
memberCountrequired	integer
namerequired	string
permissionsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/clients/{clientID}/portal/roles/{roleID}

PATCHclientportal:usersmsp facemsp

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

patchRole edits a portal role (never the owner role).

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
roleID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
description	string or null
name	string or null
permissions	array of string or null
rowVersionrequired	integer	int64.

Responses

Status	Body	Description
200	application/json, RoleView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
clippedPermissionsrequired	array of string
code	string or null
descriptionrequired	string
idrequired	string
isSystemrequired	boolean
memberCountrequired	integer
namerequired	string
permissionsrequired	array of string
rowVersionrequired	integer	int64.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "description": "string",
    "name": "string",
    "permissions": [
        "string",
    ],
    "rowVersion": 0,
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "description": "string",
    "name": "string",
    "permissions": [
      "string"
    ],
    "rowVersion": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "description": "string",
  "name": "string",
  "permissions": [
    "string"
  ],
  "rowVersion": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/clients/{clientID}/portal/roles/{roleID}

DELETEclientportal:usersmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

deleteRole deletes a custom portal role.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
roleID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:users.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/clients/<clientID>/portal/roles/<roleID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/settings

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getClientSettings reads a client’s portal settings: whether the portal is on, the permission and remote-access ceilings, IdP MFA trust and how the audit trail names technicians.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalClientSettingsView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
auditNaming	string or null
clientIdrequired	string
dirSyncEnabledrequired	boolean
dirSyncLastError	string or null
dirSyncLastRunAt	string (date-time) or null
enabledrequired	boolean
permissionCeilingrequired	array of string
portalUrlrequired	string
remoterequired	PortalRemoteCeiling	PortalRemoteCeiling is the MSP's remote-access ceiling for a client.
remote.allowedModesrequired	array of string
remote.consentRequiredrequired	boolean
remote.enabledrequired	boolean
remote.maxGrantDays	integer or null
remote.recordingRequiredrequired	boolean
remote.stepUpMfarequired	boolean
rowVersionrequired	integer	int64.
trustIdpMfarequired	boolean

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/settings' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/settings", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/settings";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/clients/{clientID}/portal/settings

PUTclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putClientSettings turns the portal on or off and sets its ceilings.

Changing the remote-access ceiling also needs clientportal:remote. Lowering the permission ceiling rewrites no role: roles are clipped when read.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
auditNamingrequired	any	Arbitrary JSON.
dirSyncEnabled	boolean or null
enabled	boolean or null
permissionCeilingrequired	any	Arbitrary JSON.
remote	object or null
remote.allowedModes	array of string or null
remote.consentRequired	boolean or null
remote.enabled	boolean or null
remote.maxGrantDaysrequired	any	Arbitrary JSON.
remote.recordingRequired	boolean or null
remote.stepUpMfa	boolean or null
rowVersionrequired	integer	int64.
trustIdpMfa	boolean or null

Responses

Status	Body	Description
200	application/json, PortalClientSettingsView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Changing the remote access ceiling needs the clientportal:remote permission.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
auditNaming	string or null
clientIdrequired	string
dirSyncEnabledrequired	boolean
dirSyncLastError	string or null
dirSyncLastRunAt	string (date-time) or null
enabledrequired	boolean
permissionCeilingrequired	array of string
portalUrlrequired	string
remoterequired	PortalRemoteCeiling	PortalRemoteCeiling is the MSP's remote-access ceiling for a client.
remote.allowedModesrequired	array of string
remote.consentRequiredrequired	boolean
remote.enabledrequired	boolean
remote.maxGrantDays	integer or null
remote.recordingRequiredrequired	boolean
remote.stepUpMfarequired	boolean
rowVersionrequired	integer	int64.
trustIdpMfarequired	boolean

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/clients/<clientID>/portal/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "auditNaming": "string",
  "dirSyncEnabled": false,
  "enabled": false,
  "permissionCeiling": "string",
  "remote": {
    "allowedModes": [
      "string"
    ],
    "consentRequired": false,
    "enabled": false,
    "maxGrantDays": "string",
    "recordingRequired": false,
    "stepUpMfa": false
  },
  "rowVersion": 0,
  "trustIdpMfa": false
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "auditNaming": "string",
  "dirSyncEnabled": false,
  "enabled": false,
  "permissionCeiling": "string",
  "remote": {
    "allowedModes": [
      "string"
    ],
    "consentRequired": false,
    "enabled": false,
    "maxGrantDays": "string",
    "recordingRequired": false,
    "stepUpMfa": false
  },
  "rowVersion": 0,
  "trustIdpMfa": false
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/settings' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "auditNaming": "string",
    "dirSyncEnabled": False,
    "enabled": False,
    "permissionCeiling": "string",
    "remote": {
        "allowedModes": [
            "string",
        ],
        "consentRequired": False,
        "enabled": False,
        "maxGrantDays": "string",
        "recordingRequired": False,
        "stepUpMfa": False,
    },
    "rowVersion": 0,
    "trustIdpMfa": False,
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "auditNaming": "string",
  "dirSyncEnabled": false,
  "enabled": false,
  "permissionCeiling": "string",
  "remote": {
    "allowedModes": [
      "string"
    ],
    "consentRequired": false,
    "enabled": false,
    "maxGrantDays": "string",
    "recordingRequired": false,
    "stepUpMfa": false
  },
  "rowVersion": 0,
  "trustIdpMfa": false
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/clients/<clientID>/portal/settings", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/settings";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "auditNaming": "string",
    "dirSyncEnabled": false,
    "enabled": false,
    "permissionCeiling": "string",
    "remote": {
      "allowedModes": [
        "string"
      ],
      "consentRequired": false,
      "enabled": false,
      "maxGrantDays": "string",
      "recordingRequired": false,
      "stepUpMfa": false
    },
    "rowVersion": 0,
    "trustIdpMfa": false
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "auditNaming": "string",
  "dirSyncEnabled": false,
  "enabled": false,
  "permissionCeiling": "string",
  "remote": {
    "allowedModes": [
      "string"
    ],
    "consentRequired": false,
    "enabled": false,
    "maxGrantDays": "string",
    "recordingRequired": false,
    "stepUpMfa": false
  },
  "rowVersion": 0,
  "trustIdpMfa": false
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/clients/<clientID>/portal/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/clients/{clientID}/portal/sso

GETclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getSSO reads the client’s portal SSO: email domains and how each signs in (the Outpost broker or the client’s own IdP connection), whether the IdP’s MFA is trusted, and directory group mappings.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PortalSSOView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
dirSyncEnabledrequired	boolean
domainsrequired	array of PortalSsoDomainView
domains[].emailDomainrequired	string
domains[].idrequired	string
domains[].idpConnectionId	string or null
domains[].moderequired	string
domains[].providerrequired	string
domains[].tenantRef	string or null
groupMappingsrequired	array of PortalDirectoryMapping
groupMappings[].directoryGroupRef	string or null
groupMappings[].directorySource	string or null
groupMappings[].groupIdrequired	string
groupMappings[].groupNamerequired	string
rowVersionrequired	integer	int64.
trustIdpMfarequired	boolean

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/clients/<clientID>/portal/sso' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/sso' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/sso"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/clients/<clientID>/portal/sso", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/sso";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/clients/<clientID>/portal/sso");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/clients/{clientID}/portal/sso

PUTclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putSSO changes the client’s portal SSO.

Everything is validated before anything is written.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
dirSyncEnabled	boolean or null
domains	array of object or null
domains[].emailDomainrequired	string
domains[].idpConnectionId	string or null
domains[].moderequired	string
domains[].providerrequired	string
domains[].tenantRef	string or null
groupMappingsrequired	array of PortalDirectoryMapping
groupMappings[].directoryGroupRef	string or null
groupMappings[].directorySource	string or null
groupMappings[].groupIdrequired	string
groupMappings[].groupNamerequired	string
rowVersionrequired	integer	int64.
trustIdpMfa	boolean or null

Responses

Status	Body	Description
200	application/json, PortalSSOView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
404	application/problem+json, ProblemDetails	No client matches that id.
500	application/problem+json, ProblemDetails	Could not read the client’s portal settings.

200 response body

Field	Type	Description
dirSyncEnabledrequired	boolean
domainsrequired	array of PortalSsoDomainView
domains[].emailDomainrequired	string
domains[].idrequired	string
domains[].idpConnectionId	string or null
domains[].moderequired	string
domains[].providerrequired	string
domains[].tenantRef	string or null
groupMappingsrequired	array of PortalDirectoryMapping
groupMappings[].directoryGroupRef	string or null
groupMappings[].directorySource	string or null
groupMappings[].groupIdrequired	string
groupMappings[].groupNamerequired	string
rowVersionrequired	integer	int64.
trustIdpMfarequired	boolean

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/clients/<clientID>/portal/sso' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "dirSyncEnabled": false,
  "domains": [
    {
      "emailDomain": "string",
      "idpConnectionId": "string",
      "mode": "string",
      "provider": "string",
      "tenantRef": "string"
    }
  ],
  "groupMappings": [
    {
      "directoryGroupRef": "string",
      "directorySource": "string",
      "groupId": "string",
      "groupName": "string"
    }
  ],
  "rowVersion": 0,
  "trustIdpMfa": false
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "dirSyncEnabled": false,
  "domains": [
    {
      "emailDomain": "string",
      "idpConnectionId": "string",
      "mode": "string",
      "provider": "string",
      "tenantRef": "string"
    }
  ],
  "groupMappings": [
    {
      "directoryGroupRef": "string",
      "directorySource": "string",
      "groupId": "string",
      "groupName": "string"
    }
  ],
  "rowVersion": 0,
  "trustIdpMfa": false
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/clients/<clientID>/portal/sso' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/clients/<clientID>/portal/sso"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "dirSyncEnabled": False,
    "domains": [
        {
            "emailDomain": "string",
            "idpConnectionId": "string",
            "mode": "string",
            "provider": "string",
            "tenantRef": "string",
        },
    ],
    "groupMappings": [
        {
            "directoryGroupRef": "string",
            "directorySource": "string",
            "groupId": "string",
            "groupName": "string",
        },
    ],
    "rowVersion": 0,
    "trustIdpMfa": False,
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "dirSyncEnabled": false,
  "domains": [
    {
      "emailDomain": "string",
      "idpConnectionId": "string",
      "mode": "string",
      "provider": "string",
      "tenantRef": "string"
    }
  ],
  "groupMappings": [
    {
      "directoryGroupRef": "string",
      "directorySource": "string",
      "groupId": "string",
      "groupName": "string"
    }
  ],
  "rowVersion": 0,
  "trustIdpMfa": false
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/clients/<clientID>/portal/sso", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/clients/<clientID>/portal/sso";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "dirSyncEnabled": false,
    "domains": [
      {
        "emailDomain": "string",
        "idpConnectionId": "string",
        "mode": "string",
        "provider": "string",
        "tenantRef": "string"
      }
    ],
    "groupMappings": [
      {
        "directoryGroupRef": "string",
        "directorySource": "string",
        "groupId": "string",
        "groupName": "string"
      }
    ],
    "rowVersion": 0,
    "trustIdpMfa": false
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "dirSyncEnabled": false,
  "domains": [
    {
      "emailDomain": "string",
      "idpConnectionId": "string",
      "mode": "string",
      "provider": "string",
      "tenantRef": "string"
    }
  ],
  "groupMappings": [
    {
      "directoryGroupRef": "string",
      "directorySource": "string",
      "groupId": "string",
      "groupName": "string"
    }
  ],
  "rowVersion": 0,
  "trustIdpMfa": false
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/clients/<clientID>/portal/sso");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/portal/settings

GETclientportal:readmsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

getPracticeSettings reads the practice’s portal defaults: technician naming in client audit trails, session limits, invite lifetime and notification defaults.

Responses

Status	Body	Description
200	application/json, PortalPracticeSettingsView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:read.
500	application/problem+json, ProblemDetails	Could not read the portal defaults.

200 response body

Field	Type	Description
absoluteHoursrequired	integer
auditNamingrequired	string
digestHourLocalrequired	integer
eventsrequired	array of PortalEventView
events[].defaultChannelrequired	string
events[].kindrequired	string
events[].labelrequired	string
events[].neverOffrequired	boolean
events[].permissionrequired	string
idleMinutesrequired	integer
inviteDaysrequired	integer
notificationDefaultsrequired	object
rowVersionrequired	integer	int64.
sensitiveReauthMinutesrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/portal/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/portal/settings' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/portal/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/portal/settings", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/portal/settings";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/portal/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/portal/settings

PUTclientportal:managemsp facemspIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID}/portal/branding to reach one client.

Source: [object Object]

putPracticeSettings changes the practice’s portal defaults.

SensitiveReauthMinutes never exceeds 15 (PCI DSS 8.2.8).

Request body

Required, sent as application/json.

Field	Type	Description
absoluteHours	integer or null
auditNaming	string or null
digestHourLocal	integer or null
idleMinutes	integer or null
inviteDays	integer or null
notificationDefaults	object or null
rowVersionrequired	integer	int64.
sensitiveReauthMinutes	integer or null

Responses

Status	Body	Description
200	application/json, PortalPracticeSettingsView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold clientportal:manage.
500	application/problem+json, ProblemDetails	Could not read the portal defaults.

200 response body

Field	Type	Description
absoluteHoursrequired	integer
auditNamingrequired	string
digestHourLocalrequired	integer
eventsrequired	array of PortalEventView
events[].defaultChannelrequired	string
events[].kindrequired	string
events[].labelrequired	string
events[].neverOffrequired	boolean
events[].permissionrequired	string
idleMinutesrequired	integer
inviteDaysrequired	integer
notificationDefaultsrequired	object
rowVersionrequired	integer	int64.
sensitiveReauthMinutesrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/portal/settings' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "absoluteHours": 0,
  "auditNaming": "string",
  "digestHourLocal": 0,
  "idleMinutes": 0,
  "inviteDays": 0,
  "notificationDefaults": {
    "key": "string"
  },
  "rowVersion": 0,
  "sensitiveReauthMinutes": 0
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "absoluteHours": 0,
  "auditNaming": "string",
  "digestHourLocal": 0,
  "idleMinutes": 0,
  "inviteDays": 0,
  "notificationDefaults": {
    "key": "string"
  },
  "rowVersion": 0,
  "sensitiveReauthMinutes": 0
}
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/portal/settings' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/portal/settings"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "absoluteHours": 0,
    "auditNaming": "string",
    "digestHourLocal": 0,
    "idleMinutes": 0,
    "inviteDays": 0,
    "notificationDefaults": {
        "key": "string",
    },
    "rowVersion": 0,
    "sensitiveReauthMinutes": 0,
}

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "absoluteHours": 0,
  "auditNaming": "string",
  "digestHourLocal": 0,
  "idleMinutes": 0,
  "inviteDays": 0,
  "notificationDefaults": {
    "key": "string"
  },
  "rowVersion": 0,
  "sensitiveReauthMinutes": 0
}`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/portal/settings", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/portal/settings";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "absoluteHours": 0,
    "auditNaming": "string",
    "digestHourLocal": 0,
    "idleMinutes": 0,
    "inviteDays": 0,
    "notificationDefaults": {
      "key": "string"
    },
    "rowVersion": 0,
    "sensitiveReauthMinutes": 0
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "absoluteHours": 0,
  "auditNaming": "string",
  "digestHourLocal": 0,
  "idleMinutes": 0,
  "inviteDays": 0,
  "notificationDefaults": {
    "key": "string"
  },
  "rowVersion": 0,
  "sensitiveReauthMinutes": 0
}
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/portal/settings");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());