Depot portal remote

Registers the remote access routes; mountOrg calls it.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/portal/v1/orgs/{clientID}/remote/endpoints

GETportal:remote:useportal facemspIdempotent

Source: [object Object]

listRemoteEndpoints lists the endpoints the member can reach now, with the mode a session would take and whether it is recorded.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PageRemoteEndpoint	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
itemsrequired	array of RemoteEndpoint
items[].agentIdrequired	string
items[].allowedModerequired	string
items[].capabilities	array of string
items[].grantIdrequired	string
items[].hostnamerequired	string
items[].onlinerequired	boolean
items[].osFamily	string
items[].recordingrequired	boolean
items[].screenCapture	string
items[].siteName	string or null
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}

GETportal:remote:useportal facemspIdempotent

Source: [object Object]

getRemoteEndpoint is one endpoint the member can reach; 404 no_grant when they hold no live grant on it, whether or not it exists.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, RemoteEndpoint	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
agentIdrequired	string
allowedModerequired	string
capabilities	array of string
grantIdrequired	string
hostnamerequired	string
onlinerequired	boolean
osFamily	string
recordingrequired	boolean
screenCapture	string
siteName	string or null

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/policy

GETportal:remote:useportal facemspIdempotent

Source: [object Object]

getRemoteSessionPolicy previews the policy a session would get: the mode the relay would choose, the modes it allows, recording, and what may cross the clipboard and file channels.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, RemoteSessionPolicy	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
allowedModesrequired	array of string
moderequired	string
recordingRequiredrequired	boolean
transferrequired	RemoteTransferPolicyView	RemoteTransferPolicyView is the clipboard and file-transfer policy the relay will sign into the session's token, as the console reads it.
transfer.audit_hash_to_endpointrequired	string, one of keyed, none, plain
transfer.audit_hash_to_technicianrequired	string
transfer.audit_names_to_endpointrequired	string, one of file_name, full_path, name_hash, path_hash
transfer.audit_names_to_technicianrequired	string
transfer.audit_sizes_to_endpointrequired	string, one of exact, summary
transfer.audit_sizes_to_technicianrequired	string
transfer.clipboard_imagesrequired	array of string
transfer.clipboard_textrequired	array of string
transfer.filesrequired	array of string
transfer.lockedByrequired	object
transfer.max_file_bytes	integer	int64.
transfer.max_session_bytes	integer	int64.
transfer.require_verification	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/sessions/{sessionID}/resume

POSTportal:remote:useportal facemsp

Source: [object Object]

resumeRemoteSession resumes a session paused for idle (RD_VIEWER_UI_CONTRACTS 7.2), for the member running it, under a live grant, after a re-authentication made since the pause.

Until there is one it answers reauth_required, which the portal turns into its re-auth dialog and a retry: the portal’s form of the console’s 428 step-up.

SensitiveAuthAt, not SensitiveSeenAt: the second moves on every sensitive request, so it would let a click during the pause pass for a re-auth.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
clientID	path	string	Yes
sessionID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/signal

GETportal:remote:useportal facemspIdempotentWebSocket

Source: [object Object]

remoteSignal upgrades to the remote session WebSocket for one endpoint.

It refuses in the Teams tab (remote pages open in the browser), demands a re-authentication within five minutes when the MSP requires step-up, and resolves the grants before upgrading.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
clientID	path	string	Yes

Responses

Status	Body	Description
101	None	Switching protocols. The connection continues as a websocket; see x-outpost-transport.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/targets

GETportal:remote:useportal facemspIdempotent

Source: [object Object]

getRemoteTargets lists the sessions on an endpoint the member holds a grant on (console users, RDP logons, the sign-in screen), asked of the agent now.

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, array of RemoteTarget	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
[].availablerequired	boolean
[].displayrequired	string
[].displayStaterequired	string
[].kindrequired	string
[].lockStaterequired	string
[].occupiedrequired	boolean
[].osSessionIdrequired	string
[].reasonrequired	string
[].refrequired	string
[].sessionTyperequired	string
[].staterequired	string
[].userrequired	string
[].windowsSessionIdrequired	integer

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/grants

GETportal:remote:grantportal facemspIdempotent

Source: [object Object]

listRemoteGrants lists the organization’s remote access grants; revoked ones too with ?includeRevoked=true.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
includeRevoked	query	string	No

Responses

Status	Body	Description
200	application/json, PageGrantView	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
itemsrequired	array of GrantView
items[].capabilitiesrequired	array of string
items[].coveredEndpointCountrequired	integer
items[].createdAtrequired	string (date-time)
items[].createdByrequired	Actor	Actor is who created a grant on the wire (contract 8.4 Actor).
items[].createdBy.kindrequired	string
items[].createdBy.label	string or null
items[].createdBy.refrequired	string
items[].endsAt	string (date-time) or null
items[].groupId	string or null
items[].idrequired	string
items[].liverequired	boolean
items[].memberId	string or null
items[].moderequired	string
items[].noterequired	string
items[].recordingRequiredrequired	boolean
items[].revokeReason	string or null
items[].revokedAt	string (date-time) or null
items[].startsAtrequired	string (date-time)
items[].targetKindrequired	string
items[].targetLabelrequired	string
items[].targetRef	string or null
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants"
params = {
    "includeRevoked": "<includeRevoked>",
}
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants");
url.searchParams.set("includeRevoked", "<includeRevoked>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/portal/v1/orgs/{clientID}/remote/grants

POSTportal:remote:grantportal facemsp

Source: [object Object]

createRemoteGrant gives a person or group remote access to an endpoint, site, device group, tag or their assigned endpoints, within the MSP’s ceiling and only to people who hold remote access.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
201	application/json, GrantView	Created.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

201 response body

Field	Type	Description
capabilitiesrequired	array of string
coveredEndpointCountrequired	integer
createdAtrequired	string (date-time)
createdByrequired	Actor	Actor is who created a grant on the wire (contract 8.4 Actor).
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
endsAt	string (date-time) or null
groupId	string or null
idrequired	string
liverequired	boolean
memberId	string or null
moderequired	string
noterequired	string
recordingRequiredrequired	boolean
revokeReason	string or null
revokedAt	string (date-time) or null
startsAtrequired	string (date-time)
targetKindrequired	string
targetLabelrequired	string
targetRef	string or null

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/grants/{grantID}

GETportal:remote:grantportal facemspIdempotent

Source: [object Object]

getRemoteGrant reads one grant.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
grantID	path	string	Yes

Responses

Status	Body	Description
200	application/json, GrantView	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
capabilitiesrequired	array of string
coveredEndpointCountrequired	integer
createdAtrequired	string (date-time)
createdByrequired	Actor	Actor is who created a grant on the wire (contract 8.4 Actor).
createdBy.kindrequired	string
createdBy.label	string or null
createdBy.refrequired	string
endsAt	string (date-time) or null
groupId	string or null
idrequired	string
liverequired	boolean
memberId	string or null
moderequired	string
noterequired	string
recordingRequiredrequired	boolean
revokeReason	string or null
revokedAt	string (date-time) or null
startsAtrequired	string (date-time)
targetKindrequired	string
targetLabelrequired	string
targetRef	string or null

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/portal/v1/orgs/{clientID}/remote/grants/{grantID}

DELETEportal:remote:grantportal facemspIdempotent

Source: [object Object]

revokeRemoteGrant revokes a grant; live sessions under it end at once.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes
grantID	path	string	Yes

Responses

Status	Body	Description
204	None	Success, with no body.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/policy

GETportal:remote:useportal facemspIdempotent

Source: [object Object]

getRemotePolicy reads the organization’s remote policy and what the MSP leaves of it.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, PolicyView	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:use.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
allowedModesrequired	array of string
consentRequiredrequired	boolean
defaultAssignedModerequired	string
defaultOtherModerequired	string
effectiveAllowedModesrequired	array of string
maxGrantDays	integer or null
recordingRequiredrequired	boolean
remoteEnabledrequired	boolean
rowVersionrequired	integer	int64.
stepUpMfarequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/portal/v1/orgs/{clientID}/remote/policy

PUTportal:remote:grantportal facemspIdempotent

Source: [object Object]

putRemotePolicy sets which modes the organization allows and the default mode for new grants, within the MSP’s ceiling.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Request body

Required, sent as application/json.

The body is any.

Responses

Status	Body	Description
200	application/json, PolicyView	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
allowedModesrequired	array of string
consentRequiredrequired	boolean
defaultAssignedModerequired	string
defaultOtherModerequired	string
effectiveAllowedModesrequired	array of string
maxGrantDays	integer or null
recordingRequiredrequired	boolean
remoteEnabledrequired	boolean
rowVersionrequired	integer	int64.
stepUpMfarequired	boolean

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`"string"`)

  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify("string"),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/portal/v1/orgs/{clientID}/remote/targets

GETportal:remote:grantportal facemspIdempotent

Source: [object Object]

listGrantTargets lists what a new grant can reach: the organization’s endpoints, sites, device groups and tags.

Parameters

Name	In	Type	Required	Description
clientID	path	string	Yes

Responses

Status	Body	Description
200	application/json, TargetChoices	Success.
400	None	The request was refused.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold portal:remote:grant.
404	application/problem+json, ProblemDetails	No resource matches that id.

200 response body

Field	Type	Description
deviceGroupsrequired	array of TargetChoice
deviceGroups[].labelrequired	string
deviceGroups[].refrequired	string
endpointsrequired	array of TargetChoice
endpoints[].labelrequired	string
endpoints[].refrequired	string
sitesrequired	array of TargetChoice
sites[].labelrequired	string
sites[].refrequired	string
tagsrequired	array of TargetChoice
tags[].labelrequired	string
tags[].refrequired	string

Request samples

curl

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'

PowerShell

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-Csrf-Token", "<portal-csrf>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());