---
title: "Depot portal remote"
description: "Every portal remote operation in the Depot API, with parameters, responses and code samples in six languages."
url: "https://support.outpostplatform.com/api/generated/depot/portalremote/"
product: "depot"
type: "reference"
status: "reviewed"
last_reviewed: 2026-11-06
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/depot/portalremote.mdx"
license: "CC BY 4.0"
---

# Depot portal remote

Registers the remote access routes; mountOrg calls it.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

### GET `/api/portal/v1/orgs/{clientID}/remote/endpoints` {#depot.portalRemote.listEndpoints}

**listRemoteEndpoints lists the endpoints the member can reach now, with the mode a session would take and whether it is recorded.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, PageRemoteEndpoint | Success. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}` {#depot.portalRemote.getEndpoint}

**getRemoteEndpoint is one endpoint the member can reach; 404 no_grant when they hold no live grant on it, whether or not it exists.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes |  |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, RemoteEndpoint | Success. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/policy` {#depot.portalRemote.getSessionPolicy}

**getRemoteSessionPolicy previews the policy a session would get: the mode the relay would choose, the modes it allows, recording, and what may cross the clipboard and file channels.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes |  |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, RemoteSessionPolicy | Success. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/sessions/{sessionID}/resume` {#depot.portalRemote.resumeSession}

**resumeRemoteSession resumes a session paused for idle (RD_VIEWER_UI_CONTRACTS 7.2), for the member running it, under a live grant, after a re-authentication made since the pause.**

Until there is one it answers reauth_required, which the portal turns into its re-auth dialog and a retry: the portal's form of the console's 428 step-up.

SensitiveAuthAt, not SensitiveSeenAt: the second moves on every sensitive
request, so it would let a click during the pause pass for a re-auth.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes |  |
| `clientID` | path | string | Yes |  |
| `sessionID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `204` | None | Success, with no body. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/sessions/<sessionID>/resume");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/signal` {#depot.portalRemote.signal}

**remoteSignal upgrades to the remote session WebSocket for one endpoint.**

It refuses in the Teams tab (remote pages open in the browser), demands a re-authentication within five minutes when the MSP requires step-up, and resolves the grants before upgrading.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes |  |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `101` | None | Switching protocols. The connection continues as a websocket; see x-outpost-transport. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This endpoint upgrades to a WebSocket. The sample shows the handshake only.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This endpoint upgrades to a WebSocket. The sample shows the handshake only.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/signal");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/endpoints/{agentID}/targets` {#depot.portalRemote.getTargets}

**getRemoteTargets lists the sessions on an endpoint the member holds a grant on (console users, RDP logons, the sign-in screen), asked of the agent now.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `agentID` | path | string | Yes |  |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, array of RemoteTarget | Success. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/endpoints/<agentID>/targets");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/grants` {#depot.portalRemote.listGrants}

**listRemoteGrants lists the organization's remote access grants; revoked ones too with ?includeRevoked=true.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |
| `includeRevoked` | query | string | No |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, PageGrantView | Success. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants"
params = {
    "includeRevoked": "<includeRevoked>",
}
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants");
url.searchParams.set("includeRevoked", "<includeRevoked>");

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants?includeRevoked=<includeRevoked>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/api/portal/v1/orgs/{clientID}/remote/grants` {#depot.portalRemote.createGrant}

**createRemoteGrant gives a person or group remote access to an endpoint, site, device group, tag or their assigned endpoints, within the MSP's ceiling and only to people who hold remote access.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |

#### Request body

Required, sent as `application/json`.

The body is `any`.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `201` | `application/json`, GrantView | Created. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := []byte(`"string"`)

	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
		"Content-Type": "application/json",
	},
	credentials: "include",
	body: JSON.stringify("string"),
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/grants/{grantID}` {#depot.portalRemote.getGrant}

**getRemoteGrant reads one grant.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |
| `grantID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, GrantView | Success. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### DELETE `/api/portal/v1/orgs/{clientID}/remote/grants/{grantID}` {#depot.portalRemote.revokeGrant}

**revokeRemoteGrant revokes a grant; live sessions under it end at once.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |
| `grantID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `204` | None | Success, with no body. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>";

const response = await fetch(url, {
	method: "DELETE",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/grants/<grantID>");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/policy` {#depot.portalRemote.getPolicy}

**getRemotePolicy reads the organization's remote policy and what the MSP leaves of it.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, PolicyView | Success. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:use. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### PUT `/api/portal/v1/orgs/{clientID}/remote/policy` {#depot.portalRemote.putPolicy}

**putRemotePolicy sets which modes the organization allows and the default mode for new grants, within the MSP's ceiling.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |

#### Request body

Required, sent as `application/json`.

The body is `any`.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, PolicyView | Success. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b '__Host-portal_session=<portal-session>' \
  --data '"string"'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$body = @'
"string"
'@

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}
payload = "string"

response = requests.put(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := []byte(`"string"`)

	req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy";

const response = await fetch(url, {
	method: "PUT",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
		"Content-Type": "application/json",
	},
	credentials: "include",
	body: JSON.stringify("string"),
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
"string"
""";

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/policy");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### GET `/api/portal/v1/orgs/{clientID}/remote/targets` {#depot.portalRemote.listGrantTargets}

**listGrantTargets lists what a new grant can reach: the organization's endpoints, sites, device groups and tags.**

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `clientID` | path | string | Yes |  |

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | `application/json`, TargetChoices | Success. |
| `400` | None | The request was refused. |
| `401` | `application/problem+json`, ProblemDetails | No signed-in identity. |
| `403` | `application/problem+json`, ProblemDetails | The identity does not hold portal:remote:grant. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches that id. |

#### Request samples

```bash
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets' \
  -H 'X-Csrf-Token: <portal-csrf>' \
  -H 'Accept: application/json' \
  -b '__Host-portal_session=<portal-session>'
```

```powershell
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-Csrf-Token' = '<portal-csrf>'
    'Accept' = 'application/json'
    'Cookie' = '__Host-portal_session=<portal-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# Sign in first. __Host-portal_session is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets"
headers = {
    "X-Csrf-Token": "<portal-csrf>",
    "Accept": "application/json",
}
cookies = {
    "__Host-portal_session": "<portal-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("X-Csrf-Token", "<portal-csrf>")
	req.Header.Set("Accept", "application/json")
	req.AddCookie(&http.Cookie{Name: "__Host-portal_session", Value: "<portal-session>"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"X-Csrf-Token": "<portal-csrf>",
		"Accept": "application/json",
	},
	credentials: "include",
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// Sign in first. __Host-portal_session is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/portal/v1/orgs/<clientID>/remote/targets");
request.Headers.TryAddWithoutValidation("X-Csrf-Token", "<portal-csrf>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "__Host-portal_session=<portal-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```