Skip to content

Add support for the Jamf Platform API gateway - #138

Open
Jordy Thery (JordyThery) wants to merge 2 commits into
jamf:mainfrom
JordyThery:feature/platform-api
Open

Jordy Thery (JordyThery) wants to merge 2 commits into
jamf:mainfrom
JordyThery:feature/platform-api

Conversation

@JordyThery

@JordyThery Jordy Thery (JordyThery) commented Oct 3, 2026 •

Copy link
Copy Markdown

Important

Depends on #137 (App Installers support). That PR's commit is included in this branch as its base — please review and merge #137 first; this PR will then contain only the single "Add support for the Jamf Platform API gateway" commit (rebase on request).

Summary

Adds the ability to connect to servers through the Jamf Platform API gateway using an integration created in Jamf Account, as an alternative to connecting to a Jamf Pro instance directly.

No new UI: the gateway region URL with the platform environment id appended is entered as the server address, together with the existing Use API Client option:

URL:           https://us.api.jamfcloud.com/<environmentId>
Use API Client: checked
Client ID:      <integration client id>
Client Secret:  <integration client secret>

The gateway can be used for the source and destination independently (including mixed gateway/direct migrations), from the UI and the command line (help text updated).

How it works

  • ApiRequest (new) centralizes endpoint URL and request header construction, previously repeated across the files making API calls. Call sites keep their exact URLs, auth styles, and content types — no functional change for direct connections.
  • When the server is a gateway (*.api.jamfcloud.com), ApiRequest routes Classic API calls through /proclassic/... and Jamf Pro API calls through /pro/..., and sends the X-Environment-Id header with every request (including multipart icon uploads).
  • Tokens are requested from the gateway token endpoint (/auth/token, client credentials, 900 second lifetime); the existing renewal logic handles the shorter lifetime unchanged.
  • The environment id is parsed from the server address in baseUrl() and kept per server, so stored credentials, the server list, and the last-user record all key off the gateway + environment combination.

Testing

Against a Jamf Pro 11.32 via both EU and US gateway (platform environment scope integration):

  • ✅ Bulk, selective, and delete (removal) with the gateway configured on both source and destination
  • ✅ Mixed mode: gateway source → direct destination and vice versa
  • ✅ Export to files and command line (-source https://us.api.jamfcloud.com/<environmentId> -sourceUseClientId true ...)
  • ✅ Direct (non-gateway) connections regression-tested — URLs and headers are byte-identical to before
  • API-level validation of the gateway: Classic XML GET/POST/PUT/DELETE, paged Jamf Pro API, icon upload (/pro/v1/icon), JCDS listing

Notes / limitations

  • The gateway has no sticky sessions; rapid read-after-write can briefly 404 (existing retry logic applies). Noted for documentation rather than code.
  • Legacy on-prem iconservlet icon URLs are not reachable through the gateway; Jamf Cloud instances serve icons from the public icon CDN, which works unchanged.

🤖 Generated with Claude Code

Jordy Thery and others added 2 commits October 3, 2026 15:31
Adds "App Installers" as a selectable object type on the macOS tab and
in selective migration, using the Jamf Pro API
v1/app-installers/deployments endpoints. Deployment records are copied
between servers with the category, site, smart computer group, and
Self Service category ids remapped by name on the destination server.
Deployments whose smart group cannot be found on the destination are
created without a scope and disabled. Supports bulk and selective
replication, export to and import from files, and removal.

Resolves jamf#105

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Connections can now be made through the Jamf Platform API gateway by
using the gateway region URL with the platform environment id appended
as the server address, e.g. https://us.api.jamfcloud.com/<environmentId>,
together with the client ID and secret of an integration created in
Jamf Account. Tokens are requested from the gateway token endpoint,
Classic and Jamf Pro API calls are routed through the gateway
/proclassic and /pro namespaces, and the X-Environment-Id header is
sent with every request. The gateway can be used for the source and
destination server independently, from both the UI and the command
line.

To support routing through the gateway, URL and request header
construction, previously repeated across the files making API calls,
is centralized in the new ApiRequest class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant