Skip to main content

Jamf Pro

Jamf Pro is an Apple device management (MDM) platform for managing macOS, iOS, iPadOS, and tvOS devices — inventory, configuration profiles, policies, and app deployment. The Willow connector talks to your Jamf Pro instance's modern REST API so agents can look up inventory and perform management actions under your governance policies.

Authentication Types​

Jamf Pro supports 1 authentication method:

  • API Roles & Clients (OAuth 2.0 client credentials) — a client ID and secret scoped to an API role you define in Jamf Pro
    • Pros: Least-privilege via granular API roles, no user password stored, tokens are short-lived and refreshed automatically
    • Cons: Requires Jamf Pro 10.49+ and admin access to create the API role and client

Configuration​

Before using the connector, you need to configure:

  • Jamf Pro URL — the base URL of your Jamf Pro instance, without a trailing slash (e.g. https://yourorg.jamfcloud.com). Willow calls the API at {jamfProUrl}/api/... and obtains tokens from {jamfProUrl}/api/v1/oauth/token.

Setting up API Roles & Clients​

  1. In Jamf Pro, go to Settings → System → API Roles and Clients.

  2. On the API Roles tab, click New. Give the role a name (e.g. Willow Integration) and add the privileges the integration needs — for example Read Computers, Read Mobile Devices, Read Buildings, and Read Departments. Click Save.

  3. On the API Clients tab, click New. Give the client a name, assign the API Role you just created, set an Access Token Lifetime, and enable API Client. Click Save.

  4. Open the client and click Generate Client Secret. Important: copy the secret immediately — it is only shown once. Note the Client ID as well.

  5. In Willow, paste the Client ID and Client Secret, and set the token URL to {jamfProUrl}/api/v1/oauth/token.

  6. Enter your Jamf Pro URL in the Configuration field (no trailing slash).

  7. Click Save Changes.

tip

Scope the API role to the minimum privileges the integration needs. Access tokens are short-lived; Willow requests and caches them automatically using the client credentials.

Common Use Cases​

Device Inventory​

  • List and search computers (macOS) and mobile devices (iOS/iPadOS/tvOS)
  • Retrieve full inventory detail for a specific device by ID
  • Filter by name, serial number, and other attributes using RSQL

Organization Data​

  • Browse buildings, departments, categories, and sites used to organize devices
  • List scripts and software packages stored in Jamf Pro
  • List computer groups (smart and static)

Management Actions​

  • Redeploy the Jamf management framework to repair an enrolled Mac's management state
  • Review the status of MDM commands issued by Jamf Pro

Available Tools​

The connector ships with tools across the following areas:

  • Instance — get Jamf Pro version (connectivity check)
  • Computers — list computers, get computer details, list computer groups
  • Mobile devices — list mobile devices, get mobile device details
  • Reference data — buildings, departments, categories, sites, scripts, packages
  • MDM — list MDM command statuses
  • Actions — redeploy Jamf management framework

Troubleshooting​

401 Unauthorized​

Cause: The client credentials are invalid, disabled, or the token URL is wrong.

Solution:

  1. Confirm the API Client is enabled in Jamf Pro.
  2. Regenerate the Client Secret and update it in Willow.
  3. Verify the token URL is {jamfProUrl}/api/v1/oauth/token.

403 Forbidden​

Cause: The API role lacks the privilege required for the requested operation.

Solution:

  1. Open the API Role in Settings → System → API Roles and Clients.
  2. Add the missing privilege (e.g. Read Computers) and save.

Connection or 404 Errors​

Cause: The Jamf Pro URL is incorrect or unreachable.

Solution:

  1. Verify the URL format: https://yourorg.jamfcloud.com (no trailing slash, no /api suffix — Willow appends the API path automatically).
  2. Ensure the instance is reachable from Willow's network.

Security Best Practices​

  1. Least privilege — grant the API role only the privileges the integration needs.
  2. Short token lifetime — keep the access token lifetime reasonable; Willow refreshes tokens automatically.
  3. Rotate secrets — regenerate the client secret periodically and revoke unused API clients.
  4. Guardrails — use Willow guards and conditions to gate management actions (e.g. redeploy) as needed.
On this page