Make an authenticated request against any Jamf Platform API Gateway endpoint. The gateway also fronts the Jamf Pro API (300+ endpoints) and Jamf Pro Classic API (500+), so this reaches essentially the whole Jamf surface. Shapes: style "tenant" (default) builds /{version}/tenant/{tenantId}/{resource}; style "flat" omits the tenant segment and has never returned 200; rawPath is used verbatim after /api/{service}. For Classic use service "proclassic" with style "classic", which builds /tenant/{tenantId}/{resource} — no version segment, tenant filled in automatically, and no /JSSResource/ prefix, which does not exist on the gateway. The service segment may be more than one segment: Declaration Reporting is "ddm/report". Jamf Pro versions are per-resource (account-groups v1, enrollment v3, computers-inventory v4) — do not assume v1. READ-ONLY BY DESIGN: this tool issues GET and nothing else, and offers no method or body parameter. Writes go through named typed tools with narrow schemas, never through the passthrough, because a passthrough write is unreviewable — method, path and body would all be composed by the caller with nothing to constrain them. See JPM-0007.

List Blueprints for the configured tenant. Requires the read:pro:blueprints scope — note the scope prefix is "pro" while the URL service segment is "blueprints".

One-call fleet summary: device counts by platform and OS major, managed vs unmanaged, stale check-ins, device-group breakdown, and blueprint deployment states. Fetches devices, device groups and blueprints concurrently. NOTE the device total spans macOS AND iOS/iPadOS — it is not a Mac count. Sections that fail are reported individually rather than failing the whole call.

Search the fleet by serial number, device name, model, device id, or user id (case-insensitive substring). Spans macOS and iOS/iPadOS. Paginates the full device list and filters client-side, because the gateway has no confirmed server-side filter.

List devices whose OS major version is below a threshold, oldest first, with the freshest activity timestamp for each. Devices whose version is missing or unparseable are returned separately, because "unknown version" is a different finding from "old version". Spans macOS and iOS/iPadOS/tvOS.

Search device groups by name or description (case-insensitive substring), returning id, member count, deviceType and groupType. Covers both computer and mobile groups, smart and static, since the gateway returns them in one list.

List the devices in a device group, resolved to names, serials, platform and last-seen time. Accepts a group UUID or a name substring; an ambiguous name returns the candidate groups rather than guessing. Member ids with no matching device are reported separately, since a membership pointing at an absent device is itself worth knowing.

Audit Jamf scripts, computer extension attributes and policies for commands that burn CPU or battery when run repeatedly (du, find /, mdfind, system_profiler and similar), and report which policies run them and how often. Extension attributes are called out separately because they execute at EVERY inventory collection. Answers "what is cooking this laptop's battery". Read-only.

Read the tenant computer inventory collection settings and rate each option by how much work it adds per collection. Flags home_directory_sizes as high cost because Jamf computes it by running du across every user home directory — the usual cause of a du process under JamfDaemon burning battery. Pair with findExpensiveAutomations, which shows how often inventory is actually triggered.

Search smart computer group criteria, advanced computer search criteria, and advanced search display fields for a term — e.g. "Home Directory" to find out whether anything consumes that inventory field before disabling its collection. Matches field names and criterion values, case-insensitively. Reports what it did NOT check, because "no references found" is a weaker claim than a hit.

Report the declarative device management (DDM) state for one device: which declarations are applied, their status and validity, and — for anything that failed — the reasons Jamf gives. The companion to listBlueprints, since a Blueprint deploys declarations and this says whether they landed. Accepts a device UUID, or a substring of a name, serial, model or user; an ambiguous substring returns candidates rather than guessing. NOTE: Jamf excludes PENDING declarations from any filtered read, so a device mid-deployment will look emptier than it is — see excludedFromThisAnswer in the result.

Report every device reporting a given DDM declaration, with its status, validity and — for failures — the reasons Jamf gives, grouped so one cause affecting forty Macs reads as one problem rather than forty. Devices are resolved to names and serials, since the API returns bare UUIDs. The inverse of getDeviceDeclarationState. NOTE: Jamf excludes PENDING declarations from any filtered read and a filter is required, so devices still awaiting delivery are invisible — an all-healthy answer is NOT proof of full deployment. See excludedFromThisAnswer in the result.

Find everything that references a package, computer group or script — the check to run before deleting or changing one. Reports where each reference sits (scope, exclusion, script slot, group criterion) and distinguishes an EXCLUSION from an inclusion, since those mean opposite things. Names are matched exactly and case-insensitively, never as substrings. Critically, it reports which source kinds it could NOT check and what that means: a "clear" verdict requires full coverage, so most answers are partial-clear and must not be read as permission to delete. Coverage is in the strength field.

Map which computer groups depend on which others, via "Computer Group" membership criteria. Reports dependency cycles as their actual node paths, references to group names that do not exist, and — given a group — its blast radius: everything that transitively changes when that group's membership changes, with depth. A "not member of" criterion is reported distinctly from "member of", since treating one as the other inverts the meaning. Groups whose detail could not be fetched are named, because a group absent from the graph must not read as independent.

Read a computer group's criteria in evaluation order, with parentheses and and/or joins preserved, plus a member count. Flags criteria that will not do what they appear to: an unanchored "matches regex" tests whether a value CONTAINS a match rather than equals one, which turns "has failures" into "is not blank". Accepts a group id or a name substring; an ambiguous name returns candidates. Members are NOT included unless asked for, since the roster carries serials and MAC addresses and is rarely the question.