Product Office Hours #11 - Platform API, Terraform and Jamf-CLI - Oct 29th *Q&A in thread*

I pretty much know nothing about Terraform, does anyone have a good training reference?

Friendly reminder with the clocks changing in the UK already - this session will be at 10 am for those based in US central! 

Jamf has got your back.

https://concepts.jamf.com/en/guides/infrastructure-as-code/resources-for-getting-started-with-terraform-and-jamf/

https://developer.jamf.com/platform-api/docs/resources-terraform-github-and-jamf-configurations

https://github.com/Jamf-Concepts/terraform-jamf-reference/tree/ref-jamfplatform-starter

Thank you, lukec!

This week's Product Office Hours covered Platform API, Terraform and jamf-cli, with Hernán Romero (Senior Product Manager) and Neil Martin (Senior Systems Engineer). Here's every question asked during the session, pulled from both the live Q&A and the chat. 

Is the Platform API Gateway missing coverage? Some Classic endpoints don't respond yet, and there's a lot we want to move over. 

There should be very few gaps. For product APIs, the gateway mainly passes requests through to the same endpoints, including the Classic API. Some endpoints aren't published for security reasons, or because they're deprecated, and a newer version or modern replacement exists. 

Let us know what’s precisely missing in the Platform API Gateway and we’re happy to look into it. 

If a Jamf Pro or Classic endpoint returns 403, check the integration's scopes. 

What's the theoretical threshold for API requests in a given time? In a past role, a migration broke Jamf by sending too many requests too fast. 

The Platform API Gateway limits each API client to 200 requests per second. The limit is tracked by client ID, so each integration gets its own allowance. It's set well above the traffic of today's busiest integrations. It exists to protect the platform from runaway traffic and to give you a clear number to design around, rather than guessing where the limit is. 

Some capabilities behind the gateway also have their own service limits that could be lower than our rate limit. If you run into problems, let us know and we'll connect you with the right team. 

Community tip: rate limits are documented in the Platform API fundamentals guide on the developer portal: https://developer.jamf.com/platform-api/reference/platform-api-fundamentals#rate-limits 

Right now there's no visibility into API usage by endpoint or call volume, which leaves teams blind to intentional or accidental overuse. Are there plans to address this? 

Yes. Jamf has internal data on this, and it would be more useful if customers and partners could see it too. The aim is to show data and trends across all your API clients and workflows, so you can understand how your APIs are being used. This is something we're looking into for customers and partners alike. 

User-delegated access, which is also planned, should help here too, as it makes it easier to see the traffic going through each integration. 

Could the slide deck be shared after the session? 

Not always. Some sessions show things before anyone else has seen them, so sharing depends on the speaker and the topic. Most of it is already covered in Jamf Nation content. 

Some things are only shown live, so joining the session is the best way to catch them. 

Are the Jamf 300 and Jamf 400 training courses updated for all things Platform API, or will Jamf update training or add more certification levels, such as a Jamf Platform Expert? 

The Jamf 300 introduces API requests as part of intermediate scripting. The Jamf 400 goes deeper, working with the Jamf Pro API and the Classic API, and introduces Terraform and infrastructure-as-code as a starting point. You can find details on the Jamf 300 and Jamf 400 overview pages (https://www.jamf.com/training/300-course/ and https://www.jamf.com/training/400-course/). 

We're constantly updating our courses. The Jamf 400 overview video is also live on YouTube: https://www.youtube.com/watch?v=RSMUgeBuFdo 

As for certification titles, we're thinking about how to reflect the platform across certifications and courses. This feedback has been heard, and we look forward to what's ahead. 

How do you see jamf-cli and the Jamf platform Terraform provider working together? Should we lean into one over the other, and where do they overlap? 

They solve different problems but have some overlaps. Most teams end up using both. They both sit on top of our Go SDK and our Platform API Gateway. 

Terraform is for configuration you want to define and iterate on, such as policies, profiles, groups and categories. It gives you change history, review before anything goes live, one-step rollback and consistency across environments. jamf-cli is for more ad-hoc actions, integrated workflows, and finding things out: device actions, reports, lookups, bulk changes, scripts, CI/CD jobs and AI agent workflows. 

They overlap because both can create and update objects. Please note that if you apply changes to the same object with both, the two will keep overwriting each other. We’re looking into ways where both can work better together. 

Regardless, there’s no one way of using these tools, and we’re sure you’ll find very creative solutions with either. Both are open source solutions and we advocate for community input. 

jamf-cli is MIT licensed and the Terraform provider is MPL 2.0 licensed. Jamf officially supports our platform Terraform provider and is in the process of also officially supporting jamf-cli. The jamf-cli wiki has a Community Showcase page with examples of how people are already using it: https://github.com/Jamf-Concepts/jamf-cli/wiki/Community-Showcase.