API to PUT Scope

[bvondeylen]

The API documentation is not very clear on this.

When using the API to PUT (using XML) the scope of a Mobile Device Application, do you need to put the entire scope or only the addition?

for example:

The scope of an mobile device application has 3 groups already scoped. I would like to add a 4th group via API. Do I need to add all 4 or just the one I want to actually add? Before I begin experimenting, I would rather not have scoped groups removed.

Also, can I just add them by name, or must I have the group ID as well?

I am only attempting to scope Smart Groups to Mobile Device Applications. Intent is to allow teachers to assign their class a push app from our catalog. I have all the app in our catalog in a FileMaker Pro database (using GET API). Teachers can search the app catalog by Category, Keyword, or apps that are PAID or PUSHED. I want them to be able to add their SmartGroup (FileMaker know their SmartGroup by their login to the FileMaker database) to any PUSH app (they are all FREE and we have the licenses). This will allow the teacher to find the app, and click a button, which will update JAMF and viola, the app appears on the classroom set of iPads with no interaction with the JAMF administrator (me). :-)

[chriscollins]

@bvondeylen i believe you’d have to put all the groups intended in the scope in each submission, otherwise how would you delete groups from the scope of it just assumed everything was an add?

[Canniff]

I concur with chriscollins. You would need to resubmit all groups currently in scope with the new ones. If you were dealing with single ipads there are xml tags to update single ipads in a group's scope without needing to rePUT what's already there. <mobile_device_additions> and <mobile_device_deletions>

[bvondeylen]

I am using FileMaker do accomplish this. I have it working by re-scoping all devices or all groups.

But I am interested in how the <mobile_device_additions> and <mobile_device_deletions> work. Where is the documentation on these commands?

I am hoping teachers will be able to assign an app to themselves (device) or their class (group) from the Filemaker database. I can now have them assign an app that way, but when they are done, I would like them to be able to remove themselves as well. So the <mobile_device_deletions> intrigues me if it would remove their device (or group) from the specific scope.

[amoscowitch]

Curious if anyone has discovered a group analogue to mobile_device_additions but for mobile device groups? Would love to be able to have our SIS tell an app to add a group to its scope without having to read whats there already.

[Hugonaut]

I believe you're after something like this sir @amoscowitch

#!/bin/bash

# API Credentials
#########################################################################################

apiuser="USERNAME HERE"
apipass="PASSWORD HERE"
jssURL="https://jss.organization.org:8443"

GroupID="### HERE"
GroupName="GROUP NAME HERE"

### the Number 1 after ID is the identifier of the application you wish to add the group to 
MobileAPPURL="JSSResource/mobiledeviceapplications/id/1"

MobileDeviceGroup="<mobile_device_application><scope><mobile_device_groups><mobile_device_group><id>${GroupID}</id><name>${GroupName}</name></mobile_device_group></mobile_device_groups></scope></mobile_device_application>"


curl -sSkiu ${apiuser}:${apipass} "${jssURL}/${MobileAPPURL}" 
    -H "Content-Type: text/xml" 
    -d "${xmlHeader}${MobileDeviceGroup}" 
    -X PUT  > /dev/null

[Hugonaut]

not sure where to add the <mobile_device_additions> </mobile_device_additions> though in order to simply add groups verse rewrite the scope entirely.

[SamF]

The ability to add or remove groups from scope without affecting other groups previously within scope does not currently exist via the API. At least, not without also including the previously defined groups within the new update request.

[Hugonaut]

Thank you @Sam.Fortuna

Guess that means it's time for a feature request! - https://www.jamf.com/jamf-nation/feature-requests/8777/http-patch-api-implementation

[amoscowitch]

Is this a "make a feature request" scenario? The thought of keeping all that state in my SIS seems crazy.

[Deverall]

Does anyone know if it would be possible to script a way to pull existing scope of a configuration profile, maybe put it in an array, then PUT to write it back (plus whatever additions you want to make) as a workaround? I just know you can't make an array and loop through it as each loop would overwrite the previous change as it's a PUT command.

Hope that makes sense.