Skip to main content

Jamf Connector

Updated

Overview 

Jamf connects to Firstbase Workflows using the generic HTTP Request node combined with a Jamf OAuth2 API credential you create yourself.

Common Use Cases Include:

  • Creating a new asset in Jamf when a new device is purchased in Firstbase
  • Assigning a device to a user in Jamf when that device is assigned to them in Firstbase
  • Creating a new asset in Firstbase when a device exists in Jamf but hasn't been recorded in Firstbase

Connection Overview

Jamf Pro API:

This credential authenticates Firstbase Workflows against your Jamf Pro tenant's API using OAuth 2.0 (Client Credentials grant). This is Jamf's standard authentication pattern for system-to-system integrations, using an API Role and API Client rather than a personal login.

Jamf API Setup

To connect to Jamf, you will need:

  • Jamf Pro Instance URL (e.g., https://yourcompany.jamfcloud.com)
  • Client ID
  • Client Secret

Step 1 – Create an API Role

In Jamf Pro, go to Settings → System Settings → API Roles and Clients → API Roles tab → New. Name the role and assign only the privileges your workflow needs. Save. (You may use an existing role)

Step 2 – Create an API Client

Go to the API Clients tab → New. Set a Client Name, assign the API Role(s) from Step 1, set an Access Token Lifetime, and toggle Enable API Client on. Save.

Step 3 – Generate the Client Credentials

Open the client and generate a new client secret. A pop-up will appear with your Client ID and Client secret. Save this information for later.

Important: The “Save client secret” pop-up will have a “Copy client credentials to clipboard” button. This copies a full JSON object, not just the secret key. You will only need the secret key for next steps. Inputting the entire JSON object will result in an error down the road. It is recommended therefore to copy the key directly from the pop-up. (Alternatively you can extract the secret key from the JSON)

Step 4 – Note your Instance URL

This is the base domain you log into Jamf with, e.g., https://yourcompany.jamfcloud.com. You'll combine this with /api/... paths later.

Setup in Firstbase Workflows

The information generated in Jamf will be used in a HTTPs Request node. Credentials can be used in a single node or a global credential can be created to then be used across multiple workflows. The guide below outlines creating the global credentials but the steps can also be used for a single workflow. 

Step 1 – Navigate to Workflows

In the Firstbase platform, as an admin, click the Workflows tab.

Step 2 – Create the new credential

In Workflows, click Credentials → Create Credential (top right) → Type "OAuth2 API" -> scroll to and select “OAuth2 API”. Click Continue


A form will appear where you can input the credentials generated in Jamf. Fill out as demonstrated below. 

  • Grant Type: Client Credentials
  • Access Token URL: https://<your-instance>.jamfcloud.com/api/v1/oauth/token
  • Client ID: from Step 3
  • Client Secret: the extracted secret value only (see warning above)
  • Scope: leave blank unless limiting to specific API roles
  • Authentication: Body. This must be Body, not Header. Jamf's token endpoint only accepts credentials in the request body; leaving this on the default Header setting causes a "Client authentication failed" error even with correct credentials.
  • No changes need to be made to Send Additional Body Properties, Ignore SSL Issues (Insecure), Token Expired Status Code, and Allowed HTTP Domains

Click Save.

Step 3 – Using the credentials in a Workflow

In a workflow, click the “+” at the top right -> type “HTTP Request” -> click the HTTP Request node. This will open the node settings where you can now connect it to your newly created credentials. 

Parameters will mirror as follow: 

  • Method: will depend on the use case

  • URL: https://<your-instance>.jamfcloud.com/api + the path for whatever you're calling. The path after /api changes depending on what data or action you're requesting. A recommended test URL is below. 
  • Authentication: Generic Credential Type
  • Generic Auth Type: OAuth2 API
  • OAuth2 API: select the credential created above OR create a new credential.

Testing your connection

A safe smoke test before building real workflows is to point the HTTP Request node at this full URL:

https://<your-instance>.jamfcloud.com/api/v1/jamf-pro-version

This returns basic Jamf Pro version info without touching device or user data.

Once you get a 200 response, your Jamf connection is ready for building workflows.

Questions? Reach out to your Firstbase Solutions Engineer or Customer Success Manager

Comments

0 comments

Please sign in to leave a comment.