Reference · built on requestConnectorIdentity, IT & observability

Iru Endpoint Management

Device inventory, status, Prism reports, vulnerabilities, and audit events from an Iru Endpoint Management tenant, formerly Kandji.

Request accessPricing ↗

About

Iru Endpoint Management, formerly Kandji, manages Apple devices and, where enabled, Windows and Android. The API sits at https://SubDomain.api.kandji.io in the US or https://SubDomain.api.eu.kandji.io in the EU and covers Device Information, Device Actions, Device Secrets, Blueprints, Library items, Prism, Threats, Vulnerabilities, Users, Tags, and the Audit Log. Device status reports each library item and parameter as PASS, PENDING, ERROR, or another documented value.

Through Fibric, an operator reads a device's details, status, and Prism rows and proposes a lock, an erase, a blueprint change, or a note. Each proposal waits for your approval and leaves a receipt with the device id and the outcome.

This is a reference listing. It documents what Fibric would read from Iru Endpoint Management and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Devices through GET /api/v1/devices and /devices/{device_id}/details, with polymorphic fields when Windows or Android management is on
  • Device status through /devices/{device_id}/status: library items and parameters as PASS, PENDING, ERROR, EXCLUDED, INCOMPATIBLE, REMEDIATED, or WARNING
  • Prism categories such as filevault, apps, certificates, gatekeeper_and_xprotect, installed_profiles, local_users, and device_information, with JSON filters and cursor pagination
  • Audit events through GET /api/v1/audit/events with action, actor_id, actor_type, target_type, new_state, and occurred_at
  • Vulnerability detections and affected devices under /api/v1/vulnerability-management, and EDR threat details under /api/v2/threat, for customers with those features
  • Blueprints, library items, custom apps, custom profiles, custom scripts, tags, users, and per-device activity

Proposed actions

  • Target capability: propose Lock Device or Erase Device through POST /api/v1/devices/{device_id}/action/lock or /action/erase
  • Target capability: propose Update Device through PATCH /api/v1/devices/{device_id} to change the assigned blueprint, user, asset tag, or tags
  • Target capability: propose Enable Lost Mode, Update Inventory, Perform Daily Check-in, or Restart Device on one device
  • Target capability: propose a device note through POST /api/v1/devices/{device_id}/notes

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Lock the Mac before the account goes

    The operator lists the leaver's devices by user, proposes Lock Device for each, and keeps the PIN from the response in the receipt. Erase Device is a second, separate approval.

    With Offboarding Sweep

  • Prove encryption and profile state

    Prism filevault and installed_profiles rows plus device status values are exported per device, with occurred_at timestamps from the Audit Log for the changes that matter.

    With Compliance Evidence

  • Move a device into the right blueprint

    A new device with an empty user and the default blueprint is the trigger. The operator proposes Update Device with the blueprint_id and user your routing rules imply.

    With Onboarding Checklist

  • Turn CVE detections into a patch list

    Vulnerability detections and affected devices are grouped by software and blueprint. The operator drafts the update wave and proposes Update Inventory on the devices after it runs.

    With Patch Window

Requirements

  • An Iru Endpoint Management tenant and an admin who can add API tokens under Settings > Access
  • The tenant API URL, https://SubDomain.api.kandji.io for US or https://SubDomain.api.eu.kandji.io for EU
  • Token permissions that cover the endpoints you use; Device Secrets reads are logged as sensitive data access in the Audit Log
  • The Vulnerability Management or Endpoint Detection and Response features for the /vulnerability-management and /threat endpoints
Authentication
A bearer API token created in Settings > Access, with permissions set per token on its Permissions tab, sent as Authorization: Bearer against your tenant's API URL.

Limits

  • 10,000 requests per hour per customer across the API
  • List Devices returns at most 300 results per request; paginate for more
  • A 400 with Command already running means the same command is still Pending on the device
  • Audit events cover the global Activity module; device-level activity is read per device through /devices/{device_id}/activity

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Iru Endpoint Management ↗

Questions and answers

Is this the same as the Kandji API?
Yes. Kandji is now Iru, and many URLs and notes in the documentation still reference Kandji. The API URL keeps the kandji.io host, https://SubDomain.api.kandji.io in the US or https://SubDomain.api.eu.kandji.io in the EU, and is shown in Settings > Access after you create a token.
What does the Audit Log return?
Events from the global Activity module: create, update, and delete on Blueprints and Library Items, access to sensitive data such as FileVault and recovery keys, device lifecycle events, user directory events, and vulnerability or EDR events for customers with those features. Each carries actor_id, target_type, new_state, and occurred_at.
How is the API rate limited and paged?
10,000 requests per hour per customer. List Devices has a hard limit of 300 results per request. Prism endpoints recommend cursor pagination: pass back the cursor from the previous response unchanged, with the same query parameters, and do not mix it with offset.
Ask about Iru Endpoint Management

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Iru Endpoint Management through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy