Reads your Macs and Apple mobile devices live from your Jamf Cloud instance, read-only: inventory, FileVault encryption, macOS security settings (System Integrity Protection, Gatekeeper, firewall, Secure Boot) and the status of the OS updates Jamf pushes. Recovery keys and passwords are never read.
For the general flow of adding a source, see Connect Data Sources.
Prerequisites
A Jamf Pro instance hosted on Jamf Cloud (an address ending in jamfcloud.com)
A Jamf Pro administrator account to create the API role and the API client
Setup
Step 1 — Create the API role
In Jamf Pro, open Settings → System → API roles and clients, then the API Roles tab, and click New.
Name it, e.g.
HARVEN read-only.Add exactly two privileges: Read Computers and Read Mobile Devices. Save.
Never add View Disk Encryption Recovery Key, View Recovery Lock, View Computer Device Lock Pin or View Local Admin Password, nor any Create, Update or Delete privilege. HARVEN needs none of them: it never reads a recovery key or a password, and never changes anything in Jamf Pro.
Step 2 — Create the API client
Open the API Clients tab and click New.
Name it, e.g.
HARVEN, and assign it the role from step 1.Keep the default Access token lifetime: HARVEN renews its token on its own.
Click Enable API client, then save.
Step 3 — Generate the client secret
On the API client, click Generate client secret.
Copy the Client ID and the Client secret. Jamf Pro shows the secret only once.
If you later change the roles assigned to this client, generate a new secret and enter it in the connector: Jamf Pro applies a role change only to a new secret. A privilege added to the role itself applies straight away.
Step 4 — Collect available updates (recommended)
The updates each Mac reports as available come from inventory collection. Under Settings → Computer management → Inventory collection, make sure Collect available software updates is ticked; otherwise that column stays empty in the Computers table.
Fields to fill in HARVEN
Field | Where to find it |
|---|---|
Instance URL | Browser address bar, e.g. acme.jamfcloud.com |
Client ID | Settings → System → API roles and clients → API Clients |
Client secret | Shown once, when you generate it on the API client |
Collected data
computers — One row per Mac: Identity and join keys (name, serial_number, model), macOS version and the updates the Mac reports (os_version, pending_software_updates), FileVault encryption (filevault_status, boot_partition_filevault_state, recovery_key_validity), macOS security settings (sip_status, gatekeeper_status, firewall_enabled, secure_boot_level), Management state, freshness and Jamf groups (managed, last_contact, groups)
mobile_devices — One row per iPhone, iPad or other Apple device: Identity, join keys and personal devices (name, serial_number, device_type, ownership_type), OS version (os_version), Passcode, encryption and integrity (passcode_compliant, data_protected, jailbreak_detected)
os_update_statuses — The OS updates Jamf is pushing, per device: Which device, and where its update stands (device_id, device_type, status), Deferrals and the next install (deferrals_remaining, next_scheduled_install)
available_os_updates — The macOS and iOS versions Jamf can push: Latest versions offered (platform, version)
Official documentation
Need help? Contact [email protected].