Kandji

Apple device management. A straightforward API token connector.


Category	MDM
Authentication	API token
Reaches	`https://yourorg.api.kandji.io`
Needs an agent	No
Demo mode	No

Capabilities

device.lookupBySerial, device.get

Which lights up device details on a repair and the device page.

Getting a token from Kandji

In Kandji, go to Settings, Access, API Token.
Create a token and name it Plugboard.
Grant the device read scopes:
- device:list
- device:details
Copy the token. It is shown once.

Note your API URL while you are there. It is on the same screen and looks like https://yourorg.api.kandji.io. It is not the same as the URL you sign in to.

Configuring it in Plugboard

Admin, Connectors, Kandji, Configure.

Settings

Field	Value
`baseUrl`	Your Kandji API URL, for example `https://yourorg.api.kandji.io`

Credentials

Field	Value
`apiToken`	The token from step 4

Save and test. Success reports “Connected to Kandji”.

What Kandji returns

Field	Notes
Serial number	The lookup key, matched uppercased
Model	Falls back to the device name
Device id	Used for subsequent calls
Assigned user	Email, falling back to name

Kandji does not carry warranty or AppleCare data through this connector. For that, add Apple GSX.

Scope the token narrowly

Kandji tokens can be scoped, and this one only needs to read devices. A token that can also enrol, erase or change blueprints is a bigger credential than the job requires.

If you later want remote commands from the device page, that needs a different MDM connector today. Kandji’s implementation here is read-only.

Troubleshooting

Symptom	Cause
`401` on test	Wrong token, or it has been revoked in Kandji
`403`	The token lacks the device read scopes
Test passes, no device found	The serial is not in Kandji. Lookups match on an uppercased serial
Connection refused or DNS failure	The base URL is the sign-in URL rather than the API URL

Alternatives

Jamf Pro, Intune, Mosyle, Chrome Enterprise.