JAMF | ReadyWorks User Guide | ReadyWorks User Guide

Overview

Jamf Pro is the Apple device management platform used by most enterprises that run Macs, iPhones and iPads at scale. It enrols Apple hardware, pushes configuration profiles and applications, enforces compliance policies, and maintains a detailed inventory record for every managed device. That inventory record is the part ReadyWorks is interested in: for each Mac, Jamf collects hardware identifiers, installed software, storage layout, FileVault encryption state, security posture, assigned user and purchasing detail, and refreshes it on a recurring inventory schedule.

The ReadyWorks connector talks to the modern Jamf Pro API over REST. It authenticates by sending the connection’s username and password as a Base64 Basic Authorization header to the bearer token endpoint (/api/v1/auth/token by default), reads the returned token from the token JSON node, and then presents it as Authorization: Bearer on every subsequent data call. Every shipped job then calls a single endpoint, /api/v1/computers-inventory, reads the results array, and writes it to its own staging table in the estate.

What separates the 24 shipped jobs from one another is the section query parameter. Jamf’s computer inventory endpoint returns a configurable slice of each computer record, and each ReadyWorks template asks for exactly one section and lands it in a table of its own. That gives you a normalised set of tables (hardware in one, applications in another, disk encryption in a third) rather than one very wide record per Mac, so you can enable only the sections you actually need and keep the rest switched off.

In a ReadyWorks context this is the Apple half of the endpoint estate. Pulling Jamf inventory alongside your Windows management source lets you reconcile a single device list across both platforms, match Macs to the people who hold them, find machines that have stopped checking in, check FileVault and security posture before a refresh or a migration wave, and assemble application inventory for rationalisation and licensing work. The purchasing and warranty section supports hardware refresh planning directly.

Direction: the connector is registered as bidirectional and the outbound job form is available, so you can build your own write-back jobs against the Jamf API. No outbound templates ship with it, so out of the box this connector reads only.

Connector Properties

Property	Value
Identifier	`JAMF`
Name	JAMF
Description	Connector for processing Jamf Rest API data.
Job Types	Both Inbound and Outbound
Order	150
Enabled	Yes
Locked	Yes
Block Update	No
Single Authentication	No
Windows Only	No
Connector Version	2025-11-18
Hooks	None
Additional Job Fields	None
Image

Authentication Methods

The connector ships one authentication method. It exchanges a username and password for a short-lived Jamf Pro bearer token, then uses that token for the data calls.

Method	Identifier	Base Method	Script	Order	Enabled	Config Fields
JAMF	`JAMF_user_token`	`JAMF_user_token`	`json_rest_api.php`	10	Yes	8

NOTE: The account used here needs a Jamf Pro privilege set that allows read access to computer inventory. A read-only account is sufficient for every shipped job.

Method 1: JAMF (`JAMF_user_token`)

Connect to a Jamf API Rest Connector

Sends the configured username and password as a Base64-encoded Basic Authorization header to the Bearer Token End Point, extracts the token from the JSON node named in Bearer Token JSON Node, and attaches it as a Bearer token on all subsequent requests. Both the endpoint and the node ship with working defaults for Jamf Pro (/api/v1/auth/token and token), so in normal use you only supply the API Domain and the credentials. Point API Domain at your Jamf Pro tenant URL, including the scheme.

Connection Configuration Fields (8)

Order	Label	Type	Required	Default	Max Len	Tooltip
10	API Domain	text	Yes		255	Enter API domain of the Connection
30	Server Temporary Working Path	text	Yes	`storage/etl5`	255	Enter path where temporary files are stored during data processing (exclude starting and ending backslash)
40	Username	text	No		1024	Enter username of the Connection
50	Password	password	No		64000	Enter password of the Connection
190	Bearer Token End Point	text	No	`/api/v1/auth/token`	500	Enter API end point to request a bearer token for a username / password
200	Bearer Token JSON Node	text	No	`token`	255	Enter JSON data node for bearer token
240	Single Authentication	radio	Yes	`0`		Choose if authentication is only to be done once and not on each enumeration or pagination loop
250	Additional Job Fields	fields_list	No			Enter list of additional fields to add to staging data for all jobs

Authentication Configuration

Headers sent on the authentication call:

Header	Value	Base64
`Content-Type:`	`application/json`	Off
`Authorization: Basic`	`%user_name%:%user_pass%`	On

Headers sent on the data calls:

Header	Value	Base64
`Content-Type:`	`application/json`	Off
`Authorization: Bearer`	`%auth_data%`	Off

cURL options:

Option	Authentication Call	Data Calls
`USERAGENT`	`Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0`	Same
`SSL_VERIFYHOST`	`false`	Same
`SSL_VERIFYPEER`	`false`	Same
`RETURNTRANSFER`	`true`	Same
`FOLLOWLOCATION`	`true`	Same
`FAILONERROR`	`true`	Same
`POST`	`true`	Not set

NOTE: Jamf Pro bearer tokens are short-lived. This matters when you decide how to set Single Authentication: leaving it at No re-authenticates on every pagination loop, and setting it to Yes reuses one token for the whole run, which will start returning 401 responses if a job runs longer than the token lifetime.

Inbound Job Fields Enabled (44)

Inbound jobs expose the full REST job form, including the pagination and three-level enumeration groups, even though no shipped template uses either.

Order	Label	Type	Required	Default	Tooltip
10	Job Description	text	Yes		Enter description of the Job
20	Job Schedule	lookup	Yes	Daily	Select frequency Job should run
30	Enabled	radio	Yes	Yes	Choose if Job is enabled
40	Use Unparsed Data	radio	No	No	Choose if you wish to parse the incoming data, or leave it in its raw format
50	Log Raw API Calls	radio	Yes	No	Choose if raw API calls are logged
70	Destination Table	text	Yes		Enter name of the destination table
80	Data Identity	text	No		Enter identity of the Job
120	Append New Data to Existing Tables	radio	No	No	Choose if new data will append to the existing destination table, or will create a new destination table
130	Fields to Index	text	No		Enter fields to index
170	Method Type	select	Yes	`GET`	Select method type of the Job
190	API End Point	text	No		Enter API end point of the Job
200	API Data Parameters	fields_list	No		Enter API data parameters of the Job
210	Body Data Sending Method	select	Yes	JSON Encoded Data	Select method for sending the body data
220	Raw JSON Body Data	textarea	No		Enter the raw JSON body to send. Do not use body selections in the API Parameters if this is used.
230	API Return Data Node	text	No		Enter API return data node of the Job
250	Pagination Type	select	No	None	Select request paging type of the Job
270	API Pagination Node	text	No		Enter API pagination node of the Job
280	Pagination Offset Start	text	No		Enter request paging offset start of the Job
290	Pagination Limit	text	No		Enter request pagination limit of the Job
300	Pagination Termination Node	text	No		Enter request paging termination node and value of the Job
310	Maximum API Calls	text	No		Enter maximum number of API calls for the Job to make
320	Enumeration 1 Type	select	No	None	Enter enumeration level 1 type
330	Enumeration 1 ETL Job	lookup	No		Select ETL job for the enumeration values
340	Enumeration 1 Data Type	data_type	No		Select the data type and fields for enumeration 1 values
350	Enumeration 1 Keys End Point	text	No		Enter enumeration 1 keys end point of the Job
360	Enumeration 1 Node	text	No		Enter enumeration 1 node of the Job
370	Enumeration 1 Fields	fields_list	No		Enter enumeration 1 fields of the Job
380	Enumeration 2 Type	select	No	None	Enter enumeration level 2 type
390	Enumeration 2 ETL Job	lookup	No		Select ETL job for the enumeration 2 values
400	Enumeration 2 Data Type	data_type	No		Select the data type and fields for enumeration 2 values
410	Enumeration 2 Keys End Point	text	No		Enter enumeration 2 keys end point of the Job
420	Enumeration 2 Node	text	No		Enter enumeration 2 node of the Job
430	Enumeration 2 Fields	fields_list	No		Enter enumeration 2 fields of the Job
440	Enumeration 3 Type	select	No	None	Enter enumeration level 3 type
450	Enumeration 3 ETL Job	lookup	No		Select ETL job for the enumeration 3 values
460	Enumeration 3 Data Type	data_type	No		Select the data type and fields for enumeration 3 values
470	Enumeration 3 Keys End Point	text	No		Enter enumeration 3 keys end point of the Job
480	Enumeration 3 Node	text	No		Enter enumeration 3 node of the Job
490	Enumeration 3 Fields	fields_list	No		Enter enumeration 3 fields of the Job
500	Pause Enumeration	text	No		Enter values for pausing enumeration every X calls for Y seconds
510	Kill Enumeration on Error	radio	No	No	Choose to stop the enumeration loop on an error or continue processing the loop
520	Additional Fields	fields_list	No		Enter list of additional fields to add to staging data
550	Retry Pause	text	No		Enter values for retrying a failed API connection. Retry X times, waiting Y seconds between each try, with an API timeout of Z seconds.
560	Order	text	Yes		Enter order of the Job

Outbound Job Fields Enabled (13)

The outbound job form is fully enabled so you can author your own write-back jobs against the Jamf Pro API, although no outbound template ships with the connector.

Order	Label	Type	Required	Default	Tooltip
10	Job Description	text	Yes		Enter description of the Job
30	Enabled	radio	Yes	Yes	Choose if Job is enabled
50	Log Raw API Calls	radio	Yes	No	Choose if raw API calls are logged
170	Method Type	select	Yes	`GET`	Select method type of the Job
180	Data Sending Method	select	Yes	JSON Encoded Data	Select method for sending the outbound data
190	API End Point	text	No		Enter API end point of the Job
200	API Data Parameters	fields_list	No		Enter API data parameters of the Job
210	Body Data Sending Method	select	Yes	JSON Encoded Data	Select method for sending the body data
260	Return Data Fields List	fields_list	Yes		Enter return data fields of the Job
530	Outbound Fields List	fields_list	Yes		Enter outbound fields of the Job
540	Ignore Empty Outbound Fields	radio	No	Yes	Ignore, and do not include, any outbound fields that are empty and have no data
550	Raw JSON Outbound Template	textarea	No		Enter the raw JSON outbound template to send. This will replace any automated structures defined in the outbound fields.
560	Order	text	Yes		Enter order of the Job

Inbound Job Templates (24)

All 24 inbound templates call the same endpoint, /api/v1/computers-inventory, and differ only in the section parameter they request and the table they write to. Twenty-three cover one inventory section each, and the twenty-fourth requests every section in a single call.

#	Job Description	Destination Table	API End Point	Enabled	What It Pulls
1	Device Applications	`jamf_device_applications`	`/api/v1/computers-inventory`	No	The APPLICATIONS section of the computer inventory: every application found on each Mac, with name, version, bundle identifier, install path, whether it is Mac App Store sourced and whether an update is available.
2	Device Storage	`jamf_device_storage`	`/api/v1/computers-inventory`	No	The STORAGE section: the boot drive plus each physical disk and partition, with capacity, available space, file system type, partition role and SMART status.
3	Device General	`jamf_device_general`	`/api/v1/computers-inventory`	No	The GENERAL section: the record-level facts about each Mac, including Jamf display name, last inventory update, last contact time, enrolment date, supervision and MDM capability flags, site and remote management state.
4	Device Disk Encryption	`jamf_device_disk_encryption`	`/api/v1/computers-inventory`	No	The DISK_ENCRYPTION section: FileVault state per partition, the encryption percentage, and whether a personal or institutional recovery key has been escrowed to Jamf.
5	Device Purchasing	`jamf_device_purchasing`	`/api/v1/computers-inventory`	No	The PURCHASING section: purchase order number, vendor, purchase price, warranty expiry, AppleCare identifier, lease dates and the flags that mark a device as leased or purchased.
6	Device User and Location	`jamf_device_user_and_location`	`/api/v1/computers-inventory`	No	The USER_AND_LOCATION section: the user assigned to each Mac in Jamf, with email address, position, department, building, room and phone number.
7	Device Configuration Profiles	`jamf_device_configuration_profiles`	`/api/v1/computers-inventory`	No	The CONFIGURATION_PROFILES section: each macOS configuration profile installed on the device, with display name, profile identifier, username scope and whether the profile is removable.
8	Device Printers	`jamf_device_printers`	`/api/v1/computers-inventory`	No	The PRINTERS section: printers mapped on each Mac, with the queue name, device URI and printer type or driver.
9	Device Services	`jamf_device_services`	`/api/v1/computers-inventory`	No	The SERVICES section: the macOS services and daemons Jamf detected running on the device.
10	Device Hardware	`jamf_device_hardware`	`/api/v1/computers-inventory`	No	The HARDWARE section: model name and model identifier, serial number, processor type, speed and core count, installed memory, wired and wireless MAC addresses, battery capacity and boot ROM version.
11	Device Local User Accounts	`jamf_device_local_user_accounts`	`/api/v1/computers-inventory`	No	The LOCAL_USER_ACCOUNTS section: every local account on the Mac, with UID, home directory and its size, administrator flag, FileVault enablement and Secure Token status.
12	Device Certificates	`jamf_device_certificates`	`/api/v1/computers-inventory`	No	The CERTIFICATES section: identity and CA certificates present in the device keychains, with common name, issuer, expiry date and whether the certificate carries an identity.
13	Device Attachments	`jamf_device_attachments`	`/api/v1/computers-inventory`	No	The ATTACHMENTS section: metadata for files attached to the Jamf computer record, with file name, size and MIME type. The file contents themselves are not retrieved.
14	Device Plugins	`jamf_device_plugins`	`/api/v1/computers-inventory`	No	The PLUGINS section: browser and system plug-ins found on the device, with name, version and file path.
15	Device Package Receipts	`jamf_device_package_receipts`	`/api/v1/computers-inventory`	No	The PACKAGE_RECEIPTS section: installer receipts on the Mac, split into packages installed by Jamf, packages installed by the macOS installer, and packages currently cached on the device.
16	Device Security	`jamf_device_security`	`/api/v1/computers-inventory`	No	The SECURITY section: System Integrity Protection and Gatekeeper status, XProtect definition version, firewall state, Activation Lock, secure boot and external boot levels, and whether a bootstrap token has been escrowed.
17	Device Operating System	`jamf_device_operating_system`	`/api/v1/computers-inventory`	No	The OPERATING_SYSTEM section: macOS name, version and build number, Active Directory binding status, the FileVault 2 enabled users, and the software update device identifier.
18	Device Licensed Software	`jamf_device_licensed_software`	`/api/v1/computers-inventory`	No	The LICENSED_SOFTWARE section: the Jamf licensed software titles matched against each computer, used for license position reporting inside Jamf.
19	Device iBeacons	`jamf_device_ibeacons`	`/api/v1/computers-inventory`	No	The IBEACONS section: the iBeacon regions each computer is currently within, as reported by Jamf’s beacon monitoring.
20	Device Software Updates	`jamf_device_software_updates`	`/api/v1/computers-inventory`	No	The SOFTWARE_UPDATES section: Apple software updates available and pending on each Mac, with update name, version and package name.
21	Device Extension Attributes	`jamf_device_extension_attributes`	`/api/v1/computers-inventory`	No	The EXTENSION_ATTRIBUTES section: the custom inventory attributes your administrators have defined in Jamf, with the definition identifier, name, data type, input type and the value collected from each device. This is where site-specific inventory such as asset tags or cost centres usually lives.
22	Device Content Caching	`jamf_device_content_caching`	`/api/v1/computers-inventory`	No	The CONTENT_CACHING section: the state of the macOS content caching service on the device, including cache size and space used, registration status, and the parent and peer caches it is associated with.
23	Device Group Memberships	`jamf_device_group_memberships`	`/api/v1/computers-inventory`	No	The GROUP_MEMBERSHIPS section: every smart group and static group each computer belongs to, with group identifier, name and whether the membership is smart.
24	Devices: All Data	`jamf_devices_all`	`/api/v1/computers-inventory`	No	The same endpoint with all 23 sections requested at once, producing one very wide record per Mac in a single table rather than 23 narrow tables. It duplicates the entire content of the other 23 templates.

Job Template Configuration

Settings Common to All Twenty-Four Templates

Setting	Value
Enabled	No
Job Schedule	Daily (15 1 * * *)
Allow Empty Table	Yes
Append Files to Same Destination Table	No
Append New Data to Existing Tables	No
Use Unparsed Data	No
Convert UUID-Keyed Objects to Rows	No
Ignore XML Attributes	No
Log Raw API Calls	No
Method Type	`GET`
API End Point	`/api/v1/computers-inventory`
Body Data Sending Method	JSON Encoded Data
API Return Data Node	`results`

Settings That Vary by Template

Template	ID	Order	Destination Table	Data Identity
Device Applications	62	20	`jamf_device_applications`	`jamf_device_applications`
Device Storage	69	30	`jamf_device_storage`	`jamf_device_storage`
Device General	70	40	`jamf_device_general`	`jamf_device_general`
Device Disk Encryption	71	50	`jamf_device_disk_encryption`	`jamf_device_disk_encryption`
Device Purchasing	72	60	`jamf_device_purchasing`	`jamf_device_purchasing`
Device User and Location	73	70	`jamf_device_user_and_location`	`jamf_device_user_and_location`
Device Configuration Profiles	74	80	`jamf_device_configuration_profiles`	`jamf_device_configuration_profiles`
Device Printers	75	90	`jamf_device_printers`	`jamf_device_printers`
Device Services	52	100	`jamf_device_services`	`jamf_device_services`
Device Hardware	53	110	`jamf_device_hardware`	`jamf_device_hardware`
Device Local User Accounts	54	120	`jamf_device_local_user_accounts`	`jamf_device_local_user_accounts`
Device Certificates	55	130	`jamf_device_certificates`	`jamf_device_certificates`
Device Attachments	56	140	`jamf_device_attachments`	`jamf_device_attachments`
Device Plugins	57	150	`jamf_device_plugins`	`jamf_device_plugins`
Device Package Receipts	58	160	`jamf_device_package_receipts`	`jamf_device_package_receipts`
Device Security	59	170	`jamf_device_security`	`jamf_device_security`
Device Operating System	60	180	`jamf_device_operating_system`	`jamf_device_operating_system`
Device Licensed Software	61	190	`jamf_device_licensed_software`	`jamf_device_licensed_software`
Device iBeacons	63	200	`jamf_device_ibeacons`	`jamf_device_ibeacons`
Device Software Updates	64	210	`jamf_device_software_updates`	`jamf_device_software_updates`
Device Extension Attributes	65	220	`jamf_device_extension_attributes`	`jamf_device_extension_attributes`
Device Content Caching	66	230	`jamf_device_content_caching`	`jamf_device_content_caching`
Device Group Memberships	67	240	`jamf_device_group_memberships`	`jamf_device_group_memberships`
Devices: All Data	68	250	`jamf_devices_all`	`jamf_devices_all`

Job Parameters and Enumeration

Device Applications

API data parameters:

Key	Value
`section`	`APPLICATIONS`

Device Storage

API data parameters:

Key	Value
`section`	`STORAGE`

Device General

API data parameters:

Key	Value
`section`	`GENERAL`

Device Disk Encryption

API data parameters:

Key	Value
`section`	`DISK_ENCRYPTION`

Device Purchasing

API data parameters:

Key	Value
`section`	`PURCHASING`

Device User and Location

API data parameters:

Key	Value
`section`	`USER_AND_LOCATION`

Device Configuration Profiles

API data parameters:

Key	Value
`section`	`CONFIGURATION_PROFILES`

Device Printers

API data parameters:

Key	Value
`section`	`PRINTERS`

Device Services

API data parameters:

Key	Value
`section`	`SERVICES`

Device Hardware

API data parameters:

Key	Value
`section`	`HARDWARE`

Device Local User Accounts

API data parameters:

Key	Value
`section`	`LOCAL_USER_ACCOUNTS`

Device Certificates

API data parameters:

Key	Value
`section`	`CERTIFICATES`

Device Attachments

API data parameters:

Key	Value
`section`	`ATTACHMENTS`

Device Plugins

API data parameters:

Key	Value
`section`	`PLUGINS`

Device Package Receipts

API data parameters:

Key	Value
`section`	`PACKAGE_RECEIPTS`

Device Security

API data parameters:

Key	Value
`section`	`SECURITY`

Device Operating System

API data parameters:

Key	Value
`section`	`OPERATING_SYSTEM`

Device Licensed Software

API data parameters:

Key	Value
`section`	`LICENSED_SOFTWARE`

Device iBeacons

API data parameters:

Key	Value
`section`	`IBEACONS`

Device Software Updates

API data parameters:

Key	Value
`section`	`SOFTWARE_UPDATES`

Device Extension Attributes

API data parameters:

Key	Value
`section`	`EXTENSION_ATTRIBUTES`

Device Content Caching

API data parameters:

Key	Value
`section`	`CONTENT_CACHING`

Device Group Memberships

API data parameters:

Key	Value
`section`	`GROUP_MEMBERSHIPS`

Devices: All Data

API data parameters:

Key	Value
`section`	See below

section:

APPLICATIONS,STORAGE,GENERAL,DISK_ENCRYPTION,PURCHASING,USER_AND_LOCATION,CONFIGURATION_PROFILES,PRINTERS,SERVICES,HARDWARE,LOCAL_USER_ACCOUNTS,CERTIFICATES,ATTACHMENTS,PLUGINS,PACKAGE_RECEIPTS,SECURITY,OPERATING_SYSTEM,LICENSED_SOFTWARE,IBEACONS,SOFTWARE_UPDATES,EXTENSION_ATTRIBUTES,CONTENT_CACHING,GROUP_MEMBERSHIPS

NOTE: Every template ships with Enabled set to No. Nothing runs until you enable the sections you want.

NOTE: Each enabled template performs its own full sweep of the computer inventory. Enabling all 24 means 24 complete passes over your Mac estate per run, so enable only the sections you will actually reconcile against.

NOTE: The templates cover computer inventory only. Mobile devices, Jamf users, policies, scripts and smart group definitions are not pulled by any shipped job, although you can add jobs for them on the same connection.

Outbound Job Templates (0)

No outbound templates ship with this connector. The outbound job form is enabled, so you can author write-back jobs against the Jamf Pro API yourself.

Preparing Jamf Pro

ReadyWorks connects to Jamf Pro through the Jamf Pro API using OAuth 2.0 client credentials. This method uses a dedicated API client with its own permissions, independent of any administrator account. Complete both steps below in Jamf Pro before configuring the connection in ReadyWorks.

Step 1: Create the API Role

The API role defines what ReadyWorks is allowed to read.

In Jamf Pro, go to Settings > System > API Roles and Clients
Open the API Roles tab and click New
Enter a descriptive display name, for example ReadyWorks Read-Only
Add the following privileges:
1. Read Computers
2. Read Computer Inventory Collection
3. Read Smart Computer Groups
4. Read Static Computer Groups
5. Read Mobile Devices
6. Read Smart Mobile Device Groups
7. Read Static Mobile Device Groups
8. Read Computer Extension Attributes
9. Read Mobile Device Extension Attributes
10. Read Departments
11. Read Buildings
12. Read Sites
13. Read User
Click Save

NOTE: Every privilege in this role is read-only. ReadyWorks uses this access to collect device inventory, group membership, and organizational data from Jamf Pro. It does not create, modify, or delete any objects in Jamf Pro.

Step 2: Create the API Client

The API client is the identity ReadyWorks authenticates as.

On the API Clients tab, click New
Enter a display name, for example ReadyWorks Integration
Assign the API role created in the previous step
Set an access token lifetime. The default is acceptable for most environments
Click Save
Click Edit, turn on Enable API Client, and save again
Click Generate Client Secret and confirm
Copy the client ID and client secret and store them securely. These values are needed to configure the connection in ReadyWorks.

NOTE: Jamf Pro displays the client secret only once. If it is lost, generate a new secret and update the ReadyWorks connection with the new value.

Table of Contents

Overview

Connector Properties

Authentication Methods

Method 1: JAMF (JAMF_user_token)

Connection Configuration Fields (8)

Authentication Configuration

Inbound Job Fields Enabled (44)

Outbound Job Fields Enabled (13)

Inbound Job Templates (24)

Job Template Configuration

Settings Common to All Twenty-Four Templates

Settings That Vary by Template

Job Parameters and Enumeration

Outbound Job Templates (0)

Preparing Jamf Pro

Step 1: Create the API Role

Step 2: Create the API Client

Attachments

Method 1: JAMF (`JAMF_user_token`)