While working with Jamf Pro’s API options, I’ve started using API clients more often for my authentication needs. The reason is that I can control how long an API client’s authentication token is valid for, which is very useful from a security point of view.

My practice has been to set them up on a per-task basis, which I’ve found can lead to an increasing number of API clients. At the same time, for auditing purposes, it’s useful to know which API clients are using which API roles as API roles determine the permissions that the API clients have.

To help me keep track of this, I’ve written a script which reports the following:

• The current list of the enabled and disabled API clients on a Jamf Pro server
• Which API roles are being used by the API clients.

For more details, please see below the jump.

The script is named API_Client_Role_Reporting.sh and is available via the link below:

https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/Casper_Scripts/API_Client_Role_Reporting

This script connects to the Jamf Pro API on a Jamf Pro server and reports which API clients are assigned to which API client roles.

Three items are required to use this script:

• The URL of the appropriate Jamf Pro server.
• An API client on the Jamf Pro server with sufficient privileges to read the necessary information from the Jamf Pro API.
• The client secret for the relevant API client on the Jamf Pro server.

If setting up an API client with limited rights, here are the required API role privileges for the API client on the Jamf Pro server:

• Read API Integrations
• Read API Roles

In this example, I have the following API roles set up on a Jamf Pro server:

In turn, the following API clients have been also set up and assigned to those API roles:

With the example conditions, you should see similar output to what’s shown below when using the API_Client_Role_Reporting.sh script to generate a report:

As part of the script’s run, a report will be generated and you’ll be notified of where it is stored. The report will be in TSV format and appear similar to what’s shown below: