[Addigy] Assign one or more devices to one or more policies. Required body fields: `agent_ids` (non-empty array of device agent IDs) and `policy_ids` (non-empty array of policy IDs). Requires organizationId (from addigy_list_child_organizations). Use addigy_get_device_policy_assignments to verify current assignments. Requires API token permission: Assign/Unassign Device Policies.

[Addigy] Remove a single device from Addigy by its serial number. DESTRUCTIVE — the device is deleted from the organization. NOTE: this endpoint is not intended for bulk removal. Requires organizationId (from addigy_list_child_organizations) and the device's serial number (sn). Requires API token permission: Delete Devices.

[Addigy] Get a device's compliance statuses per security benchmark for a specific organization. Returns an array of benchmark compliance statuses for the given agent. Requires organizationId (from addigy_list_child_organizations) and the device's agentId. Requires API token permission: View Devices.

[Addigy] Get the list of policy IDs assigned to a specific device. Returns an array of policy id strings. Requires organizationId (from addigy_list_child_organizations) and the device's agentId. Use addigy_assign_devices_to_policy / addigy_unassign_devices_from_policy to change assignments. Requires API token permission: View Devices.

[Addigy] Reveal the current managed admin password for a specific account on a device. NOTE: revealing the password also schedules a rotation on the device in one hour. Requires organizationId (from addigy_list_child_organizations), the device's agentId, and the accountName (discover via addigy_list_device_managed_admins). Requires API token permission: View Managed Admin Password.

[Addigy] Get MDM device details for a single device including enrollment profile, APN certificate, and last MDM response. The device UUID is the MDM device identifier (distinct from the agent_id used by /o/ device endpoints). Use addigy_search_devices to discover devices.

[Addigy] List the available device facts for an organization. Returns an array of fact definitions whose identifiers can be passed as desiredFactIdentifiers or used in filters for addigy_search_devices. Requires organizationId (from addigy_list_child_organizations).

[Addigy] List the managed admin accounts associated with a specific device. Returns managed-user records (account names and metadata). Requires organizationId (from addigy_list_child_organizations) and the device's agentId; optionally filter to a single accountName. Requires API token permission: View Mac Users.

[Addigy] Get overall compliance status for a set of devices. Provide agent_ids in fieldsJson to scope the query (omit/empty for all devices). Returns an array of device compliance statuses. Aggregates across child organizations when multitenancy=true. Requires API token permission: View Devices.

[Addigy] Query installed applications reported by the Addigy agent for one or more devices. macOS only. Build the filter via queryJson — required key `agent_ids` (array of agent IDs), optional `names` (array of application names, e.g. ["Google Chrome","Firefox"]). sortField and sortDirection are required by the API: sortField is one of agent_id|name; sortDirection is asc|desc. Paginated; response metadata carries page_count/total. Aggregates across child organizations when multitenancy=true. Requires API token permission: View Devices.

[Addigy] Query installed applications reported via MDM for one or more devices. Required body fields (all required by the API): `agent_ids` (array of agent IDs), `limit` (integer page size), `skip` (integer offset), `sort_field` (string, e.g. name), `sort_direction` (asc|desc). Uses skip/limit offset pagination rather than page numbers. Aggregates across child organizations when multitenancy=true. Requires API token permission: View Devices.

[Addigy] Paginated list of certificates installed on MDM devices. Build the filter via queryJson — supported keys: `days_until_expiration` (integer; certs expiring within N days), `issuer_common_name` (string), and `devices` (array of device identifiers). Useful for auditing expiring certificates across the fleet. Paginated; response metadata carries page_count/total. Requires API token permission: View Devices.

[Addigy] Rotate the managed admin password for a specific account on a device. Required body field: `accountName` (the managed admin account to rotate; discover via addigy_list_device_managed_admins). Requires organizationId (from addigy_list_child_organizations) and the device's agentId. Requires API token permission: Rotate Managed Admin Password.

[Addigy] Universal device search: query for devices by any device fact (e.g. serial_number, hostname, model). Returns a paginated audit response of matching devices. Build the search via queryJson — supported keys: `search_any` (free-text across facts), `policy_id`, and `filters` (array of audit filters); pass `desiredFactIdentifiers` (comma-separated fact ids from addigy_list_available_facts) to control which facts come back. Paginated; response metadata carries page_count/total. Org-scoping: omit organizationId to search the API key's own organization, or pass an organizationId (from addigy_list_child_organizations) to target a specific child organization. Requires API token permission: View Devices.

[Addigy] Test the MDM response for a single device — probes whether the device responds to an MDM command, useful for diagnosing unresponsive or stale MDM enrollments. The device UUID is the MDM device identifier; discover it via addigy_search_devices or addigy_get_mdm_device_details.

[Addigy] Unassign one or more devices from one or more policies. Required body fields: `agent_ids` (non-empty array of device agent IDs) and `policy_ids` (non-empty array of policy IDs). Requires organizationId (from addigy_list_child_organizations). Use addigy_get_device_policy_assignments to verify current assignments. Requires API token permission: Assign/Unassign Device Policies.

[Addigy] Create a new organization user (admin). Required body fields: email (string), role (e.g. admin). Optional: name, phone, policies (array of policy id strings). Returns the created user record. To change an existing user use addigy_update_user; to list users use addigy_query_organization_users. Requires API token permission: Create User.

[Addigy] Remove a user from the organization, identified by their email. Discover existing users with addigy_query_organization_users. This is irreversible — re-add with addigy_create_user. Requires API token permission: Remove User.

[Addigy] Disable a Beta Feature for the organization, identified by its feature_flag_key (discover keys with addigy_list_public_beta_features). To re-enable use addigy_enable_beta_feature. Requires API token permission: Toggle Feature Betas.

[Addigy] Enable a Beta Feature for the organization. Required body field: feature_flag_key (string) — discover available keys with addigy_list_public_beta_features. To turn a feature back off use addigy_disable_beta_feature. Requires API token permission: Toggle Feature Betas.

[Addigy] Get the permission set granted to the API key currently in use. Returns an array of Addigy permission identifiers (e.g. com.addigy.devices.view, com.addigy.policies.edit — verified live 2026-08-26) describing exactly what this token can do; each identifier corresponds to a labeled permission on Addigy's API-token creation screen. Use this first to confirm a tool you intend to call is authorized.

[Addigy] Get the billing account record for a specific organization — contact, payment, and account-status details. Requires organizationId from addigy_list_child_organizations (or the org's own id). For usage/charge figures use addigy_get_billing_data; for invoices use addigy_list_billing_invoices. Requires API token permission: View Billing.

[Addigy] Get billing data (device counts, charges, and usage figures) for a specific organization. Requires organizationId from addigy_list_child_organizations (or the org's own id). For account contact details use addigy_get_billing_account; for invoices use addigy_list_billing_invoices. Requires API token permission: View Billing.

[Addigy] Identify the organization the API token belongs to, via GET /configuration/whoami. Returns {organization_id, name}. This is the ONLY self-discovery of the token's own organization id — the o// tools need that id, and on a single-organization account nothing else reveals it. NOTE: the endpoint is absent from Addigy's published Swagger spec; it was verified live 2026-08-26 and may change without notice.

[Addigy] List the billing invoices for a specific organization. Returns an array of invoice records (id, period, amount, status). Requires organizationId from addigy_list_child_organizations (or the org's own id). For the live account/usage figures use addigy_get_billing_account / addigy_get_billing_data. Requires API token permission: View Billing.

[Addigy] List the child organizations belonging to a parent organization (MSP multi-tenant view). Returns each child org's id, companyName, subdomain, and contact — the organizationId values needed by org-scoped tools (addigy_get_billing_account, addigy_query_organization_users, etc.). Supports searchString, sort, and a childOrganizationId filter to fetch one specific child. Paginated; response metadata has page/page_count/total.

[Addigy] List all Beta Features available to the organization, including each feature's flag key and whether it is currently enabled. Use the returned feature_flag_key with addigy_enable_beta_feature / addigy_disable_beta_feature to toggle a feature. Paginated; response metadata has page/page_count/total. Requires API token permission: Toggle Feature Betas.

[Addigy] Get the list of Automatic Device Enrollment (ADE / DEP) tokens assigned to the given policies. Required body field: policy_ids (array of strings). Returns the matching ADE token records (server name, expiration, assigned policy). Spans child organizations when multitenancy=true.

[Addigy] Query the users (admins) belonging to a specific organization. Returns a paginated list with each user's email, name, role, and policies. Requires organizationId from addigy_list_child_organizations (or the org's own id). Pass an optional queryJson body for additional filter fields supported by the endpoint. Paginated; response metadata has page/page_count/total. Requires API token permission: View Users.

[Addigy] Update an existing organization user, matched by email. Body fields: email (string, identifies the user to update), name, phone, role (e.g. admin). Discover existing users with addigy_query_organization_users. To create a new user use addigy_create_user; to remove one use addigy_delete_user. Requires API token permission: Edit User.

[Addigy] Create a new policy within a specific organization. Required body field: `name`. Optional body fields: `color`, `icon` (fa fa-user|fa fa-users|fa fa-trophy|fa fa-university|fa fa-database|fa fa-desktop|fa fa-building-o|fa fa-lock|fa fa-dog|fa fa-mobile|fa fa-wrench|fa fa-user-graduate|fa fa-cog|fa fa-laptop|fa fa-box-open|fa fa-globe-americas), `parent_policy_id` (nest under an existing policy — discover via addigy_query_policies), `splashtop_settings` and `ssh_settings` (each an object with `enabled` and `require_user_permission` booleans). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Create Policy.

[Addigy] Add an automatic-assignment (Smart Software / custom filter) rule to a policy within an organization. Devices matching the rule's filters are auto-assigned to the policy. Body fields: `policy_id` (target policy — discover via addigy_query_policies), `filters` (array of filter groups; each group is an array of correlation_engine.Filter conditions), `auto_remove` (bool — unassign devices that stop matching), `disabled` (bool). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Automatic Policy Assignments.

[Addigy] Permanently delete a policy from a specific organization. Identify the policy with the `id` query parameter (the policy's ID — discover via addigy_query_policies). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Delete Policy.

[Addigy] Detach a policy from its parent, promoting it to a top-level policy within an organization. Identify the policy with the `policy_id` query parameter (discover via addigy_query_policies). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Edit Policy.

[Addigy] Remove an automatic-assignment rule from a policy within an organization. Identify the rule with both the `policy_id` and `rule_id` query parameters — discover them via addigy_get_policy_rule or addigy_list_policy_rules. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Automatic Policy Assignments.

[Addigy] Get the automatic-assignment rule configured for a single policy within an organization. Identify the policy with the `policy_id` query parameter (discover via addigy_query_policies). Use addigy_list_policy_rules to enumerate rules across all policies. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Automatic Policy Assignments.

[Addigy] List the MDM configuration profiles currently assigned to policies for the API key's own organization. Returns each policy together with the MDM profiles attached to it. Use addigy_query_policies to discover policy IDs and names. Paginated via page/per_page (default 50, max 500); the response metadata envelope carries page/page_count/per_page/result_count/total.

[Addigy] List all automatic-assignment (custom filter) rules across every policy in an organization. Returns each rule with its associated policy and filter conditions. Use addigy_get_policy_rule for a single policy's rule. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Automatic Policy Assignments.

[Addigy] Query an organization for all policies, or filter to specific policies, and return their full info. This is the primary discovery tool for policy IDs and names referenced by the other Policies tools. Optional body field: `policies` (array of policy ID strings to filter to; omit or pass an empty body to return all policies). Aggregates across child organizations when multitenancy=true; scope to specific children via childOrganizations.

[Addigy] Update an existing policy's editable attributes (name, color, icon) for a specific organization. Required body field: `policy_id` (the target policy's ID — discover via addigy_query_policies). Optional body fields: `name`, `color`, `icon` (one of: fa fa-user, fa fa-users, fa fa-trophy, fa fa-university, fa fa-database, fa fa-desktop, fa fa-building-o, fa fa-lock, fa fa-dog, fa fa-mobile, fa fa-wrench, fa fa-user-graduate, fa fa-cog, fa fa-laptop, fa fa-box-open, fa fa-globe-americas). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Edit Policy.

[Addigy] Re-parent a policy, moving it under a different parent policy within an organization (changes the policy hierarchy). Required body fields: `policy_id` (the policy being moved) and `parent_policy_id` (its new parent). Discover both IDs via addigy_query_policies. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Edit Policy.

[Addigy] Issue an MDM Clear Passcode command, removing the unlock passcode from a managed device. Identify the target by EITHER agentId OR deviceUuid (provide exactly one — agentId comes from addigy_list_devices, deviceUuid from addigy_get_mdm_device_details). Requires API token permission: Execute Commands. Returns the queued MDM command payload (command UUID + status).

[Addigy] Issue an MDM Clear Restrictions Password command, removing the restrictions (Screen Time) passcode from a managed device. Identify the device by EITHER agentId OR deviceUuid (provide exactly one). Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM Delete User command, removing an active local user account from a managed device. Identify the device by EITHER agentId OR deviceUuid (provide exactly one). Required: username (the account to delete) and forceDeletion. Discover known device users with addigy_list_mdm_device_users. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that disables Lost Mode on a managed device (re-enable with addigy_enable_lost_mode). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that disables Remote Desktop (screen sharing) on a managed device (re-enable with addigy_enable_remote_desktop). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that puts a managed device into Lost Mode with an on-screen message, phone number, and footnote. A message OR phone number must be provided. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Body properties: message (string), phone_number (string), footnote (string), agent_id. Disable later with addigy_disable_lost_mode; locate with addigy_get_device_location. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that enables Remote Desktop (screen sharing) on a managed device (disable with addigy_disable_remote_desktop). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM Erase Device command, wiping a managed macOS/iOS/iPadOS/tvOS device. Provide a JSON body with required `device_uuid` (all OSes). macOS: `pin` (six-character Find My PIN, required for devices without Apple M1/T2 EACS support) and `obliteration_behavior` (DoNotObliterate|ObliterateWithWarning|Always|Default). iOS/iPadOS: `disallow_proximity_setup` (bool, default false) and `preserve_data_plan` (bool, default false). Requires API token permission: Execute Commands. This command does not require supervision. Returns the queued MDM command payload.

[Addigy] Retrieve the captured output (stdout/stderr/exit status) of a previously dispatched device command. Requires organizationId (discover with addigy_list_child_organizations), agentId (from addigy_list_devices), and actionId (the command/action identifier returned by addigy_run_device_command). Returns the CommandOutput record.

[Addigy] Issue an MDM command asking a device in Lost Mode to report its current location (enable Lost Mode first with addigy_enable_lost_mode; read the last reported coordinates with addigy_get_last_device_location). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Read the last known location reported by a device while in Lost Mode (request a fresh report with addigy_get_device_location). Identify the device by EITHER agentId OR deviceUuid (provide exactly one). Requires API token permission: Execute Commands. Returns the cached LostMode location record.

[Addigy] Issue an MDM Request User List command, asking a managed device to report its local user accounts to Addigy (read the cached result afterward with addigy_list_mdm_device_users). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Return the list of known device users previously reported to Addigy via the Request User List command (addigy_list_device_users triggers that command). Identify the device by EITHER agentId OR deviceUuid (provide exactly one). Requires API token permission: Execute Commands. Returns an array of MdmDeviceUser records.

[Addigy] Issue an MDM Device Lock command, rendering the device unusable until the passcode is entered. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Optional body properties: message and phone_number (shown on the lock screen) and pin (six-digit recovery PIN for macOS). Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that plays a sound on a device currently in Lost Mode (enable Lost Mode first with addigy_enable_lost_mode). Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command prompting the user to share their screen via AirPlay Mirroring to a destination device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Body properties: destination_device_id (e.g. "AA:BB:CC:DD:EE:FF"), destination_name (e.g. "My Apple TV"), scan_time (integer 10–300, e.g. 30), password (optional), agent_id. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that immediately restarts a managed device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that rotates the FileVault personal recovery key on a managed macOS device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Run an arbitrary shell command on one or more devices within an organization. Requires organizationId (discover with addigy_list_child_organizations). Provide a JSON body with required `agent_ids` (non-empty array of agent IDs from addigy_list_devices) and `command` (the shell command text). Optional: `background` (bool), `run_as_client` (bool). Retrieve results afterward with addigy_get_command_output using the returned action id. Returns an array of Command records.

[Addigy] Issue an MDM command that shuts down a managed device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that stops AirPlay screen mirroring on a managed device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Issue an MDM command that unlocks a locked-out local user account on a managed device. Provide a JSON body identifying the device by EXACTLY ONE of `agent_id` or `device_uuid`, plus `username` (the account to unlock). Discover known device users with addigy_list_mdm_device_users. Requires API token permission: Execute Commands. Returns the queued MDM command payload.

[Addigy] Assign an MDM configuration profile to one or more policies. Body fields: `groupId` (the profile's payload group ID, discover via addigy_list_mdm_configuration_profiles), `policyIds` (array of policy IDs to attach), and `channel` (delivery channel). Use addigy_unassign_mdm_profile_from_policies to reverse.

[Addigy] Create a Custom MDM Profile by uploading a raw .mobileconfig file. Provide the .mobileconfig XML as `profileContent` and an upload `fileName`. Optionally set minimum OS versions to scope which platforms receive it (leave a version empty/null to NOT target that platform). For Addigy-native (non-custom) payloads use addigy_create_mdm_profile instead. Requires API token permission: Create MDM Profiles.

[Addigy] Create an Addigy-native MDM profile (not a raw .mobileconfig — use addigy_create_custom_mdm_profile for that). Body fields include payload metadata plus a `payloads` array of MDM payload objects. Per-payload required keys: payload_display_name (1–160 chars), payload_type (Apple type string such as com.apple.airplay, must not be empty), payload_priority (integer, default 9). Profiles with multiple payloads are not supported. NOTE: payload key names use snake_case (e.g. allow_passcode_modification), not Apple camelCase. Use addigy_list_mdm_profile_definitions / addigy_get_mdm_profile_definition to learn each payload's required keys. Requires API token permission: Create MDM Profiles.

[Addigy] Permanently delete an MDM configuration profile by its payload group ID. The `payloadGroupId` identifies the profile to remove — discover it via addigy_list_mdm_configuration_profiles or addigy_get_mdm_profile. This removes the profile and is not reversible.

[Addigy] Deploy an MDM profile directly to a list of devices and/or managed users. This is an ATOMIC request — if any single target errors, NO profile is deployed to ANY target. Body fields: `payloads_group_id` (profile payload group ID, discover via addigy_list_mdm_configuration_profiles), `devices_uuid` (array of device UUIDs), and `devices_user_ids` (object mapping device to managed-user ID arrays). Requires API token permissions: View Devices, Execute commands.

[Addigy] Get a single MDM configuration profile by its payload group ID, including its configuration payloads. The `payloadGroupId` identifies the profile — discover it via addigy_list_mdm_configuration_profiles. Use addigy_update_mdm_profile_payloads to modify it or addigy_delete_mdm_profile to remove it.

[Addigy] Get the MDM configuration profile DEFINITION (payload manifest / schema) for a single Addigy payload type. Returns the field/key manifest describing what keys a payload of this type accepts — useful before building a body for addigy_create_mdm_profile. The `addigyPayloadType` is Addigy's payload-type identifier; use addigy_list_mdm_profile_definitions to discover all available payload types.

[Addigy] Install an MDM enrollment profile on a device (via MDM if available, otherwise via the Addigy agent for macOS devices). Requires `organizationId` (the target organization — discover via addigy_list_child_organizations). Body field: `udid` (the device UDID to enroll).

[Addigy] List all MDM configuration profiles in the organization, with their configuration payloads. Use this to discover payload group IDs for addigy_get_mdm_profile, addigy_update_mdm_profile_payloads, addigy_delete_mdm_profile, and addigy_assign_mdm_profile_to_policies. For the lighter MDM-profile listing (vendor/Apple-pushed profiles) use addigy_list_mdm_profiles.

[Addigy] List all MDM configuration profile DEFINITIONS (payload manifests / schemas). Returns the array of every Addigy-supported payload type and its key manifest. Use this to discover valid `addigyPayloadType` values for addigy_get_mdm_profile_definition and to learn the fields required when building a body for addigy_create_mdm_profile.

[Addigy] Get a list of MDM profiles (the profiles installed on / pushed via MDM). For the richer configuration-profile listing with full payloads, use addigy_list_mdm_configuration_profiles instead.

[Addigy] List the MDM profiles configured on a specific policy that match a given payload type. Requires both a `policyId` and a `payloadType`. Use this to inspect which profiles of a particular type (e.g. com.apple.airplay) a policy already carries before editing. Discover payload types via addigy_list_mdm_profile_definitions.

[Addigy] Query MDM payload information and policy assignments for a specific organization. Requires `organizationId` (discover via addigy_list_child_organizations). Optional body fields: `payload_group_ids` (array — restrict to these payload group IDs) and `excluded_payload_group_ids` (array — exclude these). Omit the body to query all. Use addigy_list_mdm_configuration_profiles to discover payload group IDs.

[Addigy] Send an MDM command to enable/disable app analytics sharing with app developers. Available in Shared iPad mode on iOS 9.3.2+. Body fields: `app_analytics` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to enable/disable Bluetooth. Available in iOS 11.3+ on supervised devices and macOS 10.13.4+. Body fields: `bluetooth` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to enable/disable data roaming. Enabling data roaming also enables voice roaming. Body fields: `data_roaming` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to set a device's name. Available only on supervised devices or macOS 10.10+. On macOS this sets the computer name and local hostname. Body fields: `device_name` (string), `host_name` (string, macOS) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to set the user preference for diagnostic submission. Shared iPad mode only; available in iOS 9.3+. Body fields: `diagnostic_submission` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to enable/disable Personal Hotspot. Only available on certain carriers. Body fields: `personal-hotspot` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to enable/disable voice roaming. Only available on certain carriers. Disabling voice roaming also disables data roaming. Body fields: `voice-roaming` (boolean — true enables, false disables) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Send an MDM command to set a device's wallpaper (a one-time setting the user can later change). Supervised mode only; iOS 8+. Body fields: `image` (Base64-encoded PNG or JPEG), `where` (integer: 1=Lock screen, 2=Home/icon-list screen, 3=Lock and Home screens) and exactly one device target: `device_uuid` or `agent_id`. Requires API token permission: Execute Commands.

[Addigy] Unassign (detach) an MDM configuration profile from one or more policies. Body fields: `groupId` (the profile's payload group ID), `policyIds` (array of policy IDs to detach), and `channel` (delivery channel). This is the reverse of addigy_assign_mdm_profile_to_policies; it removes the profile from those policies.

[Addigy] Update (REPLACE) an MDM profile's payloads. IMPORTANT: this is a full REPLACE — partial data is not supported; the existing payload is removed and recreated from exactly what you send, so provide the COMPLETE payload structure. Some keys must match the existing payload to identify what to replace (payload_identifier, payload_group_id, payload_uuid). Per-payload required keys: payload_display_name, payload_type, payload_priority, plus the type's required snake_case keys. For Custom Profiles, modify and base64-encode the `custom_profile_content` field. Discover the profile via addigy_get_mdm_profile. Requires API token permission: Edit MDM Profiles.

[Addigy] Assign a custom fact to one or more policies. Body fields: `id` (the custom fact id, from addigy_list_custom_facts) and `policies` (array of policy ids). Acts on the API key's own organization by default; pass organizationId (from addigy_list_child_organizations) to act on a specific child organization. Use addigy_unassign_custom_fact_from_policy to remove an assignment.

[Addigy] Create a custom fact. Body fields: `name`, `return_type`, `notes`, and `os_architectures` (object with `linux` and `macOS` architecture settings). Returns the new fact (including its id). Acts on the API key's own organization by default; pass organizationId (from addigy_list_child_organizations) to create the fact in a specific child organization.

[Addigy] Delete a custom fact by its id. Discover ids with addigy_list_custom_facts or addigy_query_custom_facts. Acts on the API key's own organization by default; pass organizationId (from addigy_list_child_organizations) to delete the fact in a specific child organization instead. This permanently removes the fact definition.

[Addigy] Get a single custom fact by id within a specific organization. Returns the fact's id, name, return_type, notes, and os_architectures. Requires organizationId (from addigy_list_child_organizations) and the custom fact id (from addigy_list_custom_facts or addigy_query_custom_facts). Use addigy_get_custom_fact_usage to see where the fact is referenced.

[Addigy] Get the usage of a custom fact within a specific organization — where the fact is referenced (e.g. by policies). Requires organizationId (from addigy_list_child_organizations) and the custom fact id (from addigy_list_custom_facts or addigy_query_custom_facts). Use addigy_get_custom_fact for the fact's own definition.

[Addigy] Get all custom facts defined for the API key's own organization. Returns each custom fact's id, name, return_type, notes, and os_architectures. Use addigy_get_custom_fact (with organizationId from addigy_list_child_organizations) for one fact's full detail, or addigy_query_custom_facts to filter by id/name. Paginated; response metadata carries page/page_count/per_page/result_count/total.

[Addigy] Get a paginated list of custom facts for the organization, filtered by id or name. Optional filter (via filtersJson) supports `id` (exact match) and `name_contains` (substring). Supports sort_field (e.g. name) and sort_direction (asc/desc). Returns the same fact shape as addigy_list_custom_facts. Paginated; response metadata carries page/page_count/per_page/result_count/total.

[Addigy] Get a paginated list of custom facts aggregated across organizations. Optional filter (via filtersJson) supports `name_contains` (substring) and `ids` (array of fact ids). Supports sort_field (e.g. name) and sort_direction (asc/desc). per_page is capped at 100 by the API. Spans child organizations when multitenancy=true; scope with childOrganizations. Requires API token permission: View custom facts. Paginated; response metadata carries page/page_count/per_page/result_count/total.

[Addigy] Unassign a custom fact from a policy. Requires the custom fact `id` (from addigy_list_custom_facts) and the `policy_id`. Acts on the API key's own organization by default; pass organizationId (from addigy_list_child_organizations) to act on a specific child organization. Use addigy_assign_custom_fact_to_policy to reassign.

[Addigy] Update an existing custom fact. Body fields: `id` (required — the fact to update, from addigy_list_custom_facts), `name`, `return_type`, `notes`, and `os_architectures` (object with `linux` and `macOS` architecture settings). Acts on the API key's own organization by default; pass organizationId (from addigy_list_child_organizations) to update the fact in a specific child organization.

[Addigy] Assign a device (agent) to an end user. Required body fields: `end_user_id` (from addigy_query_end_users), `agent_id` (the device's agent id). Use addigy_query_end_user_devices to view existing assignments. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Remove device assignments from an end user. Required body field: `end_user_id` (from addigy_query_end_users). Optional `agent_ids` (array of device agent ids) — omit to remove all of the end user's device assignments, or supply specific ids to remove only those. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Delete one or more SCIM credentials by external id. Required body field: `external_ids` (array of external id strings, at least one — discover via addigy_query_end_user_scim_credentials). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Disable the SCIM integration that provisions end users for this organization. Stops SCIM-driven end-user sync. Re-enable with addigy_enable_end_user_scim. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Enable a SCIM integration to provision end users for this organization. Returns the new SCIM credentials (token/external id) needed by your identity provider. Required body field: `name` (display name, min length 1). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Get a single end user by id. Returns the end_user record (id, display name, email, active state, tenant/group associations). Requires organizationId (from addigy_list_child_organizations) and endUserId (discover ids via addigy_query_end_users). Requires API token permission: View end users.

[Addigy] Get the SCIM credentials for one SCIM integration by external id. Returns the integration's credential record. Requires externalId (discover via addigy_query_end_user_scim_credentials). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Bulk-import end users and their device assignments from an inventory file (multipart upload). Provide the file contents as text and a file name. Returns import metadata (file id, status) — poll progress with addigy_query_end_user_device_import_metadata. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Query metadata for prior end-user device imports (status, counts, errors per import file). Use this to monitor an import started by addigy_import_end_user_devices. Optional filter: file_ids (array of import file ids). Paginated; response metadata has page/page_count/total. Requires organizationId from addigy_list_child_organizations. Requires API token permission: View end users.

[Addigy] Query device assignments for end users. Returns end-user-to-device links. Optional filter: end_user_ids and/or agent_ids (arrays of ids). Use addigy_assign_device_to_end_user / addigy_delete_end_user_device_assignments to change assignments. Paginated; response metadata has page/page_count/total. Requires organizationId from addigy_list_child_organizations. Requires API token permission: View end users.

[Addigy] Query end-user groups. Returns groups with id, display name, and membership metadata. Optional filters: search (free-text), tenant_ids (array), ids (array of group ids). Use the returned group ids with addigy_query_end_users (group_ids filter) to list members. Paginated; response metadata has page/page_count/total. Requires organizationId from addigy_list_child_organizations. Requires API token permission: View end users.

[Addigy] Query SCIM credentials configured for end-user provisioning. Returns credential records with external ids and display names. Optional filters: search (free-text), external_ids (array). Use the returned external ids with addigy_get_end_user_scim_credentials, addigy_update_end_user_scim, addigy_rotate_end_user_scim_token, or addigy_delete_end_user_scim_credentials. Paginated; response metadata has page/page_count/total. Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Query end users. Returns end-user records (id, display name, email, active state). Optional filters: group_ids (array — from addigy_query_end_user_groups), search (free-text), active (boolean), tenant_ids (array). Use addigy_get_end_user for a single full record. Paginated; response metadata has page/page_count/total. Requires organizationId from addigy_list_child_organizations. Requires API token permission: View end users.

[Addigy] Rotate (regenerate) the SCIM token for one integration. Returns the new SCIM credentials — the old token is invalidated, so update your identity provider afterward. Requires externalId (discover via addigy_query_end_user_scim_credentials). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Update an existing SCIM integration used to provision end users. Requires externalId (the SCIM integration's external id — discover via addigy_query_end_user_scim_credentials). Required body field: `name` (display name, min length 1). Requires organizationId from addigy_list_child_organizations. Requires API token permission: Manage end users.

[Addigy] Perform a bulk action on received alerts within a specific organization: mute, acknowledge, or resolve. Required: organizationId (from addigy_list_child_organizations), action (mute|acknowledge|resolve), and a body with alert_ids (non-empty array). For action=mute, optionally include days_to_mute (integer, e.g. 7). Discover alert ids with addigy_query_received_alerts.

[Addigy] Assign a custom monitoring item to a policy so the check applies to that policy's devices. Required body fields: alert_id (the monitoring item id from addigy_query_monitoring_items), policy_id (the target policy id). Use addigy_unassign_monitoring_item_from_policy to reverse this. Requires API token permission: Edit Policy Monitoring.

[Addigy] Create a custom monitoring item (a fact-based check that raises alerts). Common fields: name, category, type, level, fact / fact_identifier, value / value_type, min_value / max_value, selector, emails (array), send_ticket, remediation_enabled, remediation_time, has_script, script_id, instructions. Returns the created item id. Use addigy_query_monitoring_items to list existing items and addigy_assign_monitoring_item_to_policy to scope it to a policy. Requires API token permission: Create Custom Monitoring.

[Addigy] Permanently delete a custom monitoring item by its id. Discover monitoring item ids with addigy_query_monitoring_items. Requires API token permission: Delete Custom Monitoring.

[Addigy] List received alerts (monitoring checks that have fired), optionally filtered by status. Returns the alert schedule with per-alert status and timing. For richer filtering (statuses, categories, date ranges, agent ids) use addigy_query_received_alerts. Paginated; response metadata carries page/page_count/total.

[Addigy] Aggregate received-alert counts grouped by alert level across organizations. Optional filter body: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] Aggregate received-alert counts grouped by alert name across organizations. Optional filter body: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] Aggregate received-alert counts grouped by remediation status across organizations. Optional filter body: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] Aggregate received-alert counts grouped by alert status across organizations. Optional filter body: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] Aggregate received-alert counts grouped by acknowledging/resolving user across organizations. Optional filter body: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] List the organization's custom monitoring items, optionally filtered by id or a name-contains substring. Returns the item definitions (name, fact, thresholds, remediation settings). Use the returned ids with addigy_update_monitoring_item, addigy_delete_monitoring_item, or addigy_assign_monitoring_item_to_policy. Paginated; response metadata carries page/page_count/total.

[Addigy] Query received alerts across organizations with rich filtering and pagination. The nested query filter accepts: statuses[], ids[], name_contains (e.g. "disk"), remediation_status (Pending|Done|Failed), category, start_date / end_date (YYYY-MM-DD), agent_ids[]. Prefer this over addigy_list_received_alerts for filtered triage. Paginated; response metadata carries page/page_count/total. Spans child organizations when multitenancy=true (optionally scoped to a child-organizations csv list).

[Addigy] Search the organization's system-events audit stream (who did what, when — e.g. policy edits, command runs, device enrollments) with optional keyword highlighting and time-bucketed aggregation. Use addigy_search_system_events for the alternate /system-events/search surface. Paginated; response metadata carries page/page_count/total. Requires API token permission: View System Events.

[Addigy] Search the organization's system-events audit stream via the /system-events/search surface (alternate to addigy_query_system_events) with optional keyword highlighting and time-bucketed aggregation. Paginated; response metadata carries page/page_count/total. Requires API token permission: View System Events.

[Addigy] Remove a custom monitoring item from a policy (reverses addigy_assign_monitoring_item_to_policy). Both ids are required. Requires API token permission: Edit Policy Monitoring.

[Addigy] Update an existing custom monitoring item. The body must include the item id plus the fields to change. Common fields: id, name, category, type, level, fact, fact_identifier, value, value_type, min_value, max_value, selector, emails[], send_ticket, remediation_enabled, remediation_time, has_script, script_id, instructions, version. Discover ids with addigy_query_monitoring_items. Requires API token permission: Edit Custom Monitoring.

[Addigy] Assigns (or unassigns) a managed app configuration to an Apple Apps & Books (VPP) application. Provide a JSON object. Properties: location_id (string), bundle_id (string), is_assigned (boolean — true to assign, false to unassign). Use addigy_get_managed_app_config to read the current assignment state.

[Addigy] Assigns a Smart Software item to a policy, given the organizationId, policyId and the Smart Software assetId. Discover organizationId via addigy_list_child_organizations, policy ids via the policies tools, and Smart Software asset ids via addigy_query_smart_software. Requires Addigy permission: Add Asset To Policy.

[Addigy] Creates a managed app configuration for an Apps & Books (VPP) application. Provide a JSON object. Properties: location_id (string), bundle_id (string), configuration (object map of key→Configuration), is_assigned (boolean), asset_id (string). Use addigy_get_managed_app_config / addigy_search_managed_app_configs afterward to read the stored config.

[Addigy] Creates a new Smart Software item in an organization. Pass the organizationId (from addigy_list_child_organizations) and a JSON body matching CreateSmartSoftwareRequest, optionally with a profiles array of PPPC profile objects. Use addigy_query_smart_software afterward to discover the new item's id. Requires Addigy permission: Create Smart Software.

[Addigy] Creates a new version of an existing Smart Software item. Pass the organizationId (from addigy_list_child_organizations), the Smart Software id (from addigy_query_smart_software), and a JSON body matching UpdateSmartSoftwareRequest, optionally with a profiles array of PPPC profile objects. Returns the updated CustomSoftware definition. Requires Addigy permission: Create Smart Software.

[Addigy] Deletes the managed app configuration for a single Apps & Books (VPP) application, identified by its locationId and the app's bundleId. Use addigy_search_managed_app_configs to confirm which configurations exist for a location before deleting.

[Addigy] Deletes a Smart Software item by id, scoped to an organization. Pass the organizationId (from addigy_list_child_organizations) and the Smart Software id (from addigy_query_smart_software or addigy_get_smart_software). Requires Addigy permission: Delete Smart Software.

[Addigy] Gets the managed app configuration for a single Apps & Books (VPP) application, identified by its locationId (VPP/Apps-and-Books location) and the app's bundleId (e.g. com.microsoft.Outlook). Returns the configuration key/value payload plus assignment flag and asset id. Use addigy_search_managed_app_configs to enumerate every managed app configuration for a location and discover bundle ids.

[Addigy] Gets a single Smart Software item by id, scoped to an organization. Pass the organizationId (from addigy_list_child_organizations) and the Smart Software id (from addigy_query_smart_software). Returns the full CustomSoftware definition. Requires Addigy permission: View Smart Software.

[Addigy] Gets a paginated list of Smart Software items, optionally filtered. Build the filter via queryJson — a JSON object supporting: archived (bool), name_contains (string), identifier (string — to fetch the versions of a specific software), ids (array), excluded_ids (array). Sort with sortField (default name) and sortDirection (asc|desc). Paginated; per_page max 100 per Addigy and response metadata carries page_count/total. Spans child organizations when multitenancy=true (optionally narrowed by childOrganizations). Use addigy_get_smart_software for full detail of a single item. Requires Addigy permission: View Smart Software.

[Addigy] Gets the list of Apps & Books (VPP) tokens assigned to a set of policies. Provide a JSON object with a policy_ids array (string policy ids). Returns an array of AppsAndBooksToken records. Spans child organizations when multitenancy=true (optionally narrowed by childOrganizations).

[Addigy] Gets all managed app configurations for an Apps & Books (VPP) location. Returns an array of configurations, each with its bundle_id, configuration payload, assignment flag and asset id. Use this to discover bundle ids before calling addigy_get_managed_app_config, addigy_assign_managed_app_config or addigy_delete_managed_app_config.

[Addigy] Unassigns a Smart Software item from a policy, given the organizationId, policyId and the Smart Software assetId. Discover organizationId via addigy_list_child_organizations and Smart Software asset ids via addigy_query_smart_software. Requires Addigy permission: Remove Asset From Policy.

[Addigy] Adds a Prebuilt App Configuration to a Policy — this is what actually deploys a Prebuilt App from the library to the Macs in a policy. Requires organizationId from addigy_list_child_organizations. Required body fields: policy_id (target policy), prebuilt_app_id (discover with addigy_query_prebuilt_apps), prebuilt_app_version_id (discover with addigy_query_prebuilt_app_versions), provider ("prebuilt-app" or "prebuilt-app-self-service"), enforcement_days (0-14, default 14). Optional: auto_update (default true), run_removal_script (default false), update_only (default false). Returns the created configuration. Requires API token permission: Add asset to policy.

[Addigy] Removes a Prebuilt App Configuration from a Policy — undeploys the Prebuilt App from that policy. Requires organizationId from addigy_list_child_organizations and the configuration id (discover with addigy_query_prebuilt_app_configs). This is irreversible; re-add with addigy_create_prebuilt_app_config. Requires API token permission: Remove asset from policy.

[Addigy] Gets a single app from the Prebuilt App library by its app ID. Returns the app's name, provider, categories, published state, and metadata. Discover app ids with addigy_query_prebuilt_apps; list its versions with addigy_query_prebuilt_app_versions. Requires API token permission: View Prebuilt Apps.

[Addigy] Gets a single Prebuilt App Configuration by its configuration ID. Returns the configuration's policy_id, prebuilt_app_id, prebuilt_app_version_id, provider, enforcement_days, auto_update, and related deployment settings. Requires organizationId from addigy_list_child_organizations and the configuration id (discover with addigy_query_prebuilt_app_configs). Requires API token permission: View Prebuilt Apps Configurations.

[Addigy] Gets a single app version from the Prebuilt App library by its version ID. Returns the version's app_id, version string, published_date, and metadata. Discover version ids with addigy_query_prebuilt_app_versions; the version id is required to pin a Prebuilt App Configuration via addigy_create_prebuilt_app_config. Requires API token permission: View Prebuilt Apps.

[Addigy] Queries Prebuilt App Configurations across organizations. Use this to discover configuration ids before addigy_get_prebuilt_app_config / addigy_update_prebuilt_app_config / addigy_delete_prebuilt_app_config. Pass a queryJson filter object to narrow results (any of: ids[], policy_ids[], prebuilt_app_ids[], prebuilt_app_version_ids[], provider (prebuilt-app|prebuilt-app-self-service), update_only, auto_update, assist_onboarding). Sort with sortField (id|policy_id|prebuilt_app_id|prebuilt_app_version_id) + sortDirection (asc|desc). Paginated; response metadata has page/page_count/total. Spans child organizations when multitenancy=true. Requires API token permission: View Prebuilt Apps Configurations.

[Addigy] Queries app versions in the Prebuilt App library to discover version ids (needed to pin a Prebuilt App Configuration via addigy_create_prebuilt_app_config). Pass a queryJson filter object to narrow results (any of: ids[], app_ids[], policy_ids[], version). Sort with sortField (id|app_id|version|published_date) + sortDirection (asc|desc). Paginated; response metadata has page/page_count/total. Requires API token permission: View Prebuilt Apps.

[Addigy] Queries the Prebuilt App library to discover available apps (and their app ids) for deployment via addigy_create_prebuilt_app_config. Pass a queryJson filter object to narrow results (any of: ids[], excluded_ids[], assigned_ids[], policy_ids[], categories[], name, provider (prebuilt-app|prebuilt-app-self-service), assist_onboarding, published, version_id). Sort with sortField + sortDirection (asc|desc). Paginated; response metadata has page/page_count/total. Requires API token permission: View Prebuilt Apps.

[Addigy] Updates an existing Prebuilt App Configuration (e.g. pin a new prebuilt_app_version_id, change enforcement_days or auto_update). Requires organizationId from addigy_list_child_organizations and the configuration id (discover with addigy_query_prebuilt_app_configs). Body fields (all optional): prebuilt_app_version_id, enforcement_days (0-14), auto_update, run_removal_script, update_only, assist_onboarding. Returns the updated configuration. Requires API token permission: Edit Prebuilt Apps Configurations.

[Addigy] Assign a scheduled maintenance item to a policy so devices in that policy run it. Required body fields: `maintenance_id` (from addigy_query_maintenance_items) and `policy_id` (the target policy). Requires API token permission: Edit Policy Maintenance. Use addigy_unassign_maintenance_item_from_policy to reverse.

[Addigy] Assign an OS user asset to a policy. Requires organizationId (discover via addigy_list_child_organizations), the asset_id of the OS user, and the policy_id to assign it to. Requires API token permission: Add asset to policy. Use addigy_unassign_os_user_from_policy to reverse.

[Addigy] Cancel a scheduled or active TempAdmin session for a Mac user account. Requires organizationId (discover via addigy_list_child_organizations), agent_id (the device's Agent ID), and account_name (the macOS account). Requires API token permission: Manage Mac Users Privileges. Use addigy_schedule_temp_admin_session to (re)schedule.

[Addigy] Create a device script assignment — schedule a script (predefined command) to run on one or more devices in the organization. Required body fields: `script_id` (Script or Command ID from addigy_query_scripts) and `agent_ids` (array of Agent IDs of the target devices). Defaults to the API key's own organization; pass organizationId to target a specific child organization (discover IDs via addigy_list_child_organizations). Use addigy_list_device_script_assignments to confirm the assignment afterward.

[Addigy] Create a scheduled maintenance item (a recurring catalog maintenance task). Body properties include `name`, `description`, `frequency` (e.g. `Monthly`), `day` (e.g. `15`), `scheduled_time`, `enabled`, `local_time`, `prompt_user`, `timeout_seconds`, `max_try_count`, `expected_remediation_time`, `is_in_blueprint`, `version`, and `scripts` (array of {name, type, command_id, script}). Requires API token permission: Create Catalog Maintenance. Use addigy_query_maintenance_items to confirm afterward and addigy_assign_maintenance_item_to_policy to scope it to a policy.

[Addigy] Create one or more scripts (predefined commands) in an organization. Requires organizationId (discover via addigy_list_child_organizations). Body field `commands` is a required non-empty array of script objects; each script requires `name`, `text` (the script body), and `categories` (non-empty array of category names), with optional `description`, `created_date`, and `in_review`. Requires API token permission: Create Predefined Commands. Use addigy_query_scripts to discover the new script ids.

[Addigy] Delete a device script assignment — unschedule a script (predefined command) from a single device. Requires both script_id (Script or Command ID from addigy_query_scripts) and agent_id (the device's Agent ID). Defaults to the API key's own organization; pass organizationId to target a specific child organization (discover IDs via addigy_list_child_organizations). Use addigy_list_device_script_assignments to find existing assignments.

[Addigy] Delete a scheduled maintenance item by its id (from addigy_query_maintenance_items). Requires API token permission: Delete Catalog Maintenance.

[Addigy] Delete an OS User asset from an organization. Requires organizationId (discover via addigy_list_child_organizations) and the asset_id of the OS user. Requires API token permission: Delete OS Users.

[Addigy] Delete a script (predefined command) by id from an organization. Requires organizationId (discover via addigy_list_child_organizations) and the script id (discover via addigy_query_scripts). Requires API token permission: Delete Predefined Commands.

[Addigy] List device script assignments available for the organization — the mapping of scripts (predefined commands) to the specific devices they are scheduled to run on. Returns an array of assignments keyed by script_id and agent_id. Optionally filter to a single script (script_id from addigy_query_scripts) or a single device (agent_id, the device's Agent ID). Acts on the API key's own organization. Use addigy_create_device_script_assignment to add an assignment and addigy_delete_device_script_assignment to remove one.

[Addigy] Query the organization's scheduled maintenance items (recurring catalog maintenance — bundles of scripts run on a frequency). Returns a paginated list. Optional filters via filtersJson: `id` (exact maintenance id) and `name_contains` (substring match on name). Optional sort_field (e.g. `frequency`) and sort_direction (`asc`/`desc`). Paginated; response metadata carries page/page_count/total. Use addigy_create_maintenance_item to add one and addigy_update_maintenance_item / addigy_delete_maintenance_item to manage existing items.

[Addigy] Query the organization's scripts (predefined commands) and return a paginated list. Requires organizationId (discover via addigy_list_child_organizations). Optional filter via filtersJson: `ids` (array of script ids). Optional sort_field (e.g. `name`) and sort_order (`asc`/`desc`). Paginated (per_page max 100 upstream); response metadata carries page/page_count/total. Requires API token permission: View Predefined Commands. Use addigy_create_scripts to add scripts and addigy_delete_script to remove one.

[Addigy] Schedule (or update the schedule for) a TempAdmin session that temporarily promotes a Mac user account to admin. Requires organizationId (discover via addigy_list_child_organizations), agent_id (the device's Agent ID), and account_name (the macOS account to promote). Optional body fields: `start_time` and `end_time` (ISO8601, e.g. 2024-07-08T19:00:00Z), `device_local_time` (bool), and `reason` (e.g. 'Install Slack'). Requires API token permission: Manage Mac Users Privileges. Use addigy_cancel_temp_admin_session to cancel.

[Addigy] Unassign a scheduled maintenance item from a policy. Requires the maintenance id (from addigy_query_maintenance_items) and the policy_id. Requires API token permission: Edit Policy Maintenance. Use addigy_assign_maintenance_item_to_policy to re-assign.

[Addigy] Unassign an OS user asset from a policy. Requires organizationId (discover via addigy_list_child_organizations), the asset_id of the OS user, and the policy_id to unassign it from. Requires API token permission: Remove asset from policy. Use addigy_assign_os_user_to_policy to re-assign.

[Addigy] Update an existing scheduled maintenance item. Body must include `id` (the maintenance id from addigy_query_maintenance_items) plus the fields to change: `name`, `description`, `frequency`, `day`, `scheduled_time`, `enabled`, `local_time`, `prompt_user`, `timeout_seconds`, `max_try_count`, `expected_remediation_time`, `is_in_blueprint`, `version`, and `scripts` (array of {name, type, command_id, script}). Requires API token permission: Edit Catalog Maintenance.

[Addigy] Requests that an installed-system-updates report for a policy's devices be generated and emailed to a recipient. This is an asynchronous side-effecting action (it sends an email), not a synchronous data fetch — for inline data on one device use addigy_get_device_installed_updates_report. Body fields: `policy_id` (the Addigy policy whose devices to report on) and `email` (the recipient address). Requires API token permission: View System Updates Settings.

[Addigy] Returns the OS software updates reported as available for a single device, each annotated with its current installation status (e.g. scheduled, downloading, installing, installed, failed). Combines the available-update list from addigy_list_available_system_updates with per-update progress. Requires the device's MDM UDID. Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Returns the history of OS software updates already installed on a single device, as reported via MDM. Use this to audit patch level / confirm an update applied after scheduling it. Note: this endpoint keys off the device UUID (the Addigy device identifier), not the MDM UDID used by the request/status tools. For the same data across all devices in a policy delivered by email, use addigy_email_installed_updates_report. Requires API token permission: View System Updates Settings, View Device List.

[Addigy] Returns the configured system-updates settings for a policy — the per-OS (macOS/iOS/iPadOS/tvOS) update enforcement rules and the optional daily-send schedule. Use this to inspect current configuration before changing it with addigy_set_system_updates_settings. Requires the Addigy policy id. Requires API token permission: View System Updates Settings.

[Addigy] Returns the current system-updates statuses most recently reported for a single device (the live progress of in-flight OS updates). Reads the cached/last-reported statuses; to force the device to re-report, first call addigy_request_system_updates_status. Requires the device's MDM UDID. Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Returns the OS software updates most recently reported as available for a single device. Reads the cached/last-reported list; to force the device to re-report, first call addigy_request_available_system_updates (or addigy_request_system_updates_scan). For each available update with its current install status, use addigy_get_available_system_updates_status instead. Requires the device's MDM UDID. Requires API token permission: View Device List.

[Addigy] Issues an MDM command asking a device to report the OS software updates it currently has available. This is a write/command action — it queues an MDM command rather than returning the cached list (use addigy_list_available_system_updates to read the previously-reported results, or addigy_get_available_system_updates_status to read results with their install statuses). Required body field: `device_udid` (the device's MDM UDID). Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Issues an MDM command telling a device to scan for newly-available OS software updates, refreshing what addigy_list_available_system_updates / addigy_get_available_system_updates_status will return. Required body field: `device_udid` (the device's MDM UDID). Optional: `force` (boolean — bypass any cached scan result and force a fresh scan). Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Issues an MDM command scheduling a specific OS software update to install on a single device. Use this to push one known update (discovered via addigy_list_available_system_updates) with a chosen install behavior, rather than the bulk on-demand tools. Required body fields: `device_udid` (the device's MDM UDID), `product_key` (the update's product key from the available-updates list), and `install_action` (one of: Default, DownloadOnly, InstallASAP, NotifyOnly, InstallLater, InstallForceRestart). Optional: `product_version`, `description`. Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Issues an MDM command asking a device to report its current system-updates statuses, refreshing what addigy_get_system_updates_status will return. This is a write/command action that queues an MDM command rather than returning the statuses inline. Required body field: `device_udid` (the device's MDM UDID). Requires API token permission: View Device List, Execute Predefined Commands.

[Addigy] Sends on-demand MDM system-update commands immediately to a specific list of devices, rather than waiting for the default daily 2AM UTC schedule. Body field: `device_uuids` (array of Addigy device UUIDs to update now). To target a whole policy instead, use addigy_schedule_updates_for_policy. Applies to MDM system updates only; the organization must have a monthly paid plan to use this feature. Requires API token permission: View System Updates Settings, Create System Updates Settings.

[Addigy] Sends on-demand MDM system-update commands immediately to every device in a policy, rather than waiting for the default daily 2AM UTC schedule. Body field: `policy_id` (the Addigy policy whose devices to update now). To target a hand-picked device list instead, use addigy_schedule_updates_for_devices. Applies to MDM system updates only; the organization must have a monthly paid plan to use this feature. Requires API token permission: View System Updates Settings, Create System Updates Settings.

[Addigy] Creates or updates the system-updates settings for a policy, covering both MDM and Declarative Device Management (DDM) enforcement across macOS/iOS/iPadOS/tvOS, plus an optional send schedule. MDM enforcement needs supervised devices on macOS 12+/iOS 9+/iPadOS 13+/tvOS 12+; DDM needs supervised macOS 14+/iOS 17+/iPadOS 17+. Body field `policy_id` selects the target policy; `macos_settings`/`ios_settings`/`ipados_settings`/`tvos_settings` carry the per-OS rules (e.g. keep_os_updated, install_action, max_user_deferrals, deferrals, automatic_actions, denied_period, allowed_days); `schedule` controls the optional non-default send window (set schedule.enabled=false to keep the daily 2AM UTC default; if enabled, all schedule fields are required and the org must have a monthly paid plan). Fetch the current shape with addigy_get_system_updates_settings first. Requires API token permission: Create System Updates Settings.

[Addigy] Creates a new Self Service configuration in the organization. Supply a JSON body describing the configuration — common fields include `name`, `label`, `description`, `os_type`, `display_mode`, `grace_period` (integer), home-screen branding (`home_screen_company_name`, `home_screen_email`, `home_screen_phone`, `home_screen_address`, `home_screen_description`, and their `home_screen_show_*` boolean toggles), prompt text fields (`maintenance_prompt_text`, `filevault_prompt_text`, `screenview_prompt_text`, `user_sentiment_prompt_text`, `ms_office_updates_prompt_text`), icon/logo file objects (`app_logo`, `dark_mode_app_logo`, `dock_icon`, `menubar_icon`), and behavior toggles (`show_support`, `hide_chat`, `restart_after_complete`, `show_complete_screen`, `beta_program_enabled`, `is_onboarding_config`, `policy_restricted`, `allow_location_tracking`, `integration_intune_enabled`, `instruction_id`). Use addigy_get_policy_self_service_configs to inspect existing assignments. Requires API token permission: Create Instruction.