Skip to main content

​
Add device note

Action ID: tools.iru.add_device_note Add a note to a device record. Reference: https://api-docs.iru.com/#fc3a2a64-b772-4145-a216-0b7ba8e0ff90

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string
required
Note content to add.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Delete device

Action ID: tools.iru.delete_device Delete a device. Removes the device record, unenrolls the device from MDM, and causes the Iru agent to uninstall itself at next check-in. This cannot be undone. Reference: https://api-docs.iru.com/#97deb582-d86c-444a-aa3b-3528b9a8478f

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Erase device

Action ID: tools.iru.erase_device Irreversibly erase a device. Optionally control platform-specific erase behavior. Reference: https://api-docs.iru.com/#149ae2cc-fb7f-42ce-8379-187878685303

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
boolean | null
Whether to disallow proximity setup after erase.Default: null.
​
string | null
Erase flags. Android only.Default: null.
​
string | null
Erase mode. Windows only.Default: null.
​
string | null
Six-character macOS erase PIN; ignored for iOS, iPadOS, and tvOS.Default: null.
​
boolean | null
Whether to preserve the cellular data plan during erase.Default: null.
​
object | null
Return to Service settings for iOS 17 and later, so the device re-enrolls after erase.Default: null.

​
Get Activation Lock bypass code

Action ID: tools.iru.get_activation_lock_bypass_code Get a device’s Activation Lock bypass code. Retrieval is recorded in the Iru audit log. Escrow the code before any destructive offboarding step. Reference: https://api-docs.iru.com/#f593744e-eedc-4d4d-ac0d-45d54860bbc5

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Get device

Action ID: tools.iru.get_device Get a device record by UUID. Reference: https://api-docs.iru.com/#10a56208-b230-455a-a835-32b6cfb2803d

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Get device details

Action ID: tools.iru.get_device_details Get detailed inventory information for a device. Reference: https://api-docs.iru.com/#efa2170d-e5f7-4b97-8f4c-da6f84ba58b5

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Get FileVault recovery key

Action ID: tools.iru.get_filevault_key Get a device’s FileVault recovery key. Retrieval is recorded in the Iru audit log. Escrow the key before any destructive offboarding step. Reference: https://api-docs.iru.com/#1577d0da-7b69-4c2b-a322-32bf1cfffee2

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Get recovery lock password

Action ID: tools.iru.get_recovery_password Get a device’s recovery lock password. Retrieval is recorded in the Iru audit log. Escrow the password before any destructive offboarding step. Reference: https://api-docs.iru.com/#a0c3f9a9-485b-46ec-922c-fc5f0e9a48d9

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
List audit events

Action ID: tools.iru.list_audit_events List tenant audit events. Covers Blueprint and Library Item changes, access to sensitive data such as FileVault and recovery keys, device lifecycle events, and API token management. Reference: https://api-docs.iru.com/#06022d9d-426b-4aea-826a-d7f084e4f1e3

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Cursor identifying the requested page.Default: null.
​
string | null
Latest event date to include.Default: null.
​
integer | null
Results per page. Maximum 500.Default: null.
​
string | null
Sort field, occurred_at or id; prefix with - for descending order.Default: null.
​
string | null
Earliest event date to include.Default: null.

​
List blueprints

Action ID: tools.iru.list_blueprints List Blueprints in the tenant. Reference: https://api-docs.iru.com/#44d3765c-ef17-4226-9104-47e5cef1d370

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Blueprint UUID to filter by.Default: null.
​
string | null
Comma-separated Blueprint UUIDs to include.Default: null.
​
integer | null
Results per page. Maximum 300.Default: null.
​
string | null
Blueprint name substring to match.Default: null.
​
integer | null
Number of results to skip.Default: null.

​
List device activity

Action ID: tools.iru.list_device_activity List activity records for a device. Reference: https://api-docs.iru.com/#80710108-fbdb-4dfd-af84-50adf15c5a23

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
integer | null
Results per page. Maximum 300.Default: null.
​
integer | null
Number of results to skip.Default: null.

​
List device apps

Action ID: tools.iru.list_device_apps List applications installed on a device. Reference: https://api-docs.iru.com/#f8cd9733-89b6-40f0-a7ca-76829c6974df

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
List device behavioral detections

Action ID: tools.iru.list_device_behavioral_detections List EDR behavioral detection events for a single device. The v2 endpoint is device-scoped, so a device UUID is required and fleet-wide sweeps are not available. Threat state is read-only through the API. Reference: https://api-docs.iru.com/#39bfcf91-086a-4907-a69d-b5bca6a1a1a8

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Required. Device UUID to return detection events for.
​
string | null
Iru base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Detection classifications to filter by.Default: null.
​
string | null
Earliest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).Default: null.
​
string | null
Latest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).Default: null.
​
integer | null
Results per page. Maximum 1000.Default: null.
​
string | null
Management states to filter by.Default: null.
​
integer | null
Number of results to skip.Default: null.
​
string | null
Search term to filter results.Default: null.
​
string | null
Severity levels to filter by.Default: null.
​
string | null
Field to sort by; prefix with - to reverse the order.Default: null.
​
string | null
Detection statuses to filter by.Default: null.
​
string | null
Tags to filter by.Default: null.

​
List device commands

Action ID: tools.iru.list_device_commands List commands sent to a device. Status codes are 1 Pending, 2 Running, 3 Completed, 4 Failed, and 5 Not Now. Reference: https://api-docs.iru.com/#740d515c-218d-48db-b452-959c3c73aaeb

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
integer | null
Results per page. Maximum 300.Default: null.
​
integer | null
Number of results to skip.Default: null.

​
List device library items

Action ID: tools.iru.list_device_library_items List Library Items assigned to a device. Reference: https://api-docs.iru.com/#005bf79f-3458-4834-9c2f-4e0c792069f4

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
List device parameters

Action ID: tools.iru.list_device_parameters List management parameter (compliance check) results for a device. Reference: https://api-docs.iru.com/#8ca8c0e9-654e-40c1-8d8c-c9a8a6e262c6

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
List devices

Action ID: tools.iru.list_devices List devices in the tenant. Returns a bare JSON array rather than a paged envelope, and extra fields appear when Windows or Android management is enabled. Reference: https://api-docs.iru.com/#78209960-31a7-4e3b-a2c0-95c7e65bb5f9

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string | null
Asset tag to filter by.Default: null.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Blueprint UUID to filter by.Default: null.
​
string | null
Device UUID to filter by.Default: null.
​
string | null
Device name to filter by.Default: null.
​
boolean | null
Whether to filter for devices with FileVault enabled or disabled.Default: null.
​
integer | null
Results per page. Maximum 300.Default: null.
​
string | null
MAC address to filter by.Default: null.
​
string | null
Device model to filter by.Default: null.
​
integer | null
Number of results to skip.Default: null.
​
string | null
Field to order results by; prefix with - to reverse the order.Default: null.
​
string | null
Operating system version to filter by.Default: null.
​
string | null
Platform to filter by, such as Mac, iPad, iPhone, AppleTV, or Android.Default: null.
​
string | null
Serial number to filter by.Default: null.
​
string | null
Tag UUID to filter by.Default: null.
​
string | null
Tag IDs to filter by, separated by commas. Case sensitive.Default: null.
​
string | null
Tag name to filter by.Default: null.
​
string | null
Tag names to filter by, separated by commas. Case sensitive.Default: null.
​
string | null
Assigned user to filter by.Default: null.
​
string | null
Assigned user email to filter by.Default: null.
​
string | null
Exact match on the assigned user’s email address.Default: null.
​
string | null
Assigned user UUID to filter by.Default: null.
​
string | null
Assigned user name to filter by.Default: null.

​
List threat details

Action ID: tools.iru.list_threat_details List malware and potentially unwanted program detections. Threat state is read-only through the API; there is no endpoint to release a detection from quarantine. Reference: https://api-docs.iru.com/#92ff98c7-c048-4f1e-9ac2-3b65ea9af5dd

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Required. Threat statuses to return, such as quarantined, not_quarantined, or released.
​
string | null
Iru base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Threat classification to filter by, such as malware or pup.Default: null.
​
integer | null
Return records from the last N days.Default: null.
​
string | null
Earliest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).Default: null.
​
string | null
Latest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).Default: null.
​
string | null
Return detections for a single device UUID.Default: null.
​
integer | null
Results per page. Maximum 1000.Default: null.
​
string | null
Management states to filter by.Default: null.
​
integer | null
Number of results to skip.Default: null.
​
string | null
Severity levels to filter by.Default: null.
​
string | null
Field to sort by; prefix with - to reverse the order.Default: null.
​
string | null
Tags to filter by.Default: null.
​
string | null
Search term matched against fields such as device name and file hash.Default: null.

​
Lock device

Action ID: tools.iru.lock_device Lock a device. For macOS an unlock PIN is generated and returned in the response. On Apple silicon running macOS earlier than 11.5 this deactivates the Mac, and reactivation requires network access and a Secure Token administrator. Reference: https://api-docs.iru.com/#f2fc0e99-c758-4eb8-bb3d-0ea72d0c0213

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Message to display on the locked device.Default: null.
​
string | null
Phone number to display on the locked device.Default: null.

​
Query Prism inventory

Action ID: tools.iru.query_prism Query a fleet-wide Prism inventory category. Reference: https://api-docs.iru.com/#d538b34f-5343-416e-be53-2ba108c51dfa

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Prism category, such as activation_lock, application_firewall, apps, cellular, certificates, desktop_and_screensaver, device_information, filevault, gatekeeper_and_xprotect, installed_profiles, kernel_extensions, launch_agents_and_daemons, local_users, startup_settings, system_extensions, or transparency_database.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
array[string] | null
Blueprint UUIDs to filter by.Default: null.
​
string | null
Pagination cursor. Iru recommends cursor paging for Prism; pass an empty string to get the first cursor, then loop on the cursor returned by each page.Default: null.
​
array[string] | null
Device families to filter by.Default: null.
​
object | null
Provider-native Prism filter object.Default: null.
​
integer | null
Results per page. Maximum 300.Default: null.
​
integer | null
Number of results to skip. Cannot be combined with cursor.Default: null.
​
string | null
Field to sort by; prefix with - to reverse the order.Default: null.

​
Send device action

Action ID: tools.iru.send_device_action Send a device action that takes no request body. Lock and erase have dedicated actions because they accept request bodies. Reference: https://api-docs.iru.com/#8c0c2c1a-4d57-4a56-80f9-87d0793f0006

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Action to send, such as restart, shutdown, blankpush, dailycheckin, updateinventory, reinstallagent, renewmdmprofile, clearpasscode, enablelostmode, disablelostmode, playlostmodesound or updatelocation.
​
string
required
Device UUID.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.

​
Update device

Action ID: tools.iru.update_device Update a device’s assignment and metadata. There is no separate blueprint-assignment endpoint, so use this action to assign a Blueprint during onboarding. Reference: https://api-docs.iru.com/#b70f2ddc-cc1b-4b4f-8eec-e481d8a17927

​
Secrets

Required secrets:
  • iru: required values IRU_API_TOKEN.

​
Input fields

​
string
required
Device UUID.
​
string | null
Asset tag to set on the device.Default: null.
​
string | null
Iru (Kandji) API base URL (e.g. https://acme.api.kandji.io).Default: null.
​
string | null
Blueprint UUID to assign to the device.Default: null.
​
object | null
Extra body fields, merged over the named inputs above. Use this to send an explicit null, which is how Iru clears a field — for example an asset_tag or user key set to null.Default: null.
​
array[string] | null
Tag names to assign to the device. Replaces the current tags; pass an empty list to clear them.Default: null.
​
string | null
User UUID to assign to the device.Default: null.