> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Iru (Kandji)

> Reference for the Tracecat Iru (Kandji) integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add device note

Action ID: `tools.iru.add_device_note`

Add a note to a device record.

Reference: [https://api-docs.iru.com/#fc3a2a64-b772-4145-a216-0b7ba8e0ff90](https://api-docs.iru.com/#fc3a2a64-b772-4145-a216-0b7ba8e0ff90)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="note" type="string" required>
  Note content to add.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Delete device

Action ID: `tools.iru.delete_device`

Delete a device. Removes the device record, unenrolls the device from MDM, and causes the Iru agent to uninstall itself at next check-in. This cannot be undone.

Reference: [https://api-docs.iru.com/#97deb582-d86c-444a-aa3b-3528b9a8478f](https://api-docs.iru.com/#97deb582-d86c-444a-aa3b-3528b9a8478f)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Erase device

Action ID: `tools.iru.erase_device`

Irreversibly erase a device. Optionally control platform-specific erase behavior.

Reference: [https://api-docs.iru.com/#149ae2cc-fb7f-42ce-8379-187878685303](https://api-docs.iru.com/#149ae2cc-fb7f-42ce-8379-187878685303)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="disallow_proximity_setup" type="boolean | null">
  Whether to disallow proximity setup after erase.

  Default: `null`.
</ParamField>

<ParamField path="erase_flags" type="string | null">
  Erase flags. Android only.

  Default: `null`.
</ParamField>

<ParamField path="erase_mode" type="string | null">
  Erase mode. Windows only.

  Default: `null`.
</ParamField>

<ParamField path="pin" type="string | null">
  Six-character macOS erase PIN; ignored for iOS, iPadOS, and tvOS.

  Default: `null`.
</ParamField>

<ParamField path="preserve_data_plan" type="boolean | null">
  Whether to preserve the cellular data plan during erase.

  Default: `null`.
</ParamField>

<ParamField path="return_to_service" type="object | null">
  Return to Service settings for iOS 17 and later, so the device re-enrolls after erase.

  Default: `null`.
</ParamField>

## Get Activation Lock bypass code

Action ID: `tools.iru.get_activation_lock_bypass_code`

Get a device's Activation Lock bypass code. Retrieval is recorded in the Iru audit log. Escrow the code before any destructive offboarding step.

Reference: [https://api-docs.iru.com/#f593744e-eedc-4d4d-ac0d-45d54860bbc5](https://api-docs.iru.com/#f593744e-eedc-4d4d-ac0d-45d54860bbc5)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Get device

Action ID: `tools.iru.get_device`

Get a device record by UUID.

Reference: [https://api-docs.iru.com/#10a56208-b230-455a-a835-32b6cfb2803d](https://api-docs.iru.com/#10a56208-b230-455a-a835-32b6cfb2803d)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Get device details

Action ID: `tools.iru.get_device_details`

Get detailed inventory information for a device.

Reference: [https://api-docs.iru.com/#efa2170d-e5f7-4b97-8f4c-da6f84ba58b5](https://api-docs.iru.com/#efa2170d-e5f7-4b97-8f4c-da6f84ba58b5)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Get FileVault recovery key

Action ID: `tools.iru.get_filevault_key`

Get a device's FileVault recovery key. Retrieval is recorded in the Iru audit log. Escrow the key before any destructive offboarding step.

Reference: [https://api-docs.iru.com/#1577d0da-7b69-4c2b-a322-32bf1cfffee2](https://api-docs.iru.com/#1577d0da-7b69-4c2b-a322-32bf1cfffee2)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Get recovery lock password

Action ID: `tools.iru.get_recovery_password`

Get a device's recovery lock password. Retrieval is recorded in the Iru audit log. Escrow the password before any destructive offboarding step.

Reference: [https://api-docs.iru.com/#a0c3f9a9-485b-46ec-922c-fc5f0e9a48d9](https://api-docs.iru.com/#a0c3f9a9-485b-46ec-922c-fc5f0e9a48d9)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## List audit events

Action ID: `tools.iru.list_audit_events`

List tenant audit events. Covers Blueprint and Library Item changes, access to sensitive data such as FileVault and recovery keys, device lifecycle events, and API token management.

Reference: [https://api-docs.iru.com/#06022d9d-426b-4aea-826a-d7f084e4f1e3](https://api-docs.iru.com/#06022d9d-426b-4aea-826a-d7f084e4f1e3)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Cursor identifying the requested page.

  Default: `null`.
</ParamField>

<ParamField path="end_date" type="string | null">
  Latest event date to include.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 500.

  Default: `null`.
</ParamField>

<ParamField path="sort_by" type="string | null">
  Sort field, occurred\_at or id; prefix with - for descending order.

  Default: `null`.
</ParamField>

<ParamField path="start_date" type="string | null">
  Earliest event date to include.

  Default: `null`.
</ParamField>

## List blueprints

Action ID: `tools.iru.list_blueprints`

List Blueprints in the tenant.

Reference: [https://api-docs.iru.com/#44d3765c-ef17-4226-9104-47e5cef1d370](https://api-docs.iru.com/#44d3765c-ef17-4226-9104-47e5cef1d370)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="id" type="string | null">
  Blueprint UUID to filter by.

  Default: `null`.
</ParamField>

<ParamField path="id__in" type="string | null">
  Comma-separated Blueprint UUIDs to include.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 300.

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  Blueprint name substring to match.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

## List device activity

Action ID: `tools.iru.list_device_activity`

List activity records for a device.

Reference: [https://api-docs.iru.com/#80710108-fbdb-4dfd-af84-50adf15c5a23](https://api-docs.iru.com/#80710108-fbdb-4dfd-af84-50adf15c5a23)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 300.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

## List device apps

Action ID: `tools.iru.list_device_apps`

List applications installed on a device.

Reference: [https://api-docs.iru.com/#f8cd9733-89b6-40f0-a7ca-76829c6974df](https://api-docs.iru.com/#f8cd9733-89b6-40f0-a7ca-76829c6974df)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## List device behavioral detections

Action ID: `tools.iru.list_device_behavioral_detections`

List EDR behavioral detection events for a single device. The v2 endpoint is device-scoped, so a device UUID is required and fleet-wide sweeps are not available. Threat state is read-only through the API.

Reference: [https://api-docs.iru.com/#39bfcf91-086a-4907-a69d-b5bca6a1a1a8](https://api-docs.iru.com/#39bfcf91-086a-4907-a69d-b5bca6a1a1a8)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Required. Device UUID to return detection events for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="classifications" type="string | null">
  Detection classifications to filter by.

  Default: `null`.
</ParamField>

<ParamField path="detection_from" type="string | null">
  Earliest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).

  Default: `null`.
</ParamField>

<ParamField path="detection_to" type="string | null">
  Latest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 1000.

  Default: `null`.
</ParamField>

<ParamField path="management_state" type="string | null">
  Management states to filter by.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

<ParamField path="search_term" type="string | null">
  Search term to filter results.

  Default: `null`.
</ParamField>

<ParamField path="severities" type="string | null">
  Severity levels to filter by.

  Default: `null`.
</ParamField>

<ParamField path="sort_by" type="string | null">
  Field to sort by; prefix with - to reverse the order.

  Default: `null`.
</ParamField>

<ParamField path="statuses" type="string | null">
  Detection statuses to filter by.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="string | null">
  Tags to filter by.

  Default: `null`.
</ParamField>

## List device commands

Action ID: `tools.iru.list_device_commands`

List commands sent to a device. Status codes are 1 Pending, 2 Running, 3 Completed, 4 Failed, and 5 Not Now.

Reference: [https://api-docs.iru.com/#740d515c-218d-48db-b452-959c3c73aaeb](https://api-docs.iru.com/#740d515c-218d-48db-b452-959c3c73aaeb)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 300.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

## List device library items

Action ID: `tools.iru.list_device_library_items`

List Library Items assigned to a device.

Reference: [https://api-docs.iru.com/#005bf79f-3458-4834-9c2f-4e0c792069f4](https://api-docs.iru.com/#005bf79f-3458-4834-9c2f-4e0c792069f4)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## List device parameters

Action ID: `tools.iru.list_device_parameters`

List management parameter (compliance check) results for a device.

Reference: [https://api-docs.iru.com/#8ca8c0e9-654e-40c1-8d8c-c9a8a6e262c6](https://api-docs.iru.com/#8ca8c0e9-654e-40c1-8d8c-c9a8a6e262c6)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## List devices

Action ID: `tools.iru.list_devices`

List devices in the tenant. Returns a bare JSON array rather than a paged envelope, and extra fields appear when Windows or Android management is enabled.

Reference: [https://api-docs.iru.com/#78209960-31a7-4e3b-a2c0-95c7e65bb5f9](https://api-docs.iru.com/#78209960-31a7-4e3b-a2c0-95c7e65bb5f9)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="asset_tag" type="string | null">
  Asset tag to filter by.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="blueprint_id" type="string | null">
  Blueprint UUID to filter by.

  Default: `null`.
</ParamField>

<ParamField path="device_id" type="string | null">
  Device UUID to filter by.

  Default: `null`.
</ParamField>

<ParamField path="device_name" type="string | null">
  Device name to filter by.

  Default: `null`.
</ParamField>

<ParamField path="filevault_enabled" type="boolean | null">
  Whether to filter for devices with FileVault enabled or disabled.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 300.

  Default: `null`.
</ParamField>

<ParamField path="mac_address" type="string | null">
  MAC address to filter by.

  Default: `null`.
</ParamField>

<ParamField path="model" type="string | null">
  Device model to filter by.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

<ParamField path="ordering" type="string | null">
  Field to order results by; prefix with - to reverse the order.

  Default: `null`.
</ParamField>

<ParamField path="os_version" type="string | null">
  Operating system version to filter by.

  Default: `null`.
</ParamField>

<ParamField path="platform" type="string | null">
  Platform to filter by, such as Mac, iPad, iPhone, AppleTV, or Android.

  Default: `null`.
</ParamField>

<ParamField path="serial_number" type="string | null">
  Serial number to filter by.

  Default: `null`.
</ParamField>

<ParamField path="tag_id" type="string | null">
  Tag UUID to filter by.

  Default: `null`.
</ParamField>

<ParamField path="tag_id_in" type="string | null">
  Tag IDs to filter by, separated by commas. Case sensitive.

  Default: `null`.
</ParamField>

<ParamField path="tag_name" type="string | null">
  Tag name to filter by.

  Default: `null`.
</ParamField>

<ParamField path="tag_name_in" type="string | null">
  Tag names to filter by, separated by commas. Case sensitive.

  Default: `null`.
</ParamField>

<ParamField path="user" type="string | null">
  Assigned user to filter by.

  Default: `null`.
</ParamField>

<ParamField path="user_email" type="string | null">
  Assigned user email to filter by.

  Default: `null`.
</ParamField>

<ParamField path="user_email_exact" type="string | null">
  Exact match on the assigned user's email address.

  Default: `null`.
</ParamField>

<ParamField path="user_id" type="string | null">
  Assigned user UUID to filter by.

  Default: `null`.
</ParamField>

<ParamField path="user_name" type="string | null">
  Assigned user name to filter by.

  Default: `null`.
</ParamField>

## List threat details

Action ID: `tools.iru.list_threat_details`

List malware and potentially unwanted program detections. Threat state is read-only through the API; there is no endpoint to release a detection from quarantine.

Reference: [https://api-docs.iru.com/#92ff98c7-c048-4f1e-9ac2-3b65ea9af5dd](https://api-docs.iru.com/#92ff98c7-c048-4f1e-9ac2-3b65ea9af5dd)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="statuses" type="string" required>
  Required. Threat statuses to return, such as quarantined, not\_quarantined, or released.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="classification" type="string | null">
  Threat classification to filter by, such as malware or pup.

  Default: `null`.
</ParamField>

<ParamField path="date_range" type="integer | null">
  Return records from the last N days.

  Default: `null`.
</ParamField>

<ParamField path="detection_date_from" type="string | null">
  Earliest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).

  Default: `null`.
</ParamField>

<ParamField path="detection_date_to" type="string | null">
  Latest detection timestamp in UTC (e.g. 2026-01-21T16:08:00.0).

  Default: `null`.
</ParamField>

<ParamField path="device_id" type="string | null">
  Return detections for a single device UUID.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 1000.

  Default: `null`.
</ParamField>

<ParamField path="management_state" type="string | null">
  Management states to filter by.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip.

  Default: `null`.
</ParamField>

<ParamField path="severities" type="string | null">
  Severity levels to filter by.

  Default: `null`.
</ParamField>

<ParamField path="sort_by" type="string | null">
  Field to sort by; prefix with - to reverse the order.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="string | null">
  Tags to filter by.

  Default: `null`.
</ParamField>

<ParamField path="term" type="string | null">
  Search term matched against fields such as device name and file hash.

  Default: `null`.
</ParamField>

## Lock device

Action ID: `tools.iru.lock_device`

Lock a device. For macOS an unlock PIN is generated and returned in the response. On Apple silicon running macOS earlier than 11.5 this deactivates the Mac, and reactivation requires network access and a Secure Token administrator.

Reference: [https://api-docs.iru.com/#f2fc0e99-c758-4eb8-bb3d-0ea72d0c0213](https://api-docs.iru.com/#f2fc0e99-c758-4eb8-bb3d-0ea72d0c0213)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="message" type="string | null">
  Message to display on the locked device.

  Default: `null`.
</ParamField>

<ParamField path="phone_number" type="string | null">
  Phone number to display on the locked device.

  Default: `null`.
</ParamField>

## Query Prism inventory

Action ID: `tools.iru.query_prism`

Query a fleet-wide Prism inventory category.

Reference: [https://api-docs.iru.com/#d538b34f-5343-416e-be53-2ba108c51dfa](https://api-docs.iru.com/#d538b34f-5343-416e-be53-2ba108c51dfa)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="category" type="string" required>
  Prism category, such as activation\_lock, application\_firewall, apps, cellular, certificates, desktop\_and\_screensaver, device\_information, filevault, gatekeeper\_and\_xprotect, installed\_profiles, kernel\_extensions, launch\_agents\_and\_daemons, local\_users, startup\_settings, system\_extensions, or transparency\_database.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="blueprint_ids" type="array[string] | null">
  Blueprint UUIDs to filter by.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Pagination cursor. Iru recommends cursor paging for Prism; pass an empty string to get the first cursor, then loop on the cursor returned by each page.

  Default: `null`.
</ParamField>

<ParamField path="device_families" type="array[string] | null">
  Device families to filter by.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="object | null">
  Provider-native Prism filter object.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Results per page. Maximum 300.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Number of results to skip. Cannot be combined with cursor.

  Default: `null`.
</ParamField>

<ParamField path="sort_by" type="string | null">
  Field to sort by; prefix with - to reverse the order.

  Default: `null`.
</ParamField>

## Send device action

Action ID: `tools.iru.send_device_action`

Send a device action that takes no request body. Lock and erase have dedicated actions because they accept request bodies.

Reference: [https://api-docs.iru.com/#8c0c2c1a-4d57-4a56-80f9-87d0793f0006](https://api-docs.iru.com/#8c0c2c1a-4d57-4a56-80f9-87d0793f0006)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="action" type="string" required>
  Action to send, such as restart, shutdown, blankpush, dailycheckin, updateinventory, reinstallagent, renewmdmprofile, clearpasscode, enablelostmode, disablelostmode, playlostmodesound or updatelocation.
</ParamField>

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

## Update device

Action ID: `tools.iru.update_device`

Update a device's assignment and metadata. There is no separate blueprint-assignment endpoint, so use this action to assign a Blueprint during onboarding.

Reference: [https://api-docs.iru.com/#b70f2ddc-cc1b-4b4f-8eec-e481d8a17927](https://api-docs.iru.com/#b70f2ddc-cc1b-4b4f-8eec-e481d8a17927)

### Secrets

Required secrets:

* `iru`: required values `IRU_API_TOKEN`.

### Input fields

<ParamField path="device_id" type="string" required>
  Device UUID.
</ParamField>

<ParamField path="asset_tag" type="string | null">
  Asset tag to set on the device.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Iru (Kandji) API base URL (e.g. [https://acme.api.kandji.io](https://acme.api.kandji.io)).

  Default: `null`.
</ParamField>

<ParamField path="blueprint_id" type="string | null">
  Blueprint UUID to assign to the device.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  Extra body fields, merged over the named inputs above. Use this to send an explicit null, which is how Iru clears a field — for example an asset\_tag or user key set to null.

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  Tag names to assign to the device. Replaces the current tags; pass an empty list to clear them.

  Default: `null`.
</ParamField>

<ParamField path="user" type="string | null">
  User UUID to assign to the device.

  Default: `null`.
</ParamField>