Idemeum public REST APIs have resource-oriented URLs, return JSON-encoded responses, and use standard HTTP response codes, authentication, and verbs.
\nThe Idemeum API uses API keys to authenticate requests. Here is how you can create and manage your apiKey in the idemeum admin portal:
Access your parent idemeum tenant at [your domain].idemeum.com/adminportal
Navigate to Settings → Integrations
Click Add integration and choose Inbound integration
Provide the integration name and save the configuration
\nYou will be presented with your API key
\nIdemeum is a zero-knowledge cloud, meaning we do not see your sensitive information such as LAPS credentials. Everything is encrypted on the client side, and each desktop agent leverages master key to encrypt sensitive information locally before uploading it to idemeum cloud.
\nTherefore, when you call idemeum APIs that perform sensitive operations (i.e. create customer, delegate access to technician, etc.) your API key is used to perform encryption / decryption functions.
\nHere is how we maintain zero-knowledge security while exposing public APIs:
\nAPI key is generated at the parent tenant level and is only known to you
\nWe do not persist the API key in unencrypted form in our cloud
\nAPI key is passed with every request, used for crypto operations and then discarded once the actions are performed
\nRetrieve information about all customers for your parent tenant
\nYou need to pass the apiKey in the header for authenitcation
The response inludes all tenant metadata along with the PowerShell and Bash installation commands for each customer tenant
\nGet information about a customer tenant
\nPass the apiKey in the header for authentication
Specify the customer name in the URL to retrive the information about specific customer. This attribute name is used in the URL for a customer and is returned by the Get All Customers endpoint.
The metadata will include the customer name, display name, URL, number of techs, users, and installation commans for a tenant.
\nGet information about a customer tenant
\nPass the apiKey in the header for authentication
Specify the customer id in the URL to retrive the information about specific customer. This attribute id is used in the URL for a customer and is returned by the Get All Customers endpoint.
The metadata will include the customer name, display name, URL, number of techs, users, and installation commans for a tenant.
\nThis API will create a child customer tenant in your parent MSP tenant
\nPass apiKey in the header for authentication
In the JSON body you need to pass the configuration parameters:
\ncustomerName that will be used as a URL subdomain
customerDisplayName that is used as a friendly display name
enableOtpLoginForQrcodeMode - option to enable online OTP login for your tenant - true or false
mspAccountTypeInDomainJoinedWorkstation - choose how you want JIT login to be performed on domain workstations - with domain accounts, local accounts, or with option to prompt users to choose. Allowed values: LOCAL, DOMAIN, PROMPT_TO_CHOOSE
The response includes the tenant metadata, associated keys, as well as the agent installation commands for a customer tenant
\nDelete the child tenant in you parent MSP tenant
\nPass the apiKey in the header for authentication
Specify the customer tenant name to delete in the URL
This API updates settings for your existing tenant. We will be adding more parameters as we enhance this API
\nPass the apiKey in the header for authentication
In the JSON body you can specify parameters that you want to change:
\nouForDomainAccounts - change the OU where you want to create JIT domain accountsEndpoints to manage customer tenants for your parent MSP tenant.
\n","_postman_id":"1e911087-4af0-4056-b3e9-948118cccb39"},{"name":"Groups","item":[{"name":"Get all groups for parent tenant","id":"4519e453-ee85-4b70-a256-26ebba89f5d0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Accept","value":"application/vnd.dvmi.sdk.group.info.list+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"url":"https://{{tenantUrl}}/api/integrations/groups","description":"Get all groups for your parent MSP tenant
\nPass apiKey in the header for authentication
The response will include all groups and associated types - Built-in, Local group, or External
Endpoints to retrieve and manage idemeum groups.
\n","_postman_id":"20ffa757-3143-4345-9665-582f9561de07"},{"name":"Devices","item":[{"name":"Get all devices for customer by id","id":"809c447e-0410-48eb-9e8c-5a65de1bf9be","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"Accept","value":"application/vnd.dvmi.sdk.customer.devices+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"url":"https://{{tenantUrl}}/api/integrations/customers/{{customerId}}/devices","description":"Retrive all devices and associated metadata for a customer tenant
\nPass apiKey in the header for authentication
You first need to obtain the customerId and then pass it in the URL to retrive the device information. You can call Get all customers or Get customer by name endpoints
The response returns the device list along with the associated metadata for each device
\nEndpoints to retrieve and manage devices that get created when idemeum desktop agent is installed on workstations.
\n","_postman_id":"c9652424-cee9-4329-8441-2e4dbfeb082f"},{"name":"Delegation","item":[{"name":"Delegate user by email","id":"0a967b0b-ed55-425a-9d9a-8b44c117752e","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/vnd.dvmi.sdk.delegate.to.customer+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"body":{"mode":"raw","raw":"{\n \"userEmail\": \"{{user_email}}\",\n \"role\": \"ADMIN\" //ADMIN or ADMIN_READ_ONLY\n}","options":{"raw":{"language":"json"}}},"url":"https://{{tenantUrl}}/api/integrations/customers/{{customerName}}/delegation","description":"This endpoint is used to delegate technician access to customers tenants.
\nPass apiKey for authentication
Pass Content-Type as application/vnd.dvmi.sdk.delegate.to.customer+json
userEmail - email address of the technicain who needs to obtain access
role - specify if full access ADMIN or only read-only access ADMIN_READ_ONLY is required
This endpoint is used to remove user delegation from the customer tenant.
\nPass apiKey for authentication
Pass Content-Type as application/vnd.dvmi.sdk.undelegate.from.customer+json
userEmail - email address of the technicain who needs to obtain accessDelegate access to child tenant with a user group
\nPass the apiKey in the header for authentication
When assigning the group you can also choose what role the users of that group will be assigned READ_ONLY_ADMIN or ADMIN
You can pass multiple groups for delegation in the JSON body
\nRemove the user group from child tenant delegation
\nPass the apiKeyin the header
Specify a list of groups to remove from delegation in the request body
\nDelegate technician access to customer tenants.
\n","_postman_id":"2be9601a-64c0-464c-9054-dba249007be2"},{"name":"Entra JIT accounts","item":[{"name":"Disable Entra JIT account","id":"85253d82-52f5-4726-98e2-d60ab77bc6b3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/vnd.dvmi.entra.app.user.disable+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"body":{"mode":"raw","raw":"{\n \"customerName\": \"{{customerName}}\",\n \"technicianEmailAddress\": \"{{technicianEmailAddress}}\"\n}","options":{"raw":{"language":"json"}}},"url":"https://{{tenantUrl}}/api/integrations/entrajitaccounts","description":"Disable Entra JIT account for a technician
\nPass the apiKey in the header for authentication
Specify the child tenant name and the technician emaill address for the account to be disabled in the JSON body
\nManage Entra ID just-in-time accounts that your technicians request.
\n","_postman_id":"6c51d6cf-13c8-4f05-baa7-e5210b4bd7f7"},{"name":"Rules","item":[{"name":"Get parent tenant rules","id":"07af62c0-b201-4171-aab3-54fda9e3bce6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"},{"key":"Accept","value":"application/vnd.dvmi.sdk.rule.definition+json","type":"text"}],"url":"https://{{tenantUrl}}/api/integrations/msp/rules","description":"This endpoint is used to retrive all rules that are associated with your parent tenant / organization. These are the rules that will be applied across all child organizations.
\napiKey in the header for authenticationThis endpoint is used to create rules for your parent organization / tenant. These rules will apply across all organizations.
\nPass the apiKey for authentication
Regex can be used when matchign applications with file attributes or certificate elements
\nruleName - this is mandatory field to specify the rule name
At least one of these is mandatory to identify the application:
\nfileName - match the application by file name. You can user RegEx in this field.
filePath - match the application by its path. You can use RegEx in this field. You need to excape the \\ with \\\\
fileHashSha256 - match the application by SHA256 hash of the executable
certificateThumbprint - match the application by the thumbprint of publisher certificate
subjectCn - if you want to match the verified publisher by certificate elements you can use CN element
subjectO - O element of the verified publisher certificate
subjectL - L element of the verified publisher certificate
subjectS - S element of the verified publisher certificate
subjectC - C element of the verified publisher certificate
elevationOutcome - ALLOW, DENY, or REQUEST for how you want to handle elevation
executionOutcome - ALLOW or DENY for how you want to handle execution / allowlsiting outcome
applicationFencing - is used to define how you want to handle application interaction rules
applicationInteraction - you can choose what the application can do when interacting with other applications. ALLOW_ALL will allow all interactions and child processes. DENY_ALL will deny all interactions. You can also specify the CUSTOM option and then provide the child rules for what is allowed or denied.This endpoint is used to retrive all rules that are associated with your child tenant / organization.
\nPass the apiKey in the header for authentication
Pass the name to specify the name of the organization in idemeum
This endpoint is used to create rules for your child organization / tenant. Note that when passing the rules to a tenant we will NOT remove the global rules (created at the parent organization level), and we will not remove the rules added from catalog.
\nPass the apiKey for authentication
Regex can be used when matchign applications with file attributes or certificate elements
\nruleName - this is mandatory field to specify the rule name
At least one of these is mandatory to identify the application:
\nfileName - match the application by file name. You can user RegEx in this field.
filePath - match the application by its path. You can use RegEx in this field. You need to excape the \\ with \\\\
fileHashSha256 - match the application by SHA256 hash of the executable
certificateThumbprint - match the application by the thumbprint of publisher certificate
subjectCn - if you want to match the verified publisher by certificate elements you can use CN element
subjectO - O element of the verified publisher certificate
subjectL - L element of the verified publisher certificate
subjectS - S element of the verified publisher certificate
subjectC - C element of the verified publisher certificate
elevationOutcome - ALLOW, DENY, or REQUEST for how you want to handle elevation
executionOutcome - ALLOW or DENY for how you want to handle execution / allowlsiting outcome
applicationFencing - is used to define how you want to handle application interaction rules
applicationInteraction - you can choose what the application can do when interacting with other applications. ALLOW_ALL will allow all interactions and child processes. DENY_ALL will deny all interactions. You can also specify the CUSTOM option and then provide the child rules for what is allowed or denied.These endpoints are used to manage allowlisting and elevation rules for your parent tenant as well as for organizations / tenants that you created in idemeum.
\n","_postman_id":"f0bd35c1-dfc2-4f9c-bc0c-2e0a38994bc9"},{"name":"Elevation","item":[{"name":"Approve elevation request","id":"fb62ce1c-3770-48f2-a4fd-b9fda8a508ce","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/vnd.dvmi.sdk.elevation.request.approval+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"body":{"mode":"raw","raw":"{\n \"idemeumElevationRequestId\": \"{{request_id}}\",\n \"idemeumCustomerName\": \"{{customer_name}}\",\n \"userElevationMode\": \"ADMIN\" // ADMIN or USER can be used depending on elevation type\n}","options":{"raw":{"language":"json"}}},"url":"https://{{tenantUrl}}/api/integrations/elevation/request/approve","description":"This endpoint is used to approve elevation request that is open in idemeum.
\ntenantURL in the request URLPass the apiKey for authentication
Pass Content-Type as application/vnd.dvmi.sdk.elevation.request.approval+json
idemeumRequestId - this is the ID of the elevation request in idemeum (i.e. 253D351cab5f-b41c-478c-b0ca-8bbe25138268)
idemeumCustomerName - the organization / customer name where elevation request is open
userElevationMode - what elevation to perform, ADMIN or USER. ADMIN is used by default if value is omitted.
When creating integrations with ticketing systems (i.e. approving tickets from HaloPSA and others), you can leverage the custom fields to automatically obtain these values when idemeum creates a ticket. Check our integration guides for more information → https://docs.idemeum.com/integrations/
\n","urlObject":{"protocol":"https","path":["api","integrations","elevation","request","approve"],"host":["{{tenantUrl}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"fb62ce1c-3770-48f2-a4fd-b9fda8a508ce"},{"name":"Deny elevation request","id":"7e797082-8a3d-47f2-a39a-73000a23668a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/vnd.dvmi.sdk.elevation.request.approval+json","type":"text"},{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"}],"body":{"mode":"raw","raw":"{\n \"idemeumElevationRequestId\": \"{{request_id}}\",\n \"idemeumCustomerName\": \"{{customer_name}}\"\n}","options":{"raw":{"language":"json"}}},"url":"https://{{tenantUrl}}/api/integrations/elevation/request/deny","description":"This endpoint is used to deny elevation request that is open in idemeum.
\ntenantURL in the request URLPass the apiKey for authentication
Pass Content-Type as application/vnd.dvmi.sdk.elevation.request.approval+json
idemeumRequestId - this is the ID of the elevation request in idemeum (i.e. 253D351cab5f-b41c-478c-b0ca-8bbe25138268)
idemeumCustomerName - the organization / customer name where elevation request is open
When creating integrations with ticketing systems (i.e. approving tickets from HaloPSA and others), you can leverage the custom fields to automatically obtain these values when idemeum creates a ticket. Check our integration guides for more information → https://docs.idemeum.com/integrations/
\n","urlObject":{"protocol":"https","path":["api","integrations","elevation","request","deny"],"host":["{{tenantUrl}}"],"query":[],"variable":[]}},"response":[],"_postman_id":"7e797082-8a3d-47f2-a39a-73000a23668a"}],"id":"0f3bfa6d-bc3f-4639-bf79-8a05f129d5de","description":"This set of endpoints is used to manage elevation requests in idemeum. When users request application elevation, a request is created in idemeum and the notification is sent to admin users, or optionally the ticket is created in the ticketing system.
\n","_postman_id":"0f3bfa6d-bc3f-4639-bf79-8a05f129d5de"},{"name":"Audit","item":[{"name":"Get desktop login events","id":"589f636b-eb73-48db-9135-8a40ad393ba6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"X-Idemeum-Api-Key","value":"{{apiKey}}","type":"text"},{"key":"Accept","value":"application/vnd.dvmi.ecs.events.list+json","type":"text"}],"url":"https://{{tenantUrl}}/api/integrations/audit/events?page=1&size=1&range=last_90d","description":"This endpoint is used to extract desktop login events from idemeum platform.
\ntenantUrl in the request URLPass the apiKey for authentication
Pass Content-Type as application/vnd.dvmi.ecs.events.list+json
page - specify the page that you want to retrieve. If the number of events is more than the count you specify, you will need to retrieve the results by page.
size - specify how many events you want to retrive for the specified range
range - sepcify the range.
You can use the intervals last_1d, last_3d, last_7d, last_30d, last_60d, last_90d
You can use the range in epoch milliseconds
\nYou can use range in ISO8601 format
\nIf you are retrieving the events for an MSP tenant, you can use the parameter to include logs for all customer tenants:
\nincludeCustomerTenantEvents - pass true like so includeCustomerTenantEvents=trueThis endpoint is used to extract desktop login events from idemeum platform.
\ntenantUrl in the request URLPass the apiKey for authentication
Pass Content-Type as application/vnd.dvmi.ecs.events.list+json
page - specify the page that you want to retrieve. If the number of events is more than the count you specify, you will need to retrieve the results by page.
size - specify how many events you want to retrive for the specified range
range - sepcify the range.
You can use the intervals last_1d, last_3d, last_7d, last_30d, last_60d, last_90d
You can use the range in epoch milliseconds
\nYou can use range in ISO8601 format
\nIf you are retrieving the events for an MSP tenant, you can use the parameter to include logs for all customer tenants:
\nincludeCustomerTenantEvents - pass true like so includeCustomerTenantEvents=trueA set of endpoints to extract audit events from idemeum. We follow Elastic Common Scema for returning information about events.
\n","_postman_id":"0f560483-3f76-4528-95d8-34b167f1ddd2"}],"id":"c2ef37bd-ee03-4cef-81cf-2c51cc297965","_postman_id":"c2ef37bd-ee03-4cef-81cf-2c51cc297965","description":""}],"event":[{"listen":"prerequest","script":{"id":"2d9b2f7b-dcbd-46fd-8479-4d17e5d7269d","type":"text/javascript","packages":{},"exec":[""]}},{"listen":"test","script":{"id":"22805fb0-dad5-4ffd-b463-1cd749dcbd6b","type":"text/javascript","packages":{},"exec":[""]}}],"variable":[{"key":"apiKey","value":"{{apiKey}}","type":"string"},{"key":"tenantUrl","value":"{{tenantUrl}}","type":"string"},{"key":"epoch_start_millis","value":"","type":"default"},{"key":"range","value":"","type":"default"},{"key":"epoch_end_millis","value":"","type":"default"},{"key":"start_in_iso8601","value":"","type":"default"},{"key":"end_in_iso8601","value":"","type":"default"}]}