As part of reporting on Jamf Pro API clients and assigned API roles, I had previously written a script to report on the following information:

•  The current list of the enabled and disabled API clients on a Jamf Pro server.
•  Which API roles are being used by the API clients.

It later occurred to me that a more comprehensive report which includes the permissions assigned to the roles may be wanted, so I’ve now written a separate script which reports on the following:

•  API Role Display Name
•  API Role ID number
•  API privileges assigned to the API Role.
•  Which API Clients are assigned to each API Role and whether the API Client is enabled or disabled.

For more details, please see below the jump.

The script is named Generate_Jamf_Pro_API_Role_Privileges_Report.sh and is available via the link below:

https://github.com/rtrouton/rtrouton_scripts/tree/main/rtrouton_scripts/Casper_Scripts/Generate_Jamf_Pro_API_Role_Privileges_Report

This script connects to the Jamf Pro API on a Jamf Pro server and reports the API Roles, their assigned API privileges and which API clients (if any) are assigned to those API client roles.

Three items are required to use this script:

• The URL of the appropriate Jamf Pro server.
• An API client on the Jamf Pro server with sufficient privileges to read the necessary information from the Jamf Pro API.
• The client secret for the relevant API client on the Jamf Pro server.

If setting up an API client with limited rights, here are the required API role privileges for the API client on the Jamf Pro server:

• Read API Integrations
• Read API Roles

You should see similar output to what’s shown below when using the Generate_Jamf_Pro_API_Role_Privileges_Report.sh script to generate a report:

As part of the script’s run, a report will be generated and you’ll be notified of where it is stored. The report will be in TSV format and appear similar to what’s shown below: