ReferenceDevelopers

Admin Centre API

The Admin Centre API is everything an organisation's admins can do in the Admin Centre: people, groups, roles and licences; sign-in security; single sign-on apps; branding and domains; guests and portal users; the audit log; and each app's admin settings. All of it lives in BRM-API under /api/v1/admin/... and works with an API key belonging to an admin.

Address: https://<your-org>.brambleit.cloud/api
Sign-in: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Address: https://<your-org>.brambleit.cloud/admin
Sign-in: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Endpoints: 297
OpenAPI: admin.json
Guides: How Admin Centre works

Who can call these. Each area checks its own role or permission: a Global Administrator can use all of them; app admin roles (PSA Admin, HR Admin, RMM Admin…) unlock their own app's settings; the audit log needs audit.view. A person without the right role gets 403.

Partners. An MSP acting for a customer (delegated admin, from the Partner portal) can call most of these for that customer. Partnership, support-access and deletion endpoints always refuse delegated calls.

Changes are audited. Every change made here is written to the audit log with who made it and the before/after values.

Resources

Organisation

The organisation itself: its record, name and type (MSP or company), whether Bramble support may access it, and what the signed-in admin is allowed to manage.

Method	Path	Summary
GET	`/v1/admin/isadmin`	Can the caller use the Admin Centre?
GET	`/v1/admin/tenant/info`	Get the organisation
PATCH	`/v1/admin/tenant/support-access`	Allow or stop Bramble support access
PATCH	`/v1/admin/tenant/name`	Rename the organisation
GET	`/v1/admin/tenant/monitoring/summary`	Health summary for the Admin Centre home page
PATCH	`/v1/admin/tenant/org-type`	Set the organisation type

People

Staff accounts: create, edit, turn off and delete people; their username and email aliases, mailbox, groups, roles and licences; reset passwords and two-step sign-in; sign someone out everywhere. A person's username is their email address on one of the organisation's verified domains.

Method	Path	Summary
GET	`/v1/admin/tenant/users`	List people
POST	`/v1/admin/tenant/users/:id/revoke-sessions`	Sign a person out everywhere
GET	`/v1/admin/tenant/subjects/users`	Find people (for pickers)
GET	`/v1/admin/tenant/subjects/groups`	Find groups (for pickers)
POST	`/v1/admin/user/check-email`	Is this address free?
POST	`/v1/admin/user`	Create a person
POST	`/v1/admin/tenant/user`	Get a person
PUT	`/v1/admin/tenant/users/:id/picture`	Set a person's photo
DELETE	`/v1/admin/tenant/users/:id/picture`	Remove a person's photo
PATCH	`/v1/admin/tenant/user`	Change one field on a person
PATCH	`/v1/admin/user/profile`	Update a person's name details
PATCH	`/v1/admin/user/account`	Update a person's account
GET	`/v1/admin/user/addresses`	A person's username and aliases
PATCH	`/v1/admin/user/username`	Change a person's username
POST	`/v1/admin/user/aliases`	Add an email alias
DELETE	`/v1/admin/user/aliases/:id`	Remove an email alias
PATCH	`/v1/admin/user/mailbox`	Change a person's mailbox
PATCH	`/v1/admin/user/groups`	Set a person's groups
PATCH	`/v1/admin/user/roles`	Set a person's roles
PATCH	`/v1/admin/user/licenses`	Set a person's licences
PATCH	`/v1/admin/user/security`	Reset a person's password
POST	`/v1/admin/user/mfa/reset`	Reset a person's two-step sign-in
DELETE	`/v1/admin/user`	Delete a person

Groups

Groups of people. Groups are used to give access (apps, sites, PSA queues, single sign-on apps, security policies) to many people at once.

Method	Path	Summary
GET	`/v1/admin/tenant/groups`	List the tenant's groups with member counts
GET	`/v1/admin/tenant/groups/:id`	Get a group and its members
POST	`/v1/admin/tenant/groups`	Create a group. Requires the GLOBAL_ADMIN role
PATCH	`/v1/admin/tenant/groups/:id`	Rename a group. Requires the GLOBAL_ADMIN role
DELETE	`/v1/admin/tenant/groups/:id`	Delete a group. Requires the GLOBAL_ADMIN role
POST	`/v1/admin/tenant/groups/:id/members`	Add a user to a group
DELETE	`/v1/admin/tenant/groups/:id/members/:userId`	Remove a user from a group

Roles & permissions

Roles bundle permissions. Built-in roles (Global Administrator, RMM Technician, PSA Admin…) can't be changed; organisations can create custom roles from the permission catalogue and give them to people.

Method	Path	Summary
GET	`/v1/admin/tenant/applications`	List the platform-wide application catalog
GET	`/v1/admin/tenant/permissions`	List the full platform permission catalog
GET	`/v1/admin/tenant/roles`	List all roles with their application and assigned-user count
GET	`/v1/admin/tenant/roles/:id`	Get a role with its full permission checklist
GET	`/v1/admin/tenant/roles/:id/members`	List the users in this tenant who hold a role
POST	`/v1/admin/tenant/roles/:id/members`	Give a user in this tenant a role
DELETE	`/v1/admin/tenant/roles/:id/members/:userId`	Take a role away from a user in this tenant
POST	`/v1/admin/tenant/roles`	Create a custom role
PATCH	`/v1/admin/tenant/roles/:id`	Update a custom role's description and permissions
DELETE	`/v1/admin/tenant/roles/:id`	Delete a custom role

Licences

The licence packages the organisation has, how many seats are used, and which licensed apps the organisation actually uses (which decides what shows in the launcher). Assign a licence to a person with PATCH /v1/admin/user/licenses.

Method	Path	Summary
GET	`/v1/admin/tenant/licenses`	List licence packages and seats
GET	`/v1/admin/tenant/apps-in-use`	Which licensed apps are in use
PATCH	`/v1/admin/tenant/apps-in-use/:applicationId`	Mark an app as used or not
POST	`/v1/admin/tenant/license`	Get a licence package

Domains

Email domains. A domain is added, then verified by publishing a DNS TXT record; only verified domains can be used for usernames and mailboxes. Bramble checks verified domains again later and marks them "verification lost" if the record disappears.

Method	Path	Summary
GET	`/v1/admin/tenant/domains`	List the tenant's verified/pending domains
POST	`/v1/admin/tenant/domains/verify`	Check a domain's verification record
POST	`/v1/admin/tenant/domains/add`	Add a domain
POST	`/v1/admin/domains/view`	Get a domain
DELETE	`/v1/admin/tenant/domains`	Remove a domain

Security policies

Conditional access. A policy either requires two-step sign-in or blocks sign-in, for everyone or for chosen people and groups, optionally only from (or except from) named locations — lists of countries and IP ranges. Also the session length (how long people stay signed in).

Method	Path	Summary
PATCH	`/v1/admin/tenant/session-policy`	Set how long people stay signed in
GET	`/v1/admin/tenant/security-policies`	List the tenant's Conditional Access-style security policies
POST	`/v1/admin/tenant/security-policies`	Create a security policy
PATCH	`/v1/admin/tenant/security-policies/:id`	Update a security policy
DELETE	`/v1/admin/tenant/security-policies/:id`	Delete a security policy
POST	`/v1/admin/tenant/security-policies/:id/subjects`	Add an include/exclude subject (user or group) to a security policy
DELETE	`/v1/admin/tenant/security-policies/:id/subjects/:subjectRowId`	Remove a subject entry from a security policy
POST	`/v1/admin/tenant/security-policies/:id/locations`	Add an include/exclude named-location condition to a security policy
DELETE	`/v1/admin/tenant/security-policies/:id/locations/:locationRowId`	Remove a location condition from a security policy
GET	`/v1/admin/tenant/named-locations`	List the tenant's named locations
POST	`/v1/admin/tenant/named-locations`	Create a named location
PATCH	`/v1/admin/tenant/named-locations/:id`	Rename/update a named location
DELETE	`/v1/admin/tenant/named-locations/:id`	Delete a named location
POST	`/v1/admin/tenant/named-locations/:id/entries`	Add a country or CIDR match entry to a named location
DELETE	`/v1/admin/tenant/named-locations/:id/entries/:entryId`	Remove a match entry from a named location

Sign-ins & sessions

Every sign-in attempt (success, failure, interrupted for two-step sign-in) with where it came from, and the sessions currently signed in. Revoke a session to sign that device out.

Method	Path	Summary
GET	`/v1/admin/tenant/sign-ins`	Search the tenant's sign-in logs
GET	`/v1/admin/tenant/sign-ins/facets`	Filter options for the sign-in log report
GET	`/v1/admin/tenant/sign-ins/export`	Export sign-in logs as CSV
GET	`/v1/admin/tenant/sign-ins/:id`	Get a single sign-in, with the activities done in that session
GET	`/v1/admin/tenant/sessions`	List active Bramble Cloud sessions in this tenant
DELETE	`/v1/admin/tenant/sessions/:id`	Revoke (sign out) one session

Audit log

Who changed what, when. audit-events is the detailed trail (each change with its modified properties, before and after) with filters and CSV export; audit-log is the older request log.

Method	Path	Summary
GET	`/v1/admin/tenant/audit-log`	Search/list the tenant's audit log
GET	`/v1/admin/tenant/audit-log/:id`	Get a single audit log entry
GET	`/v1/admin/tenant/audit-events`	Search the tenant's activity audit trail
GET	`/v1/admin/tenant/audit-events/facets`	Filter options for the audit trail report
GET	`/v1/admin/tenant/audit-events/export`	Export the audit trail as CSV
GET	`/v1/admin/tenant/audit-events/:id`	Get a single audit event, with modified properties

Single sign-on apps

"Sign in with Bramble" for other applications (OpenID Connect). Register an app to get its client ID and secret, choose who may use it, and optionally show it in the app launcher. Bramble's own platform apps can be switched on or off for the organisation.

Method	Path	Summary
GET	`/v1/admin/tenant/oidc`	Get OIDC SSO status and the tenant's registered OIDC clients
POST	`/v1/admin/tenant/oidc/enable`	Enable or disable OIDC SSO for the tenant
POST	`/v1/admin/tenant/oidc/clients`	Register a single sign-on app
PATCH	`/v1/admin/tenant/oidc/clients/:id`	Update an OIDC client's settings
POST	`/v1/admin/tenant/oidc/clients/:id/rotate-secret`	Rotate an OIDC client's secret
DELETE	`/v1/admin/tenant/oidc/clients/:id`	Delete an OIDC client
GET	`/v1/admin/tenant/oidc/clients/:id/access`	Get an OIDC client's access-restriction settings and allow-listed subjects
POST	`/v1/admin/tenant/oidc/clients/:id/access/toggle`	Toggle whether an OIDC client's access is restricted to an allow-list
POST	`/v1/admin/tenant/oidc/clients/:id/access`	Add a user or group to an OIDC client's access allow-list
DELETE	`/v1/admin/tenant/oidc/clients/:id/access/:accessId`	Remove a subject from an OIDC client's access allow-list
GET	`/v1/admin/tenant/oidc/platform-apps`	List Bramble's own platform apps
POST	`/v1/admin/tenant/oidc/platform-apps/:clientId/enable`	Opt the tenant into a platform OIDC app
POST	`/v1/admin/tenant/oidc/platform-apps/:clientId/disable`	Opt the tenant out of a platform OIDC app
POST	`/v1/admin/tenant/oidc/clients/:id/icon`	Upload a drawer/rail icon for an OIDC client
DELETE	`/v1/admin/tenant/oidc/clients/:id/icon`	Remove an OIDC client's uploaded icon
GET	`/v1/admin/tenant/oidc/icons/:id`	Serve an uploaded OIDC client icon

Branding & launcher

The organisation's colours, logo, sign-in page background and wording, and custom links added to everyone's app launcher.

Method	Path	Summary
GET	`/v1/admin/tenant/custom-links`	List launcher links
POST	`/v1/admin/tenant/custom-links`	Add a launcher link
PATCH	`/v1/admin/tenant/custom-links/:id`	Change a launcher link
DELETE	`/v1/admin/tenant/custom-links/:id`	Remove a launcher link
GET	`/v1/admin/tenant/branding`	Get the tenant's branding settings
PUT	`/v1/admin/tenant/branding`	Set colours and sign-in wording
POST	`/v1/admin/tenant/branding/logo`	Upload the tenant's branding logo
POST	`/v1/admin/tenant/branding/background`	Upload the tenant's branding background image
DELETE	`/v1/admin/tenant/branding/logo`	Remove the tenant's branding logo
DELETE	`/v1/admin/tenant/branding/background`	Remove the tenant's branding background image
GET	`/v1/admin/tenant/branding/image/:id`	Serve a tenant branding image (logo or background)

Guests & portal users

Guests are people from outside the organisation invited by email (for example to a site or a shared file). Portal users are PSA contacts given a client-portal sign-in.

Method	Path	Summary
POST	`/v1/admin/portal/contacts/:contactId/invite`	Invite a PSA contact as a client-portal user
GET	`/v1/admin/portal/contacts`	List every client-portal login in the tenant
POST	`/v1/admin/portal/contacts/:userId/revoke`	Revoke a client-portal user's access
POST	`/v1/admin/guests/invite`	Invite a guest user by email
GET	`/v1/admin/guests`	List the tenant's guest users
POST	`/v1/admin/guests/:guestId/resend`	Resend a guest's set-password invite link
POST	`/v1/admin/guests/:guestId/revoke`	Revoke a guest's access

Partners

MSP partnerships. A partner (MSP) asks to manage this organisation; the organisation approves it and chooses what the partner may do: devices.read (see devices in the partner's RMM), device_management.manage (manage device policies) and admin.full (delegated admin of the Admin Centre). Either side can end it.

Method	Path	Summary
GET	`/v1/admin/partners`	List partnerships
POST	`/v1/admin/partners/requests`	Ask to manage a customer
POST	`/v1/admin/partners/:id/approve`	Approve a partner
POST	`/v1/admin/partners/:id/decline`	Decline a partner's request
PUT	`/v1/admin/partners/:id/permissions`	Change what a partner may do
POST	`/v1/admin/partners/:id/end`	End a partnership
GET	`/v1/admin/partners/sites`	Your RMM sites and the customers they're linked to
PUT	`/v1/admin/partners/sites/:siteId`	Link an RMM site to a customer

Storage

The organisation's storage pool: how much each app and person uses, per-app limits, and Drive settings.

Method	Path	Summary
GET	`/v1/admin/storage/overview`	The tenant's storage pool, where it comes from, and what each app uses
PUT	`/v1/admin/storage/apps/:app/quota`	Cap how much of the pool one app may use (quota_bytes null removes the cap)
GET	`/v1/admin/storage/users`	Staff users with their storage use across apps and their Drive personal quota
PUT	`/v1/admin/storage/users/:userId/quota`	Set one user's Drive personal quota (quota_bytes null = unlimited; use_default true = follow the tenant default)
GET	`/v1/admin/storage/largest`	The biggest stored files across all apps (or one, with ?app=)
GET	`/v1/admin/storage/history`	Daily storage use per app (?days=, default 90)
GET	`/v1/admin/storage/drive-settings`	Drive rules for this tenant (personal quota, versions kept, bin retention, link sharing, quick shares)
PUT	`/v1/admin/storage/drive-settings`	Update the drive settings

Delete the organisation

Permanently deleting the organisation is a three-step process: request (type the organisation's name), confirm from the link emailed to the admin, then a grace period during which it can be cancelled. After the grace period every app's data is purged. The preview shows what would go.

Method	Path	Summary
GET	`/v1/admin/tenant/delete-preview`	Preview what would be deleted if this tenant were purged
POST	`/v1/admin/tenant/delete-request`	Request permanent deletion of this tenant
GET	`/v1/admin/tenant/delete-confirm`	Confirm a pending tenant deletion via emailed token
POST	`/v1/admin/tenant/delete-cancel`	Cancel a pending tenant deletion request
GET	`/v1/admin/tenant/delete-status`	Check for an active deletion request on this tenant

App settings: PSA

PSA administration: queues and their mailboxes, statuses, ticket types, categories, SLA policies, workflows, email templates, procedures and approvals.

Method	Path	Summary
GET	`/v1/admin/psa/templates`	List PSA email templates
POST	`/v1/admin/psa/templates`	Create a PSA email template
POST	`/v1/admin/psa/templates/:id`	Update a PSA email template
POST	`/v1/admin/psa/templates/:id/delete`	Delete a PSA email template
GET	`/v1/admin/psa/statuses`	List PSA statuses with their behaviours and ticket counts
POST	`/v1/admin/psa/statuses`	Add a PSA status. Requires the GLOBAL_ADMIN role
POST	`/v1/admin/psa/statuses/:id`	Update a PSA status. Requires the GLOBAL_ADMIN role
POST	`/v1/admin/psa/statuses/:id/delete`	Delete a PSA status. Requires the GLOBAL_ADMIN role
GET	`/v1/admin/psa/workflows`	List PSA workflow rules
POST	`/v1/admin/psa/workflows`	Create a PSA workflow rule
POST	`/v1/admin/psa/workflows/:id`	Update a PSA workflow rule
POST	`/v1/admin/psa/workflows/:id/delete`	Delete a PSA workflow rule and its run log
POST	`/v1/admin/psa/workflow-test`	Dry-run a PSA workflow rule against a ticket
GET	`/v1/admin/psa/workflow-runs`	Recent PSA workflow runs (last 30 days)
GET	`/v1/admin/psa/sla`	PSA business hours and SLA policies
POST	`/v1/admin/psa/sla/hours`	Add PSA business hours
POST	`/v1/admin/psa/sla/hours/:id`	Update PSA business hours
POST	`/v1/admin/psa/sla/hours/:id/delete`	Delete PSA business hours
POST	`/v1/admin/psa/sla/policies`	Add a PSA SLA policy
POST	`/v1/admin/psa/sla/policies/:id`	Update a PSA SLA policy
POST	`/v1/admin/psa/sla/policies/:id/delete`	Delete a PSA SLA policy
GET	`/v1/admin/psa/types`	List PSA ticket types
POST	`/v1/admin/psa/types`	Add a PSA ticket type
POST	`/v1/admin/psa/types/:id`	Rename, turn on/off or reorder a PSA ticket type
POST	`/v1/admin/psa/types/:id/delete`	Delete a PSA ticket type

App settings: Forms

Every form in the organisation, with admin overrides for owners and collaborators.

Method	Path	Summary
GET	`/v1/admin/forms`	List every form
GET	`/v1/admin/forms/:id`	Get a form with its questions
GET	`/v1/admin/forms/:id/collaborators`	List a form's collaborators
GET	`/v1/admin/forms/:id/collaborators/available`	People who could be added as collaborators
POST	`/v1/admin/forms/:id/collaborators`	Add a collaborator to a form
DELETE	`/v1/admin/forms/:id/collaborators/:collabId`	Remove a collaborator from a form
PATCH	`/v1/admin/forms/:id/owner`	Give a form a new owner

App settings: Sites

Every site in the organisation, its members, and who may create sites.

Method	Path	Summary
GET	`/v1/admin/sites/settings`	Who may create sites in this tenant
PUT	`/v1/admin/sites/settings`	Update the settings
GET	`/v1/admin/sites`	Every site in the tenant with its owners, members, pages and library size
POST	`/v1/admin/sites/:id/owners`	Make a tenant user an owner of a site (user_id; defaults to the calling admin)
GET	`/v1/admin/sites/:id/members`	List members of a site
PUT	`/v1/admin/sites/:id/members`	Update the members of a site
DELETE	`/v1/admin/sites/:id/members/:type/:pid`	Delete a member
DELETE	`/v1/admin/sites/:id`	Delete a site (its libraries' files are purged by Drive after the bin period)

App settings: Mail

Mail domains (set up and check DNS), every mailbox, shared mailboxes and their members (full access, send as, send on behalf), and app passwords for accounts that never sign in interactively (a scanner, Paper's intake).

Method	Path	Summary
GET	`/v1/admin/mail/mailboxes`	List every mailbox
GET	`/v1/admin/mail/domains`	List mail domains and their DNS
POST	`/v1/admin/mail/domains/:domain/setup`	Set up mail for a domain
POST	`/v1/admin/mail/domains/:domain/check`	Check a mail domain's DNS now
GET	`/v1/admin/mail/shared`	List shared mailboxes
POST	`/v1/admin/mail/shared`	Create a shared mailbox
POST	`/v1/admin/mail/shared/existing`	Turn an existing mailbox into a shared one
PATCH	`/v1/admin/mail/shared/:id`	Change a shared mailbox
DELETE	`/v1/admin/mail/shared/:id`	Stop sharing a mailbox
DELETE	`/v1/admin/mail/mailboxes/:domain/:boxId`	Deletes a shared or unassigned mailbox and all its mail from the server
GET	`/v1/admin/mail/users/:userId/mailbox`	A person's mailbox, so "Remove user" can ask what happens to it
GET	`/v1/admin/mail/users/:userId/app-passwords`	List a person's admin-made app passwords
POST	`/v1/admin/mail/users/:userId/app-passwords`	Make an app password for a person
DELETE	`/v1/admin/mail/users/:userId/app-passwords/:id`	Revoke an app password
PUT	`/v1/admin/mail/shared/:id/members/:userId`	Set a person's access to a shared mailbox

App settings: HR

HR policy (leave year, allowances, carry-over, half days), leave types, company closures, checklist templates, who is in HR, removed people, and each person's HR record including dated allowance changes.

Method	Path	Summary
GET	`/v1/admin/hr/overview`	HR policy, leave types, closures, templates and licence counts in one call
PUT	`/v1/admin/hr/settings`	Update the leave policy (leave year start, allowance, bank holidays, carry-over, half days, privacy)
PUT	`/v1/admin/hr/people-scope`	Who gets an HR record automatically — every staff account (scope all) or members of chosen groups (scope groups, groups = ids)
POST	`/v1/admin/hr/removed/:employeeId/restore`	Restore a removed
POST	`/v1/admin/hr/types`	Add a leave type
PUT	`/v1/admin/hr/types/:id`	Change a leave type, or archive / restore it ({ archived })
POST	`/v1/admin/hr/closures`	Add company closure days (a date range)
PUT	`/v1/admin/hr/closures/:id`	Switch one closure day between "extra day off" and "comes out of the allowance"
DELETE	`/v1/admin/hr/closures/:id`	Delete a closure
POST	`/v1/admin/hr/templates`	Add an onboarding or offboarding checklist template with its tasks
PUT	`/v1/admin/hr/templates/:id`	Replace a template's name, description and tasks (checklists already started keep their own copy)
DELETE	`/v1/admin/hr/templates/:id`	Delete a template
GET	`/v1/admin/hr/people/:userId`	Get a people
PUT	`/v1/admin/hr/people/:userId`	Update a people
POST	`/v1/admin/hr/people/:userId/allowance-changes`	Change a user's holiday allowance from a leave year on (kind set = days a year, extra = days on top of the policy)
DELETE	`/v1/admin/hr/people/:userId/allowance-changes/:id`	Delete an allowance change

App settings: SimpleBooks

Companies, who can access each company and with what role, and the receipts email address.

Method	Path	Summary
GET	`/v1/admin/simplebooks/companies`	Every SimpleBooks company in the tenant, with modules, access and receipt counts
POST	`/v1/admin/simplebooks/companies`	Create a company
PUT	`/v1/admin/simplebooks/companies/:id`	Rename, change business type, archive/unarchive, or switch modules on/off
GET	`/v1/admin/simplebooks/principals`	Tenant users (with whether each has a SimpleBooks licence) and groups, for the access picker
GET	`/v1/admin/simplebooks/companies/:id/access`	Who can open this company, and with which role
POST	`/v1/admin/simplebooks/companies/:id/access`	Access a company
PUT	`/v1/admin/simplebooks/companies/:id/access/:accessId`	Update an access
DELETE	`/v1/admin/simplebooks/companies/:id/access/:accessId`	Delete an access
GET	`/v1/admin/simplebooks/email`	The SMTP account SimpleBooks emails invoices through (password never returned)
PUT	`/v1/admin/simplebooks/email`	Update the email
POST	`/v1/admin/simplebooks/email/test`	Send a test email to the signed-in admin through the saved SMTP account

App settings: Warden

Warden administration: overview, network device integrations (UniFi), SIEM (Logs & auditing) collection, general settings, ticket and notification rules, and connectors.

Method	Path	Summary
GET	`/v1/admin/warden/overview`	Warden configuration status + headline numbers for the admin overview
GET	`/v1/admin/warden/network`	Detection + PSA integration settings, and the site -> PSA customer map
PUT	`/v1/admin/warden/network`	Update the network
GET	`/v1/admin/warden/siem`	Get the SIEM
PUT	`/v1/admin/warden/siem`	Update the SIEM
GET	`/v1/admin/warden/settings`	Get the settings
PUT	`/v1/admin/warden/settings`	Update the settings
GET	`/v1/admin/warden/lookups`	RMM sites and PSA queues/customers for the settings dropdowns
GET	`/v1/admin/warden/ticket-rules`	List ticket rules
POST	`/v1/admin/warden/ticket-rules`	Create a ticket rule
PUT	`/v1/admin/warden/ticket-rules/:id`	Update a ticket rule
DELETE	`/v1/admin/warden/ticket-rules/:id`	Delete a ticket rule
GET	`/v1/admin/warden/notify-channels`	The tenant's named notification channels Warden can deliver through (set up in Admin → RMM → Notification channels)
GET	`/v1/admin/warden/notify-rules`	Warden notification rules, with each rule's last delivery
POST	`/v1/admin/warden/notify-rules`	Create a notify rule
PUT	`/v1/admin/warden/notify-rules/:id`	Update a notification rule
DELETE	`/v1/admin/warden/notify-rules/:id`	Delete a notify rule
POST	`/v1/admin/warden/notify-rules/:id/test`	Queue a test message for a rule (Warden sends it within ~15s; poll notify-rules for the result)
GET	`/v1/admin/warden/connectors`	List connectors
POST	`/v1/admin/warden/connectors`	Create a connector
PUT	`/v1/admin/warden/connectors/:id`	Update a connector
POST	`/v1/admin/warden/connectors/:id/reset-pin`	After a controller is replaced or gets a new certificate
DELETE	`/v1/admin/warden/connectors/:id`	Delete a connector

RMM: checks & alerts

Checks watch devices and raise alerts: CPU, memory and disk, stopped services, offline devices, containers, Proxmox and backup health, HTTP/TCP/ping, network devices and interfaces, database and device backups. Each check has a severity, the devices it applies to (assignments), and actions to take when it fires (notify a channel).

Method	Path	Summary
GET	`/v1/admin/rmm/checks`	List checks
GET	`/v1/admin/rmm/checks/:id`	Get a check with its actions and assignments
POST	`/v1/admin/rmm/checks`	Create a check
PUT	`/v1/admin/rmm/checks/:id`	Update a check
POST	`/v1/admin/rmm/checks/:id/toggle`	Turn a check on or off
DELETE	`/v1/admin/rmm/checks/:id`	Delete a check
GET	`/v1/admin/rmm/alerts/stats`	Alert statistics
GET	`/v1/admin/rmm/alerts`	List alerts
POST	`/v1/admin/rmm/alerts/:id/resolve`	Resolve an alert
GET	`/v1/admin/rmm/alerts/active`	List active alerts

RMM: scripts

The script library and its categories. Scripts run on devices directly or as steps of a task.

Method	Path	Summary
GET	`/v1/admin/rmm/scripts`	List RMM scripts available to the tenant
GET	`/v1/admin/rmm/scripts/:id`	Get one RMM script's full record, including its body
POST	`/v1/admin/rmm/scripts`	Create an RMM script
PUT	`/v1/admin/rmm/scripts/:id`	Update an RMM script
DELETE	`/v1/admin/rmm/scripts/:id`	Delete an RMM script
GET	`/v1/admin/rmm/script-categories`	List the tenant's RMM script folders
POST	`/v1/admin/rmm/script-categories`	Create an RMM script folder
PUT	`/v1/admin/rmm/script-categories/:id`	Rename or re-parent an RMM script folder
DELETE	`/v1/admin/rmm/script-categories/:id`	Delete an RMM script folder and its subtree

RMM: scheduled tasks

Tasks run one or more scripts on a schedule (every N hours, daily, weekly, a day of the month, or the Nth weekday of the month) on the devices they're assigned to. Each run records a result per device and per step.

Method	Path	Summary
GET	`/v1/admin/rmm/tasks`	List scheduled tasks
GET	`/v1/admin/rmm/tasks/:id`	Get a task with its steps and assignments
POST	`/v1/admin/rmm/tasks`	Create a scheduled task
PUT	`/v1/admin/rmm/tasks/:id`	Update a scheduled task
POST	`/v1/admin/rmm/tasks/:id/toggle`	Turn a task on or off
DELETE	`/v1/admin/rmm/tasks/:id`	Delete a task
POST	`/v1/admin/rmm/tasks/:id/run`	Run a task now
GET	`/v1/admin/rmm/tasks/:id/runs`	A task's past runs
GET	`/v1/admin/rmm/runs`	Recent task runs
GET	`/v1/admin/rmm/runs/:runId/results`	Per-device rollup plus the full per-step timeline (client groups by device_id and orders by sort_order to render a mini step-by-step timeline per device)
POST	`/v1/admin/rmm/runs/:runId/cancel`	Cancel a running task

RMM: sites, groups & enrolment

Sites and groups organise devices. Enrolment keys add devices: each key puts new devices into a site and group. Anyone holding a key can add a device, so keep keys private and delete unused ones.

Method	Path	Summary
GET	`/v1/admin/rmm/overview`	Get device/site/group/script counts for the tenant's RMM instance
GET	`/v1/admin/rmm/sites`	List the tenant's RMM sites with group and device counts
GET	`/v1/admin/rmm/sites/:id/groups`	Get an RMM site with its groups and per-group device counts
GET	`/v1/admin/rmm/groups`	List all RMM groups across every site in the tenant, with device counts
POST	`/v1/admin/rmm/sites`	Create an RMM site. Requires the GLOBAL_ADMIN role
PUT	`/v1/admin/rmm/sites/:id`	Update an RMM site. Requires the GLOBAL_ADMIN role
DELETE	`/v1/admin/rmm/sites/:id`	Delete an RMM site. Requires the GLOBAL_ADMIN role
POST	`/v1/admin/rmm/groups`	Create an RMM device group within a site
PUT	`/v1/admin/rmm/groups/:id`	Update an RMM device group
DELETE	`/v1/admin/rmm/groups/:id`	Delete an RMM device group
GET	`/v1/admin/rmm/enrollment-keys`	List RMM device enrollment keys
POST	`/v1/admin/rmm/enrollment-keys`	Create an RMM device enrollment key
PUT	`/v1/admin/rmm/enrollment-keys/:id`	Rename an enrollment key
DELETE	`/v1/admin/rmm/enrollment-keys/:id`	Revoke an enrollment key

RMM: device management

Device management (MDM) for Linux devices: configuration profiles and baselines, and which devices, sites or groups they apply to. MSP technicians can manage a customer's policies with ?tenant=<id> when the partnership allows it.

Method	Path	Summary
GET	`/v1/admin/rmm/${base}/sites`	This organisation's own RMM sites and who manages each one's devices (RMM2's site picker): the linked customer while its partnership lets us manage its devic…
GET	`/v1/admin/rmm/${base}/baselines`	List baselines
POST	`/v1/admin/rmm/${base}/baselines`	Create a baseline
PUT	`/v1/admin/rmm/${base}/baselines/:id`	Update a baseline
DELETE	`/v1/admin/rmm/${base}/baselines/:id`	Delete a baseline
PUT	`/v1/admin/rmm/${base}/baselines/:id/targets`	Which organisations the baseline is deployed to (replaces the list)

RMM: agent updates

Automatic agent updates, how long RMM history is kept (utilisation, commands, logs), and hypervisor summaries.

Method	Path	Summary
GET	`/v1/admin/rmm/hypervisor-scope-summary`	Hypervisors in a site or group
GET	`/v1/admin/rmm/agent-updates`	Agent update policy and devices behind
PUT	`/v1/admin/rmm/agent-updates`	Turn automatic agent updates on or off
GET	`/v1/admin/rmm/history`	History retention and usage
PUT	`/v1/admin/rmm/history`	Set how long RMM history is kept

Web pages

These return pages for the browser rather than data.

GET /
GET /${view}
GET /rmm/:tab?
GET /kb/:tab?
GET /psa/:tab?
GET /warden/:tab?
GET /simplebooks/:tab?
GET /storage/:tab?
GET /sites/:tab?
GET /forms/:tab?
GET /hr/:tab?
GET /atlas/:tab?
GET /mail/:tab?
GET /project/:tab?