# Connect Jamf Pro

Canonical URL: https://docs.fuse.init.inc/integrations/jamf-pro/setup

Create a Jamf Pro API client with an API role and submit HTTPS instance credentials to Init.



## Before you start [#before-you-start]

Jamf Pro uses **customer client credentials** (`oauth2_client_credentials` + `customer_credentials`). There is no Init platform OAuth app for this provider.

**Connection admin/user** creates a Jamf Pro API role and API client, generates a client secret, and submits the instance URL plus client credentials through Init Connect.

You need:

* A Jamf Pro administrator who can create API roles and API clients.
* A Jamf Cloud instance hostname under `*.jamfcloud.com`.
* Access to Init Connect for the tenant that will own the connection.

## Configure the provider [#configure-the-provider]

### Create an API role and API client (**Connection admin/user**) [#create-an-api-role-and-api-client-connection-adminuser]

1. In Jamf Pro, open **Settings → API roles and clients** (labels vary slightly by Jamf Pro version).
2. Create an **API role** with only the privileges needed for the Init actions you will run (computers, mobile devices, packages, patch, conditional access as applicable). Avoid FileVault recovery-key and other unused admin privileges.
3. Create an **API client** and assign that API role (or roles).
4. Generate a **client secret**. Copy it once; Jamf shows the secret only at creation time.
5. Note the **client ID** and the HTTPS instance origin (for example `https://example.jamfcloud.com` with no path).

There is no one-time Init platform Jamf registration.

## Connect to Init [#connect-to-init]

**Connection admin/user** starts a Jamf Pro Connect session and submits only these contract fields:

| Field           | Required | Notes                                                                           |
| --------------- | -------- | ------------------------------------------------------------------------------- |
| `instance_url`  | Yes      | HTTPS origin for the Jamf Cloud instance (`*.jamfcloud.com`). No path required. |
| `client_id`     | Yes      | API client ID from Jamf Pro.                                                    |
| `client_secret` | Yes      | Secret generated for that API client.                                           |

Use inert placeholders in docs only, such as `example-token-not-valid`. Never embed a real client secret.

Init exchanges the client ID and secret at `{instance_url}/api/v1/oauth/token` using the client-credentials grant, then probes API compatibility for the connection.

## Permissions [#permissions]

API role privileges control which Jamf Classic / Jamf Pro API endpoints the client can call. Match privileges to the generated action requirements; do not grant unused admin privileges.

If you later expand Init actions, update the API role in Jamf and reconnect so a fresh token is minted under the new privileges.

## Verify the connection [#verify-the-connection]

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing computers or mobile devices.
3. Success looks like Jamf returning inventory data without `401` token errors or privilege denials.

## Rotate or revoke access [#rotate-or-revoke-access]

1. Generate a new client secret for the API client in Jamf Pro (or create a replacement client).
2. Reconnect in Init with the same `instance_url` / `client_id` (or the new client ID) and the new `client_secret`.
3. Invalidate the previous secret or disable the old API client after cutover.

If a secret is exposed, rotate or disable the API client immediately in Jamf, then reconnect.

## Troubleshooting [#troubleshooting]

| Symptom                          | What to check                                                              |
| -------------------------------- | -------------------------------------------------------------------------- |
| Connect rejects `instance_url`   | Must be HTTPS and a Jamf Cloud host under `*.jamfcloud.com`.               |
| `401` on token exchange          | Client ID/secret mismatch, secret rotated, or API client disabled.         |
| Privilege / authorization errors | API role missing privileges for the action; update the role and reconnect. |
| Wrong instance                   | Confirm the URL matches the Jamf Cloud tenant you intend to connect.       |
| Connect rejects the payload      | Submit only `instance_url`, `client_id`, and `client_secret`.              |