Webhooks

Webhooks allow you to subscribe to specific events on a Jamf Pro instance. When an event occurs, an HTTP POST payload is sent to a specified URL.

Each webhook response contains two objects: event and webhook. The structure of the webhook object returns the same data format for all webhook events. Starting in Jamf Pro 10.12 the eventTimestamp key was added to the webhook object.

Written inJSON

"webhook": {
    "eventTimestamp": 1553550275590,
    "id": 1,
    "name": "Webhook Display Name",
    "webhookEvent": "WebhookEventName"
}

The webhookEvent key value may differ between the various webhook events, but each unique event will return the same data format.

Below is a list of the supported webhook events, descriptions of how the events are triggered and samples of the data structures they POST.


The ComputerAdded, ComputerCheckin, ComputerInventoryCompleted, ComputerPolicyFinished and ComputerPushCapabilityChanged events return data in the format depicted below, with their respective values for the webhookEvent attribute.

Written inJSON

{
    "event": {
        "alternateMacAddress": "72:00:01:DD:A0:B9",
        "building": "Block D",
        "department": "Information Technology",
        "deviceName": "John's MacBook Pro",
        "emailAddress": "john.smith@company.com",
        "jssID": 13,
        "macAddress": "60:03:08:A3:64:9D",
        "model": "13-inch Retina MacBook Pro (Late 2013)",
        "osBuild": "16G29",
        "osVersion": "10.12.6",
        "phone": "555-472-9829",
        "position": "Desktop Services Specialist",
        "realName": "John Smith",
        "room": "487",
        "serialNumber": "C02M23PJFH50",
        "udid": "EBBFF74D-C6B7-5599-93A9-19E8BDDEFE32",
        "userDirectoryID": "-1",
        "username": "john.smith"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "ComputerPushCapabilityChanged"
    }
}
ComputerAdded
This event is triggered when a new computer is enrolled into Jamf Pro. This event will not trigger if a computer record already exists within inventory for a device that is re-enrolled. For more information on the various computer enrollment methods, see the Administrator's Guide.
ComputerCheckIn
This event is triggered when a managed computer reaches out to the Jamf Pro server, to check for tasks. The following device check-in types will trigger the webhook event:
  • Startup
  • Login
  • Logout
  • Network State Change
  • Enrollment Complete
  • Recurring Check-in
Starting in Jamf Pro 10.12, the response body was modified to include additional information about the check-in event that triggered the webhook. Information about the user that was logged into the device when the check-in occurred has also been added as part of the event object via the username key.

Written inJSON

{
    "event": {
        "computer": {
            "alternateMacAddress": "72:00:01:DD:A0:B9",
            "building": "Block D",
            "department": "Information Technology",
            "deviceName": "John's MacBook Pro",
            "emailAddress": "john.smith@company.com",
            "jssID": 13,
            "macAddress": "60:03:08:A3:64:9D",
            "model": "13-inch Retina MacBook Pro (Late 2013)",
            "osBuild": "16G29",
            "osVersion": "10.12.6",
            "phone": "555-472-9829",
            "position": "Desktop Services Specialist",
            "realName": "John Smith",
            "room": "487",
            "serialNumber": "C02M23PJFH50",
            "udid": "EBBFF74D-C6B7-5599-93A9-19E8BDDEFE32",
            "userDirectoryID": "-1",
            "username": "john.smith"
        },
        "trigger": "CLIENT_CHECKIN",
        "username": "John Smith"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "ComputerCheckIn"
    }
}
ComputerInventoryCompleted
This event is triggered when a managed computer submits inventory. For more information on inventory collection, see the Administrator's Guide.
ComputerPolicyFinished
This event is triggered when a managed computer executes a policy. Both failed and successfully executed policies will trigger this event. For more information on policies, see the Administrator's Guide. In a future version of Jamf Pro, the response body will be modified to the following, which includes information about the policy that completed:

Written inJSON

{
    "event": {
        "computer": {
            "alternateMacAddress": "72:00:01:DD:A0:B9",
            "building": "Block D",
            "department": "Information Technology",
            "deviceName": "John's MacBook Pro",
            "emailAddress": "john.smith@company.com",
            "jssID": 6486,
            "macAddress": "60:03:08:A3:64:9D",
            "model": "MacBook Pro (13-inch, 2018)",
            "osBuild": "18D109",
            "osVersion": "10.14.3",
            "phone": "555-472-9829",
            "position": "Desktop Services Specialist",
            "realName": "John Smith",
            "room": "487",
            "serialNumber": "C02M23PJFH50",
            "udid": "EBBFF74D-C6B7-5599-93A9-19E8BDDEFE32",
            "userDirectoryID": "-1",
            "username": "john.smith"
        },
        "policyId": 8,
        "successful": true
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 1,
        "name": "Webhook Documentation",
        "webhookEvent": "ComputerPolicyFinished"
    }
}
ComputerPushCapabilityChanged
Push capability refers to the MDM Capability inventory reporting field for computers. This status determines whether the device has fulfilled the necessary requirements to receive push notifications. This webhook event is triggered when a device’s capacity for receiving push notifications changes.

ComputerPatchPolicyCompleted
This event is triggered when a Computer Patch Policy is completed. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "computer": {
            "alternateMacAddress": "72:00:01:DD:A0:B9",
            "building": "Block D",
            "department": "Information Technology",
            "deviceName": "John's MacBook Pro",
            "emailAddress": "john.smith@company.com",
            "jssID": 13,
            "macAddress": "60:03:08:A3:64:9D",
            "model": "13-inch Retina MacBook Pro (Late 2013)",
            "osBuild": "16G29",
            "osVersion": "10.13.4",
            "phone": "555-472-9829",
            "position": "Desktop Services Specialist",
            "realName": "John Smith",
            "room": "487",
            "serialNumber": "C02M23PJFH50",
            "udid": "EBBFF74D-C6B7-5599-93A9-19E8BDDEFE32",
            "userDirectoryID": "-1",
            "username": "john.smith"
        },
        "deployedVersion": "66.0.3359.117",
        "eventActions": {
            "action": [
                "Executing Patch Policy Google Chrome",
                "Mounting MasterDP",
                "Copying GoogleChrome.dmg...",
                "Installing GoogleChrome.dmg...",
                "Mounting GoogleChrome.dmg...",
                "Mount successful",
                "Installing package contents...",
                "Successfully installed package contents",
                "Unmounting GoogleChrome.dmg...",
                "Unmount successful"
            ]
        },
        "patchPolicyId": 4,
        "patchPolicyName": "Chrome Test",
        "softwareTitleId": 2,
        "successful": true
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 5,
        "name": "Webhook Documentation",
        "webhookEvent": "ComputerPatchPolicyCompleted"
    }
}

DeviceAddedToDEP
Beginning with Jamf Pro 10.12, this event is triggered when Jamf Pro receives information about a new device that was assigned to a Device Enrollment Program instance. The assetTag key is provided by Apple's Device Enrollment service and should not be confused with the Asset Tag field within the inventory record of a device in Jamf Pro.

Written inJSON

{
    "event": {
        "assetTag": "1664194",
        "description": "Mac Pro",
        "deviceAssignedDate": 1552478234000,
        "deviceEnrollmentProgramInstanceId": 1,
        "model": "Mac Pro",
        "serialNumber": "92D8014694C4BE96B3"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 1,
        "name": "Webhook Documentation",
        "webhookEvent": "DeviceAddedToDEP"
    }
}

The JSSShutdown and JSSStartup events return data in the format depicted below, with their respective values for the webhookEvent attribute.

Written inJSON

{
    "event": {
        "hostAddress": "172.31.16.70",
        "institution": "Company Name",
        "isClusterMaster": false,
        "jssUrl": "https://company.jamfcloud.com/",
        "webApplicationPath": "/usr/local/jss/tomcat/webapps/ROOT"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "JSSShutdown"
    }
}
JSSShutdown
This event is triggered when the Tomcat service hosting Jamf Pro is shutdown or when the individual instance of Jamf Pro is stopped.
JSSStartup
This event is triggered when the Tomcat service hosting Jamf Pro is started or when the individual instance of Jamf Pro is started.

The MobileDeviceCheckIn, MobileDeviceCommandCompleted, MobileDeviceEnrolled, MobileDevicePushSent and MobileDeviceUnenrolled events return data in the format depicted below, with their respective values for the webhookEvent attribute.

Written inJSON

{
    "event": {
        "bluetoothMacAddress": "C0:F2:FB:37:04:2B",
        "deviceName": "iPad",
        "icciID": "",
        "imei": "",
        "jssID": 2,
        "model": "iPad4,7",
        "modelDisplay": "iPad mini 3 (Wi-Fi)",
        "osBuild": "14D27",
        "osVersion": "10.2.1",
        "product": null,
        "room": "221",
        "serialNumber": "DLXN69VAG5X8",
        "udid": "270aae10800b6e61a2ee2bbc285eb967050b5994",
        "userDirectoryID": "-1",
        "username": "John Smith",
        "version": "10.2.1",
        "wifiMacAddress": "C0:F2:FB:37:04:1F"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "MobileDeviceCommandCompleted"
    }
}

MobileDeviceCheckIn
This event is triggered when a managed mobile device submits inventory. For more information on inventory collection, see the Administrator's Guide.
MobileDeviceCommandCompleted
This event is triggered when Jamf Pro receives acknowledgement of a completed command for a mobile device. This event will trigger for both successfully completed and failed commands. For more information on remote commands, see the Administrator's Guide.
MobileDeviceEnrolled
This event is triggered when a mobile device is enrolled or re-enrolled into Jamf Pro. For more information on mobile device enrollment, see the Administrator's Guide.
MobileDevicePushSent
This event is triggered when Jamf Pro issues a push command to a mobile device. Although similar to MobileDeviceCommandCompleted, this event triggers when Jamf Pro sends the command, not after the command has been completed.
MobileDeviceUnenrolled
This event is triggered when the MDM Profile is manually removed from an enrolled device and when the Unmanage Device remote command is sent from Jamf Pro.

PatchSoftwareTitleUpdated
This event is triggered when Jamf Pro receives an update to a patch title it is subscribed to. For more information on patch software titles, see the Administrator's Guide. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "jssID": 1,
        "lastUpdate": 1506031211000,
        "latestVersion": "61.0.3163.100",
        "name": "Google Chrome",
        "reportUrl": "https://company.jamfcloud.com//view/patch/1/report"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "PatchSoftwareTitleUpdated"
    }
}

PushSent
This event is triggered when Jamf Pro sends a remote command to either a computer or mobile device. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "jssid": 13,
        "type": "PushSent"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "PushSent"
    }
}

RestAPIOperation
This event is triggered whenever any authorized HTTP request is made to a supported resource for the Classic API. Unauthorized requests, failed requests and non-existent resources will not trigger this event. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "authorizedUsername": "administrator",
        "objectID": 34,
        "objectName": "Self Service Mobile",
        "objectTypeName": "Mobile Device Application",
        "operationSuccessful": true,
        "restAPIOperationType": "GET"
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 7,
        "name": "Webhook Documentation",
        "webhookEvent": "RestAPIOperation"
    }
}

SmartGroupComputerMembershipChange
This event is triggered when a managed computer joins or leaves the membership of a smart computer group. Starting in Jamf Pro 10.5 you can select a specific Smart Computer Group to trigger the webhook. For more information on Smart Computer Groups, see the Administrator's Guide. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "computer": false,
        "groupAddedDevices": [],
        "groupAddedDevicesIds":
        [1,2,3,4,5],
        "groupRemovedDevices": [],
        "groupRemovedDevicesIds":
        [6,7,8,9,10],
        "jssid": 8,
        "name": "Smart Group Name",
        "smartGroup": true
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 1,
        "name": "Webhook Documentation",
        "webhookEvent": "SmartGroupMobileDeviceMembershipChange"
    }
}

SmartGroupMobileDeviceMembershipChange
This event is triggered when a managed mobile device joins or leaves the membership of smart mobile device group. Starting in Jamf Pro 10.4 you can select a specific Smart Mobile Device Group to trigger the webhook. Starting in Jamf Pro 10.6 you can choose to return additional inventory fields about the devices affected by a Smart Group Membership Change. These fields will be returned within a groupAddedDevices or groupRemovedDevices array. This functionality must be configured via the Classic API. For more information see the /webhooks section of the Classic API documentation. For more information on Smart Device Groups, see the Administrator's Guide. An example of the data format can be seen below.

Written inJSON

{
    "event": {
        "computer": false,
        "groupAddedDevices": [],
        "groupAddedDevicesIds":
        [1,2,3,4,5],
        "groupRemovedDevices": [],
        "groupRemovedDevicesIds":
        [6,7,8,9,10],
        "jssid": 8,
        "name": "Smart Group Name",
        "smartGroup": true
    },
    "webhook": {
        "eventTimestamp": 1553550275590,
        "id": 1,
        "name": "Webhook Documentation",
        "webhookEvent": "SmartGroupMobileDeviceMembershipChange"
    }
}