Ways to work with Jamf Infrastructure as Code (IaC) and Jamf's platform API gateway
Manage Apple, your way.
Platform API
One gateway. Every Jamf product.Most organizations don't run one Jamf product in isolation. They run Jamf Pro, Jamf Protect and Jamf Security Cloud together: each with its own API, auth and base URL. The platform API gateway changes that: one OAuth 2.0-authenticated surface — scoped to your tenant and governed by fine-grained permissions — that sits in front of the Jamf Platform.
Built for AI-assisted development
Simple for AI
The Platform API Gateways are structured to be as easy for AI tools to work with as they are for developers: consistent, predictable and documented in a way both humans and language models can parse.
Live data queries
Jamf publishes an llms.txt index of the developer docs and runs a hosted MCP Model Context Protocol (MCP)server, so tools like Claude Code, GitHub Copilot and other AI coding assistants can query live, accurate API specs directly from the source rather than guessing from stale training data.
Infrastructure as Code (IaC)
Manage your Apple fleet as code.Most device management still happens the same way it did a decade ago: log in, click, configure, repeat. That works when you're managing dozens of devices. It gets harder to trust as you scale to hundreds of policies, multiple sites, or more than one Jamf Pro instance.
What click-ops cost you as you grow:
- No record of intent: logs show who changed a setting, rarely why, and never what was tested beforehand.
- Configuration drift: one admin's change conflicts with another's, and six months later nobody agrees on what "standard" looks like.
- Knowledge walks out the door: tribal configuration knowledge lives in admins' heads. When someone leaves, so does the context.
- Slow audits: proving compliance means reconstructing timelines from screenshots and scattered exports instead of pointing to a history.
- Reactive teams: repetitive console work eats time that could go toward higher-value projects
How Jamf supports IaC
Jamf's approach to IaC is built on Terraform, and (deliberately) it isn't a single, closed, first-party tool. It's a layered set of providers: some built by Jamf, one built and maintained by the community, that together let you describe your entire Apple environment as code and manage it through the same Platform API Gateway. And because it's built on the Jamf Pro deployment you already run, adopting it doesn't mean switching MDMs to get there.
Our partners and ecosystem
- Jamf Pro provider, built by Deployment Theory; now maintained with contributions from engineers who use Jamf, including from Lloyds Banking Group
- Jamf Platform provider, Jamf-built: as the Platform API grows, so does coverage — its newest release federates the full Jamf Pro surface under one authenticated connection
- Jamf Protect provider: built by Jamf
- jamformer, a Jamf Concepts tool for bringing an already-configured, console-managed tenant into code
What do our providers and tools do?
Jamf Pro provider
Manages policies, scripts, configuration profiles, Smart Groups, static groups, prestages, packages and more via the Classic API and Jamf Pro API.
Jamf Platform provider
Manages platform API deliveries like blueprints, compliance benchmarks, device groups, device actions and data sources for unified inventory.
Jamf Protect provider
Manages Jamf Protect's own GraphQL-based Configuration as Code (CaC): plans, action configurations, exception sets and more.
jamformer
Discovers what's in your Jamf instance and generates a first draft Terraform configuration across all four providers. No migration starts from a blank file.
The workflow:
-
Define the desired state in a Terraform configuration file: the settings, profiles and policies you want to exist.
-
Run terraform plan to see exactly what would change before anything touches a live device: creation, modification, or destruction, in plain diff form.
-
Push through a pull request. Reviewers see the diff, approve it — and only then does terraform apply bring your Jamf environment in line with what's in Git.
-
Roll back by reverting a commit, not by manually re-clicking through a console under pressure.
What makes Jamf different
No rip-and-replace
Adopt IaC on your existing Apple platform.
Apple native; Apple first
Map to real Apple OS constructs.
Open where it matters
Official where it counts.
Proven under audit
Several customers currently manage regulated, audited Apple fleets as code.
Industry-standard Terraform
Your teams have already got this.
AI-ready by design
AI coding assistants can query directly.
Get started.
Build, automate and manage Apple at workHowever your team works best
Questions and answers
What's the difference between the Jamf Pro API and the Jamf Platform API?
The Jamf Pro API is the REST API for the Jamf Pro product specifically, tenant by tenant. The Jamf Platform API is a newer, unified gateway that sits across Jamf Pro, Jamf Protect and Jamf Security Cloud through one OAuth 2.0 entry point and is starting to federate Jamf Pro resources under that same gateway.
Do I have to migrate off Jamf Pro to start using Infrastructure as Code?
No. Jamf's Terraform providers manage the Jamf Pro deployment you already run. There's no MDM migration required to adopt a code-based workflow.
What is Infrastructure as Code and why does it matter for Apple device management?
Infrastructure as Code means defining your device management configuration (policies, profiles, groups and more) in version-controlled files rather than through manual console changes. For Apple fleets, that means every change is reviewable, auditable and reversible before it reaches a live device.
What if I already have an existing, console-managed Jamf Pro tenant?
jamformer discovers what's already configured in your tenant and generates a first-draft Terraform configuration from it, so moving to code-managed doesn't mean starting from a blank project.