ruby-jss 3.2.2 → 4.0.0b1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 723328fc03b943e9453d8575edabd1a764582711f87c609dcbc439c147957ea6
-  data.tar.gz: 43f8c1cbde95f56e977678ba9a1573781761cae0635b9f89592ec5dab1b0aecf
+  metadata.gz: 5404634d6e9f6031506f64c61391ca5a461ad71e372922d20c2785022cede9e7
+  data.tar.gz: 435a69e88d14c9df2ddac29ed1ce8a8dffd485ac2c6969d6f765a92a67d75c97
 SHA512:
-  metadata.gz: 7d95f14055ae3668af94a9aa0b8932255dcc6adf93175318ec4218a510a0ce8fa95cf99ffd60a803245b87f4087e733a51872c2b05c543f1dc025d3b5dfaf876
-  data.tar.gz: 79ddfbe92115d2d1325b6de74c1d999bf6f439ea4f0cab95a6b52b1e8055016abac9078873d2b63c4351eaeb0d0a8aa19c71a9c47e2bd8734e3b8ca8f5130f02
+  metadata.gz: c75068fdbb7fbe7c780a46f76e2430ed3c00f3b5afd4cf6020d4ad39d961b07207f4da27a466eb990f164ea499a123a2e12d2a79c42b95b6f208c07f5554cdbd
+  data.tar.gz: 1e8dc60c2f322c147b7650b76c565fc04c959c8eb43554b5efed0c8f7ce032683f22ee967d23c494dea2f4a949e96f8b03d32d1aa369219d9545559edbb0c187

data/CHANGES.md

@@ -2,7 +2,7 @@
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+and this project attempts to adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## _IMPORTANT_: Known Security Issue in v1.5.3 and below
 
@@ -14,12 +14,38 @@ __Please update all installations of ruby-jss to at least v1.6.0.__
 
 Many many thanks to actae0n of Blacksun Hackers Club for reporting this issue and providing examples of how it could be exploited.
 
+--------
+## \[4.0.0] 2024-01-22
+
+### Changed
+  - Jamf::ComputerPrestage now accesses the v3 endpoints as needed - the v1 and some v2 endpoints are deprecated and will be removed from the Jamf Pro API sometime soon
+  
+  - Jamf::Prestage (ComputerPrestage and MobileDevicePrestage) no longer accesses Jamf::DeviceEnrollment for pre-validation. The API itself will report these kinds of errors when prestage scope changes are saved. See the ['Cross-object valildation in setters' section of the file _README-2.0.0.md_](README-2.0.0.md#cross-object-validation-in-setters)
+
+  - Jamf::Prestage (ComputerPrestage and MobileDevicePrestage) no longer caches any data from the server. All methods that take a `refresh` parameter (positional or named) will ignore that parameter and always fetch fresh data. This applies to mostly to the current scope (assignments) for the prestages. This is in line with the ['API data are no longer cached' section of the file _README-2.0.0.md](README-2.0.0.md#api-data-are-no-longer-cached-) (and also, the data was being cached in an inappropriate place).  If making many calls at once, consisider capturing the data in your own variable. See also the deprecations listed below.
+
+### Added
+  - Support for API Roles and API Clients (requires Jamf Pro 10.49 and up). 
+    - Two new classes: `Jamf::APIRole` and `Jamf::APIClient` provide access to the definitions of these objects via the 'api-roles' and 'api-integrations' endpoints respectively. There are also methods for listing all available privileges for defining roles, and for rotating the clientSecret of clients.
+
+    - Connections can now be made using API clients. When specifying connection parameters, just use `client_id:` instead of `user:` and `client_secret` instead of `pw:`. For example:  
+      
+      `Jamf.cnx.connect  client_id: "a83cb7bc-5a61-4e5f-b894-5d63dca2e355", client_secret: "seCretString", host: 'jamfpro.company.com', port: 8443`  
+
+      NOTE that 'keep_alive' cannot be used with API Clients - the tokens generated with them will expire at the appropriate time, which is usually much shorter than the session timeout for standard connections.
+
+### Fixed
+  - Bugfix when flushing or refreshing cached data
+  - Bugfix when validating data for saving newly-created objects to the Jamf Pro API
+
+### Deprecated
+  - Jamf::Prestage (ComputerPrestage and MobileDevicePrestage): the `refresh` parameter will be removed from all class and instance methods in a future version of ruby-jss. It currently is still accepted, but does nothing. See the changes listed above.
+
 --------
 ## \[3.2.1] 2023-09-12
 
 ### Fixed
   - Don't look at the management_status of unmanaged computers, it doesn't exist.
-    
 
 --------
 ## \[3.2.1] 2023-09-08

data/README-2.0.0.md

@@ -191,12 +191,14 @@ If you want to avoid repeated GET requests to the server when you aren't worried
 
 ### No Attribute aliases for Jamf Pro API objects
 
-Objects from the Jamf Pro API will no longer define aliases for the attribute names that come from the API itself. This means, e.g., to get the name of a ComputerPrestage or MobileDevicePrestage, you have to ask for its `displayName` not its `name`, since the property comes from the API as `displayName`. To see a list  of all the names, you must use `.all_displayNames` not `.all_names`.  For objects with a 'name' property (most of them) then you can use `.name` and `.all_names`.
+In most cases, objects from the Jamf Pro API will no longer define aliases for the attribute names that come from the API itself. This means, e.g., to get the name of a ComputerPrestage or MobileDevicePrestage, you have to ask for its `displayName` not its `name`, since the property comes from the API as `displayName`. To see a list  of all the names, you must use `.all_displayNames` not `.all_names`.  For objects with a 'name' property (most of them) then you can use `.name` and `.all_names`. 
 
 The reason behind this is twofold: 
 1) to simplify ruby-jss's code and automate as much as possible
 2) to reflect what Jamf actually gives us in the APIs
 
+There may be times when exceptions to this are appropriate. For example, in the Jamf Pro Webapp, the API Roles assigned to API Clients are called 'API Roles' or just 'roles'.  However in the API data for APIClients (which themselves are called APIIntegrations), the roles are called 'authorizationScopes'.  In order to agree with the webapp, the various 'authorizationScopes*' methods have matching 'roles*' aliases.
+
 **IMPORTANT** This is a breaking change from earlier ruby-jss versions, for which Jamf Pro API objects had the potential for aliases of their attribute names.
 
 ### Class/Mixin hierarchy for Jamf Pro API objects

data/lib/jamf/api/connection/cache.rb

@@ -40,7 +40,7 @@ module Jamf
       # when ruby-jss is required
       EXTENDABLE_CLASSES = %w[Jamf::Computer Jamf::MobileDevice Jamf::User].freeze
 
-      # @return [Concurrent::Map.new] This Hash-like object caches the results of
+      # @return [Concurrent::Map] This Hash-like object caches the results of
       #   C-API queries for an APIObject
       #   subclass's .all summary list, keyed by the subclass's RSRC_LIST_KEY.
       #   See the APIObject.all class method.
@@ -97,7 +97,7 @@ module Jamf
       # won't be removed from memory by garbage collection but all cached data
       # will be recached as needed.
       #
-      # e.g.s
+      # e.g.
       #  my_ref = Jamf::SomeClass.all
       #  # my_ref now points to the same cached hash that Jamf::SomeClass.all does
       #
@@ -122,20 +122,21 @@ module Jamf
       def flushcache(key_or_klass = nil)
         # EA defs for just one extendable class?
         if EXTENDABLE_CLASSES.include? key_or_klass.to_s
-          @c_ext_attr_definition_cache[key_or_klass] = Concurrent::Hash.new
+          @c_ext_attr_definition_cache[key_or_klass] = Concurrent::Map.new
 
         # one API object class?
         elsif key_or_klass
           map_key_pfx = "#{key_or_klass}_map_"
-          @c_object_list_cache.delete_if do |cache_key, _cache|
-            cache_key == key_or_klass || cache_key.to_s.start_with?(map_key_pfx)
-          end
+          @c_object_list_cache.each_key do |cache_key|
+            next unless cache_key == key_or_klass || cache_key.to_s.start_with?(map_key_pfx)
 
+            @c_object_list_cache.delete cache_key
+          end
 
         # flush everything
         else
-          @c_object_list_cache = Concurrent::Hash.new
-          @c_ext_attr_definition_cache = Concurrent::Hash.new
+          @c_object_list_cache = Concurrent::Map.new
+          @c_ext_attr_definition_cache = Concurrent::Map.new
         end
 
         GC.start

data/lib/jamf/api/connection/connect.rb

@@ -88,6 +88,22 @@ module Jamf
       # in the parameters. See {Jamf::Configuration}. If there are no config values
       # then a built-in default is used if available.
       #
+      # ### API Clients
+      #
+      # As of Jamf Pro 10.49, API connections can be made using "API Clients" which are
+      # assigned to various "API Roles", as well  as regular Jamf Pro accounts.
+      #
+      # Connections made with API Client credentials are different from regular connections:
+      #   - Their expiration period can vary based on the Client definition
+      #   - The expirations are usually quite short, less than the default 30 min. session timeout
+      #   - They cannot be kept alive, they will become invalid when the expiration time arrives.
+      #   - The API endpoints and data exchange used for making API Client connections are
+      #     different from those used by normal connections.
+      #
+      # To make a connection using an API Client, pass in the client_id: and client_secret: instead
+      # of user: and pw:
+      #
+      #####################
       #
       # @param url[String] The URL to use for the connection. Must be 'https'.
       #   The host, port, and (if provided), user and spassword will be extracted.
@@ -108,13 +124,23 @@ module Jamf
       #     server_path: 'dev_mgmt/jssweb'
       #
       # @option params :user[String] a JSS user who has API privs, required if not
-      #   defined in Jamf::CONFIG
+      #   defined in Jamf::CONFIG.
+      #   NOTE: To use an API Client (Jamf pro 10.49 and up),
+      #   provide client_id: instead of user:
+      #
+      # @option params :client_id[String] The Client ID of an "API Client"
+      #   available in Jamf Pro 10.49 and up. Use this instead of user:
+      #
+      # @option params :client_secret[String] The Client Secret of an "API Client"
+      #   available in Jamf Pro 10.49 and up. Use this instead of pw:
       #
       # @option params :pw[String, Symbol] The user's password, :prompt, or :stdin
       #   If :prompt, the user is promted on the commandline to enter the password
       #   If :stdin#, the password is read from a line of std in represented by
       #   the digit at #, so :stdin3 reads the passwd from the third line of
       #   standard input. Defaults to line 1, if no digit is supplied. see {JSS.stdin}
+      #   NOTE: To use an API Client (Jamf pro 10.49 and up),
+      #   provide client_secret: instead of pw:
       #
       # @option params :port[Integer] the port number to connect with, defaults
       #   to 443 for Jamf Cloud hosts, 8443 for on-prem hosts
@@ -287,7 +313,6 @@ module Jamf
       private
 
       # Get host, port, & user from a Token object
-      # or just the user from a token string.
       #######################################################
       def parse_token(params)
         return unless params[:token].is_a? Jamf::Connection::Token
@@ -349,6 +374,10 @@ module Jamf
         # (will be set via client defaults or module defaults)
         params[:port] ||= Jamf::Connection::JAMFCLOUD_PORT if params[:host].to_s.end_with?(Jamf::Connection::JAMFCLOUD_DOMAIN)
 
+        # if we're using an API client, the id and secret are synonyms of the user and pw
+        params[:user] ||= params[:client_id]
+        params[:pw] ||= params[:client_secret]
+
         apply_defaults_from_config(params)
 
         apply_defaults_from_client(params)
@@ -466,6 +495,8 @@ module Jamf
         token_params = {
           base_url: build_base_url(params),
           user: params[:user],
+          client_id: params[:client_id],
+          client_secret: params[:client_secret],
           timeout: params[:timeout],
           keep_alive: params[:keep_alive],
           refresh_buffer: params[:token_refresh_buffer],

data/lib/jamf/api/connection/constants.rb

@@ -34,6 +34,11 @@ module Jamf
 
       # This version of ruby-jss only works with this version of the server
       # and higher
+      #
+      # NOTE: Some objects and features may require newer versions of Jamf Pro than this.
+      # However this is the minimum required for even making an API connection using this
+      # version of ruby-jss.
+      #
       MIN_JAMF_VERSION = Gem::Version.new('10.35.0')
 
       # The base of the Classic API resources

data/lib/jamf/api/connection/token.rb

@@ -45,6 +45,12 @@ module Jamf
 
       JAMF_VERSION_RSRC = "#{JAMF_VERSION_RSRC_VERSION}/jamf-pro-version".freeze
 
+      OAUTH_RSRC = 'oauth'.freeze
+
+      API_CLIENT_TOKEN_RSRC = "#{OAUTH_RSRC}/token".freeze
+
+      API_CLIENT_GRANT_TYPE = 'client_credentials'.freeze
+
       # Recognize the tryitout server, cuz its /auth endpoint
       # is disabled, and it needs no tokens
       # TODO: MOVE THIS TO THE CONNECTION CLASS
@@ -155,6 +161,9 @@ module Jamf
           @pw_fallback = false unless @pw
           init_from_token_string params[:token_string]
 
+        elsif @client_id
+          init_for_api_client
+
         elsif @user && @pw
           init_from_pw
 
@@ -166,6 +175,32 @@ module Jamf
         @creation_time = Time.now
       end # init
 
+      # Initialize for an API client
+      #################################
+      def init_for_api_client
+        data = {
+          client_id: @client_id,
+          client_secret: Base64.decode64(@pw),
+          grant_type: API_CLIENT_GRANT_TYPE
+        }
+
+        resp = api_client_auth_connection(API_CLIENT_TOKEN_RSRC).post { |req| req.body = data }
+
+        if resp.success?
+          parse_token_from_api_client_auth resp
+          @creation_http_response = resp
+          whoami = token_connection(AUTH_RSRC, token: @token).get
+          @user = "#{whoami.body[:account][:username]} (API Client)"
+        elsif resp.status == 401
+          raise Jamf::AuthenticationError, 'Incorrect client_id or client_secret'
+        else
+          # TODO: better error reporting here
+          raise Jamf::AuthenticationError, "An error occurred while authenticating client_id: #{resp.body}"
+        end
+      ensure
+        @pw = nil
+      end
+
       # Initialize from password
       #################################
       def init_from_pw
@@ -430,7 +465,18 @@ module Jamf
 
         @timeout = params[:timeout] || Jamf::Connection::DFT_TIMEOUT
 
-        @user = params[:user]
+        if params[:client_id]
+          @client_id = params[:client_id]
+          params[:keep_alive] = false
+          params[:refresh_buffer] = nil
+          params[:pw_fallback] = false
+        else
+          @user = params[:user]
+        end
+
+        # when using an API client, the client secret can be
+        # given in params[:client_secret] or params[:pw]
+        params[:pw] ||= params[:client_secret]
 
         # @pw will be deleted after use if pw_fallback is false
         # It is stored as base64 merely for visual security in irb sessions
@@ -496,6 +542,19 @@ module Jamf
         end # Faraday.new
       end # token_connection
 
+      # a generic, one-time Faraday connection for API Client token
+      # acquision & manipulation
+      #################################
+      def api_client_auth_connection(rsrc)
+        Faraday.new("#{@base_url}/#{Jamf::Connection::JPAPI_RSRC_BASE}/#{rsrc}", ssl: @ssl_options) do |fcnx|
+          # activates the url_encoded request middleware, which converts a hash in the request body to url-encoded form data
+          fcnx.request :url_encoded
+          # activates the json response middleware, parsing all valid  response bodies with JSON.parse
+          fcnx.response :json, parser_options: { symbolize_names: true }
+          fcnx.adapter Faraday::Adapter::NetHttp
+        end
+      end # token_connection
+
       # Parse the API token data into instance vars.
       #################################
       def parse_token_from_response(resp)
@@ -505,6 +564,16 @@ module Jamf
         @valid = true
       end
 
+      # Parse the API Client token data into instance vars.
+      #################################
+      def parse_token_from_api_client_auth(resp)
+        @token_response_body = resp.body
+        @token = @token_response_body[:access_token]
+        @expires = Time.now + @token_response_body[:expires_in] - 1
+        @api_role_ids = @token_response_body[:scope].split(' ').map { |r| r.split(':').last }
+        @valid = true
+      end
+
     end # class Token
 
   end # class Connection

data/lib/jamf/api/connection.rb

@@ -33,7 +33,7 @@ module Jamf
   #
   # For most cases, a single connection to a single JSS is all you need, and
   # ruby-jss automatically creates and uses a default connection. See
-  # {JSS.connect}
+  # {Jamf.connect}
   #
   # If needed, multiple connection objects can be made and used sequentially or
   # simultaneously.
@@ -61,14 +61,14 @@ module Jamf
   # Example:
   #
   #    require 'ruby-jss'
-  #    JSS.cnx.connect host: 'server.address.edu', user: 'jss-api-user', pw: :prompt
+  #    Jamf.connect host: 'server.address.edu', user: 'jss-api-user', pw: :prompt
   #    # (see {Jamf::Connection#connect} for all the connection options)
   #
   #    a_phone = Jamf::MobileDevice.fetch id: 8743
   #
   #    # the mobile device was fetched through the default connection
   #
-  # If needed, you can re-login to the default connection by calling JSS.connect
+  # If needed, you can re-login to the default connection by calling Jamf.connect
   # with new connection parameters. You can also call JSS.disconnect to close the
   # connection
   #
@@ -91,8 +91,9 @@ module Jamf
   #
   # NOTE:
   # When an obbject is retrieved or created it stores an internal
-  # reference to the Connection object that it usdd, and uses that when making
+  # reference to the Connection object that it was made with, and uses that when making
   # future API calls.
+  #
   # So in the example above, when saving any changes to a_computer, the Connection
   # object 'my_connection' will (and must) be used.
   #

data/lib/jamf/api/jamf_pro/api_objects/api_client.rb

@@ -0,0 +1,173 @@
+# Copyright 2023 Pixar
+
+#
+#    Licensed under the Apache License, Version 2.0 (the "Apache License")
+#    with the following modification; you may not use this file except in
+#    compliance with the Apache License and the following modification to it:
+#    Section 6. Trademarks. is deleted and replaced with:
+#
+#    6. Trademarks. This License does not grant permission to use the trade
+#       names, trademarks, service marks, or product names of the Licensor
+#       and its affiliates, except as required to comply with Section 4(c) of
+#       the License and to reproduce the content of the NOTICE file.
+#
+#    You may obtain a copy of the Apache License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the Apache License with the above modification is
+#    distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+#    KIND, either express or implied. See the Apache License for the specific
+#    language governing permissions and limitations under the Apache License.
+#
+#
+
+# The Module
+module Jamf
+
+  # Classes
+  #####################################
+
+  # An API Role in the Jamf Pro API
+  #
+  # API Roles are predefined sets of privileges that can be assigned to API Clients, aka API Integrations.
+  #
+  class APIClient < Jamf::OAPISchemas::ApiIntegrationResponse
+
+    include Jamf::CollectionResource
+    extend Jamf::Filterable
+
+    ########### RELATED OAPI OBJECTS
+    # These objects should be OAPIObjects, NOT subclasses of them and
+    # not Collection or Singleton resources.
+    #
+    # TODO: See if these constants can be auto-generated from the
+    # OAPI schema and baked into the parent class
+
+    # The OAPI object class we get back from a 'list' query to get the
+    # whole collection, or a subset of it. It contains a :results key
+    # which is an array of data for objects of the parent class.
+    SEARCH_RESULT_OBJECT = Jamf::OAPISchemas::ApiIntegrationSearchResult
+    # The OAPI object class we send with a POST request to make a new member of
+    # the collection in Jamf. This is usually the same as the parent class.
+    POST_OBJECT = Jamf::OAPISchemas::ApiIntegrationRequest
+
+    # The OAPI object class we send with a PUT request to change an object in
+    # Jamf by specifying all its values. Most updates happen this way,
+    # and this is usually the same as the parent class
+    PUT_OBJECT = Jamf::OAPISchemas::ApiIntegrationRequest
+
+    # The OAPI object we send with a PATCH request to change an object in
+    # Jamf by replacing only some of its values. This is never the same as the
+    # parent class, and is usually used when many or most of the data about an
+    # object cannot be changed via the API.
+    # PATCH_OBJECT = Jamf::OAPISchemas::Building
+
+    ############# API PATHS
+
+    # The path for GETting the list of all objects in the collection, possibly
+    # filtered, sorted, and/or paged
+    # REQUIRED for all collection resources
+    #
+    # GET_PATH, POST_PATH, PUT_PATH, PATCH_PATH, and DELETE_PATH are automatically
+    # assumed from the LIST_PATH if they follow the standards:
+    # - GET_PATH = "#{LIST_PATH}/id"
+    #   - fetch an object from the collection
+    # - POST_PATH = LIST_PATH
+    #   - create a new object in the collection
+    # - PUT_PATH = "#{LIST_PATH}/id"
+    #   - update an object passing all its values back.
+    #     Most objects use this or PATCH but not both
+    # - PATCH_PATH = "#{LIST_PATH}/id"
+    #   - update an object passing some of its values back
+    #     Most objects use this or PUT but not both
+    # - DELETE_PATH = "#{LIST_PATH}/id"
+    #   - delete an object from the collection
+    #
+    # If those paths differ from the standards, the constants must be defined
+    # here
+    #
+    LIST_PATH = 'v1/api-integrations'.freeze
+
+    # The path that returns a list of all available privs
+    NEW_CREDENTIALS_PATH_SUFFIX = 'client-credentials'
+
+    # When creating new credentials, an instance of this is returned
+    NEW_CREDENTIALS_OBJECT = Jamf::OAPISchemas::OAuthClientCredentials
+
+    # Identifiers not marked in the superclass's OAPI_PROPERTIES constant
+    # which usually only identifies ':id'
+    ALT_IDENTIFIERS = %i[displayName].freeze
+
+    # Must define this when extending Filterable
+    FILTER_KEYS = %i[
+      id displayName
+    ].freeze
+
+    # Class Methods
+    ###############################
+
+    # For the given API Client, replace the existing clientSecret with a new one, to be
+    # used with the clientID for generating a connection token.
+    #
+    # IMPORTANT: When you do this, the previous secret becomes immediately invalid and
+    # can no longer be used for generating connection tokens.
+    # BE SURE to capture the output in a variable, or display it somewhere immediately,
+    # as it will not be available ever again.
+    # See the Jamf Pro docs at
+    # https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/API_Roles_and_Clients.html
+    #
+    # @param client_ident [String, Integer] The displayName or id of the APIClient
+    #   for which to generate a new secret.
+    #
+    # @param cnx [Jamf::APIConnection] The API connection through which to perform
+    #   the operation
+    #
+    # @return [String] The new valid secret for use with the clientId
+    #
+    def self.rotate_secret(client_ident, cnx: Jamf.cnx)
+      valid_id = valid_id(client_ident, cnx: cnx)
+      raise Jamf::NoSuchItemError, "No APIClient matching '#{client_ident}'" unless valid_id
+
+      creds = NEW_CREDENTIALS_OBJECT.new cnx.jp_post("#{LIST_PATH}/#{valid_id}/#{NEW_CREDENTIALS_PATH_SUFFIX}", nil)
+      creds.clientSecret
+    end
+
+    # Instance Attributes and Methods
+    ###########################
+
+
+
+
+    # For this API Client, replace the existing clientSecret with a new one, to be
+    # used with the clientID for generating a connection token.
+    #
+    # IMPORTANT: When you do this, the previous secret becomes immediately invalid and
+    # can no longer be used for generating connection tokens.
+    # BE SURE to capture the output in a variable, or display it somewhere immediately,
+    # as it will not be available ever again.
+    # See the Jamf Pro docs at
+    # https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/API_Roles_and_Clients.html
+    #
+    # @return [String] The new valid secret for use with the clientId
+    #
+    def rotate_secret
+      self.class.rotate_secret(id, cnx: cnx)
+    end
+
+    # In the UI these are the 'API Roles', not 'authorization scopes'
+
+    alias roles authorizationScopes
+    alias roles= authorizationScopes=
+    alias roles_append authorizationScopes_append
+    alias roles_delete authorizationScopes_delete
+    alias roles_delete_at authorizationScopes_delete_at
+    alias roles_delete_if authorizationScopes_delete_if
+    alias roles_insert authorizationScopes_insert
+    alias roles_prepend authorizationScopes_prepend
+
+
+  end # class
+
+end # module

data/lib/jamf/api/jamf_pro/api_objects/api_integration.rb

@@ -0,0 +1,38 @@
+# Copyright 2023 Pixar
+
+#
+#    Licensed under the Apache License, Version 2.0 (the "Apache License")
+#    with the following modification; you may not use this file except in
+#    compliance with the Apache License and the following modification to it:
+#    Section 6. Trademarks. is deleted and replaced with:
+#
+#    6. Trademarks. This License does not grant permission to use the trade
+#       names, trademarks, service marks, or product names of the Licensor
+#       and its affiliates, except as required to comply with Section 4(c) of
+#       the License and to reproduce the content of the NOTICE file.
+#
+#    You may obtain a copy of the Apache License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the Apache License with the above modification is
+#    distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+#    KIND, either express or implied. See the Apache License for the specific
+#    language governing permissions and limitations under the Apache License.
+#
+#
+
+# The Module
+module Jamf
+
+  # In the Jamf Pro Web UI, API Clients are called just that "API Clients", so
+  # they are defined as the Jamf::APIClient class.
+  #
+  # But in the Jamf Pro API, they are referred to as API Integrations, and their
+  # resource paths are `v1/api-integrations`
+  # So, this class is just an alias of APIClient
+
+  APIIntegration = APIClient
+
+end # module