gatewaysdk 0.3.2__py3-none-any.whl

gatewaysdk/environment/schema/connectors/jamf/provenance.json

@@ -0,0 +1,181 @@
+{
+  "connector": "jamf",
+  "shape": "mixed",
+  "label": "subset",
+  "authored_by": "connector-template-author (brief: .claude/skills/connector-schema-authoring/briefs/jamf.md)",
+  "generated_at": "2026-09-06T22:27:40Z",
+  "scope_hash": "sha256:dd428e10ae681def60d56915020efedde639accd5784489de18a7bc8e018ce05",
+  "world_sha256": "sha256:09b9f16faad8583bbe2c8b1978da8e2265777f2f840869319c76909c64be7f2d",
+  "source": {
+    "kind": "docs-embedded-openapi",
+    "url": "https://developer.jamf.com/jamf-pro/reference/jamf-pro-api",
+    "version": "Jamf Pro API 11.31.0; Classic API 11.28.0",
+    "sha256": "2b788374829edc1687adc9e8b55a8e846b5cfaa28a59db1502f404c63726b86d",
+    "verified_at": "2026-09-06",
+    "note": "Primary evidence is the OpenAPI 3.0 JSON embedded in Jamf's public reference markdown. Jamf's preferred machine-readable declaration is per-instance at https://<instance>.jamfcloud.com/api/schema, but no sandbox instance was available. The top-level digest is the llms.txt index; every used page is pinned separately below and all listed bytes were re-fetched and hashed on 2026-09-06.",
+    "pages": [
+      {
+        "url": "https://developer.jamf.com/jamf-pro/llms.txt",
+        "sha256": "2b788374829edc1687adc9e8b55a8e846b5cfaa28a59db1502f404c63726b86d",
+        "used_for": "documentation index"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v3-computers-inventory-id.md",
+        "version": "11.31.0",
+        "sha256": "518c2dd570e814bfa8b6827f0fed6743dfcc6320857888885836537489a0d263",
+        "used_for": "ComputerInventoryV3 and retained GENERAL, HARDWARE, OPERATING_SYSTEM, USER_AND_LOCATION section declarations; ComputerSectionV3 values; ApiError; documented 404"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v2-mobile-devices-id.md",
+        "version": "11.31.0",
+        "sha256": "7740a4df97106f827f6f6420e532283a807e148c9ac02bc7c76feb2710ef99ff",
+        "used_for": "MobileDeviceV2 summary read properties and type enum"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v2-mobile-devices-id-detail.md",
+        "version": "11.31.0",
+        "sha256": "38452ad2b879c4036137b0586eee8048fbd77e746e79cbcda6d492502523df99",
+        "used_for": "MobileDeviceDetailsV2 detail read scalar properties"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v1-computer-groups.md",
+        "version": "11.31.0",
+        "sha256": "2358059ea0094ffdc0574ac73fd6b18a3b50d6c2fb83361bb74086997c33a6ef",
+        "used_for": "ComputerGroup read shape"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v3-computer-groups-static-groups-id.md",
+        "version": "11.31.0",
+        "sha256": "d7b65916abf86916c31cbce04138d32074f154bf6647b756d1e186fd049447e0",
+        "used_for": "StaticComputerGroup required id/name and nullable description/siteId"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/put_v3-computer-groups-static-groups-id.md",
+        "version": "11.31.0",
+        "sha256": "fd0b2dd273f0f74fb0cc85adffdf89c2ede7c4ffc1dba6e71a88e4d096c786fd",
+        "used_for": "StaticComputerGroupAssignment.assignments membership evidence"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/post_v3-computer-groups-static-groups.md",
+        "version": "11.31.0",
+        "sha256": "2755fec17919738bc5af2499c1f136d53dcc0827eada736fc1decc45d8315f0c",
+        "used_for": "documented 422 Duplicate group name and 400 responses"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v1-computer-extension-attributes-id.md",
+        "version": "11.31.0",
+        "sha256": "4f8c40bee779f27926e642d26c3d599238f2630077db8bddce1871642fa413ed",
+        "used_for": "ComputerExtensionAttributes declared allOf properties, required blocks, enums, and ApiError shape"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/get_v1-users-id.md",
+        "version": "11.31.0",
+        "sha256": "3ef642b8eff665d09a3dcca984e6bdae989119fc76eb0371c680830418215046",
+        "used_for": "UserInventory plus User.id allOf read shape"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/findpolicies.md",
+        "version": "Classic API 11.28.0",
+        "sha256": "8426f22ed86f6c053e2a6d2a96304b11cd47d23292c31647db1b4a7101a906ea",
+        "used_for": "policy list id_name read form"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/findpoliciesbyid.md",
+        "version": "Classic API 11.28.0",
+        "sha256": "f6bf8225ec51cbc4600b595dc157268f5311691181611a1d6c49668cd14e95bd",
+        "used_for": "policy.general and policy.scope detail declarations and enums"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/findosxconfigurationprofiles.md",
+        "version": "Classic API 11.28.0",
+        "sha256": "4749a472fb0ca3d6e9d88cad1bf4feba321556d768209d59d4c37fb115732f04",
+        "used_for": "configuration-profile list id_name read form"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/reference/findosxconfigurationprofilesbyid.md",
+        "version": "Classic API 11.28.0",
+        "sha256": "8b952e757ec86b3fdbdfdec97ff0bab2a30aa8c205c251406a51daf4d5162064",
+        "used_for": "os_x_configuration_profile.general and .scope detail declarations and enums"
+      },
+      {
+        "url": "https://developer.jamf.com/jamf-pro/docs/webhooks-1.md",
+        "sha256": "f9cec6b78ded10593c81e261142cc4545595dbf9bd73da3ac8a759069a18be68",
+        "used_for": "consulted only; event entities remain outside this eight-entity scope"
+      }
+    ]
+  },
+  "coverage": {
+    "entity_count": 8,
+    "recursive_field_count": 373,
+    "count_method": "For each declared entity, count every object property reached from its schema after resolving local $ref; descend properties, array items, allOf, anyOf, and oneOf. Repeated paths count independently.",
+    "included": "Four computer inventory sections; union of mobile summary/detail scalar fields; groups and membership relationships; policy and configuration-profile list identities plus nested general/scope detail; extension-attribute definitions; users.",
+    "excluded": "See scope.toml for section-, field-, and compiler-specific exclusions."
+  },
+  "errors": {
+    "format": "{\"httpStatus\": <int>, \"errors\": [{\"code\", \"description\", \"id\", \"field\"}]}",
+    "modelled_as": "$defs/ApiError and $defs/ApiErrorCause retain the Jamf Pro API declaration; handlers raise only statuses/descriptions explicitly documented for their endpoint.",
+    "raised_by_handlers": [
+      "get_computer -> '404: Specified computer object does not exist.'",
+      "create_computer_group -> '422: Duplicate group name.'"
+    ],
+    "note": "Jamf publishes no ApiErrorCause.code vocabulary; the OpenAPI example 8675309 is an example, not an enum, and is not treated as a declared value. Classic API errors are HTML/XML status bodies, not this JSON shape."
+  },
+  "type_mapping_notes": [
+    "OpenAPI nullable: true becomes type [sourceType, null]; no additional nullability is inferred.",
+    "OpenAPI format date-time is retained. Unsupported integer int32/int64 format annotations are dropped while integer type and declared bounds remain.",
+    "ComputerGeneral.initialEntryDate retains the OpenAPI date format.",
+    "Jamf Pro API ids remain strings and Classic API ids remain integers.",
+    "Declared enum blocks are copied in vendor order and casing. Examples and prose examples are not promoted to enums."
+  ],
+  "requiredness": {
+    "vendor": "Required arrays inside retained OpenAPI schemas are preserved. Jamf Pro inventory, mobile-device, and user response properties have no declared required arrays.",
+    "entity_keys": "gateway-world/1 requires direct required non-null keys, so vendor ids are promoted to required at entity roots.",
+    "multiple_reads": "MobileDevice properties are the union of summary/detail reads, with only the mandatory entity id required. Classic policy/profile list identity and detail section properties are also a union, with only id required at the entity root.",
+    "computer_sections": "The endpoint returns one or several requested sections. general, hardware, operatingSystem, and userAndLocation are optional as whole sections; no section is globally required."
+  },
+  "tenant_overlay": {
+    "required": false,
+    "channel": "GET /v1/computer-extension-attributes and mobile-device equivalent, plus per-instance https://<instance>.jamfcloud.com/api/schema",
+    "note": "Extension-attribute definitions are in the base; collected values are tenant data and remain outside the shared template."
+  },
+  "compiler_limitations": [
+    "hardware.serialNumber remains nested. Nested uniqueness is supported, but the pinned OpenAPI does not declare serial-number uniqueness, so no constraint is invented.",
+    "The Classic list and detail HTTP envelopes differ; entities model the union of record properties and omit envelope-only size fields.",
+    "Conditional section selection is represented by independently optional whole section properties because entity roots cannot use composition as an identity workaround.",
+    "OpenAPI date is retained for initialEntryDate."
+  ],
+  "unverified": [
+    "No per-instance /api/schema was available; public embedded OpenAPI fragments are pinned instead.",
+    "No Jamf sandbox or trial credentials were available, so tenant round trip, mutation verification, audit against pulled records, and golden replay were skipped.",
+    "No customer or production data is included.",
+    "Serial-number, UDID, extension-attribute-name, and username uniqueness are not declared by the pinned OpenAPI and are therefore not asserted. Computer group name uniqueness is retained because the create endpoint explicitly documents Duplicate group name as 422.",
+    "computerId in the membership join is a projection name for the member computer id; Jamf supplies assignments as an array of ids rather than join records."
+  ],
+  "fidelity": {
+    "label": "subset",
+    "mimic_status": "not eligible without a per-instance schema, sandbox round trip, and golden replay",
+    "sandbox": "Jamf developer sandbox or trial required; none available",
+    "goldens": "none",
+    "tenant_round_trip": "skipped"
+  },
+  "verification": {
+    "bundle": "/home/ubuntu/jamf-connector-verify",
+    "init": "passed: status ok",
+    "compile": "passed: status ok",
+    "check": "passed: status ok",
+    "domain_hash": "babbc52fe77b577ebeedd2cc2193a39a94fe126826fe75cbe791529cb6e7d831",
+    "synthetic_store": "passed: inserted one synthetic row for every entity, resolved both computer-group membership relationships, exercised retained declared enums, and audit returned no violations",
+    "field_count": {
+      "jamf_computers": 91,
+      "jamf_mobile_devices": 31,
+      "jamf_computer_groups": 4,
+      "jamf_computer_group_members": 2,
+      "jamf_policies": 120,
+      "jamf_configuration_profiles": 104,
+      "jamf_extension_attributes": 12,
+      "jamf_users": 9,
+      "total": 373
+    },
+    "pytest_conventions": "not run: python3.12 environment has no pytest module"
+  }
+}

gatewaysdk/environment/schema/connectors/jamf/scope.toml

@@ -0,0 +1,128 @@
+# Scope of the Jamf Pro model.
+#
+# Hand-authored from the OpenAPI fragments embedded in the pinned developer.jamf.com
+# reference pages (Jamf Pro API 11.31.0, Classic API 11.28.0). There is no importer
+# run behind this file yet. The allowlist and exclusions make a later diff against a
+# tenant's per-instance /api/schema explicit.
+
+[source]
+kind = "docs"
+jamf_pro_api_version = "11.31.0"
+classic_api_version = "11.28.0"
+instance_spec = "none"          # https://<instance>.jamfcloud.com/api/schema needs an instance
+shape = "mixed"
+evidence_reverified = "2026-09-06"
+
+# ---------------------------------------------------------------- entity allowlist
+
+[[entities]]
+name = "jamf_computers"
+vendor = "ComputerInventoryV3 (GET /v3/computers-inventory/{id})"
+sections = ["GENERAL", "HARDWARE", "OPERATING_SYSTEM", "USER_AND_LOCATION"]
+primary_key = ["id"]
+unique = []
+note = "The four retained response sections and serialNumber under hardware stay nested. Since `section` can select one or several sections, each section is optional as a whole; fields inside it retain the OpenAPI requiredness (none)."
+
+[[entities]]
+name = "jamf_mobile_devices"
+vendor = "MobileDeviceV2 (GET /v2/mobile-devices/{id}) plus MobileDeviceDetailsV2 (GET /v2/mobile-devices/{id}/detail)"
+primary_key = ["id"]
+unique = []
+note = "Properties are the union of the two read forms. Only id is required by the entity key because the OpenAPI declares no response property required; detail-only fields cannot be required of summary records."
+
+[[entities]]
+name = "jamf_computer_groups"
+vendor = "ComputerGroup (GET /v1/computer-groups) and StaticComputerGroup"
+primary_key = ["id"]
+unique = [["name"]]
+note = "id/name requiredness comes from StaticComputerGroup; the create endpoint explicitly documents duplicate group names as 422."
+
+[[entities]]
+name = "jamf_computer_group_members"
+vendor = "StaticComputerGroupAssignment.assignments (PUT /v3/computer-groups/static-groups/{id}) and GroupMembership.groupId on computer inventory"
+primary_key = ["groupId", "computerId"]
+note = "Jamf carries membership as an array on either side; gateway-world/1 represents the relationship as a join entity. computerId is the projection name for the member computer's id."
+
+[[entities]]
+name = "jamf_policies"
+vendor = "id_name from GET /policies plus policy.general and policy.scope from GET /policies/id/{id}"
+primary_key = ["id"]
+note = "The list identity supplies the direct entity key. Detail fields remain under general and scope; they are not hoisted to accommodate the compiler."
+
+[[entities]]
+name = "jamf_configuration_profiles"
+vendor = "id_name from GET /osxconfigurationprofiles plus os_x_configuration_profile.general and .scope from GET /osxconfigurationprofiles/id/{id}"
+primary_key = ["id"]
+note = "The list identity supplies the direct entity key. Detail fields remain under general and scope; only the opaque mobileconfig payload is excluded."
+
+[[entities]]
+name = "jamf_extension_attributes"
+vendor = "ComputerExtensionAttributes (GET /v1/computer-extension-attributes/{id})"
+primary_key = ["id"]
+unique = []
+note = "Definitions only. Collected values are tenant data and reach a world through the optional overlay. The OpenAPI does not declare name unique."
+
+[[entities]]
+name = "jamf_users"
+vendor = "User = UserInventory + id (GET /v1/users/{id})"
+primary_key = ["id"]
+unique = []
+note = "The Jamf Pro API user shape is retained in full. The OpenAPI does not declare username required or unique."
+
+# ------------------------------------------------------------------- key handling
+
+[key_overrides]
+# Jamf Pro inventory/user response schemas mark ids readOnly and declare no property
+# required. gateway-world/1 requires each primary key to be direct, required, and
+# non-null, so the vendor id is promoted to required for persistence.
+jamf_computers = "id promoted to required; nested hardware.serialNumber uniqueness is not asserted by the pinned OpenAPI"
+jamf_mobile_devices = "id promoted to required; serialNumber uniqueness is not asserted by the pinned OpenAPI"
+jamf_computer_groups = "id and name are already required by StaticComputerGroup"
+jamf_extension_attributes = "id promoted to required; name/dataType/inputType/inventoryDisplayType keep their vendor declarations"
+jamf_users = "id promoted to required"
+jamf_policies = "direct id comes from the documented list id_name shape; detail general.id remains nested"
+jamf_configuration_profiles = "direct id comes from the documented list id_name shape; detail general.id remains nested"
+
+[shape_overrides]
+classic_read_forms = "Policy and profile entity properties are the union of list identity and detail sections; requiredness is their supported intersection plus the mandatory entity id."
+serial_uniqueness = "Computer serialNumber remains at hardware.serialNumber. Nested uniqueness is supported, but no constraint is invented because the pinned OpenAPI does not declare one."
+section_scoping = "Computer inventory returns only requested sections. general, hardware, operatingSystem, and userAndLocation are independently optional whole sections."
+
+[relationship_hints]
+jamf_computer_group_members = [
+  "groupId -> jamf_computer_groups.id",
+  "computerId -> jamf_computers.id",
+]
+
+[polymorphic]
+fields = []
+
+# ----------------------------------------------------------------------- exclusions
+
+[exclusions]
+"ComputerInventoryV3 sections outside GENERAL/HARDWARE/OPERATING_SYSTEM/USER_AND_LOCATION" = "Outside the brief's four-section inventory scope; add from the pinned per-instance schema when a use case requires them."
+"ComputerGeneral.extensionAttributes/ComputerHardware.extensionAttributes/ComputerOperatingSystem.extensionAttributes/ComputerUserAndLocation.extensionAttributes" = "Collected tenant extension-attribute values; definitions are modelled separately and values belong in the optional tenant overlay."
+"ComputerGeneral.remoteManagement" = "Contains deprecated managementUsername, documented by Jamf as always null and replaced by the privileged local-admin-password endpoint."
+"MobileDeviceDetailsV2.site/location/groups" = "Nested detail outside the brief's identity/inventory scope."
+"MobileDeviceDetailsV2.extensionAttributes" = "Collected tenant extension-attribute values; excluded from the shared base."
+"MobileDeviceDetailsV2.ios/tvos/watchos/visionos" = "Large per-platform inventory branches are excluded; the declared type discriminator and common scalar inventory fields remain."
+"policy sections other than general/scope" = "Action payloads (packages, scripts, account maintenance, encryption, and user interaction) are outside the records/scope model and may include secrets."
+"os_x_configuration_profile.general.payloads" = "Opaque mobileconfig plist; excluded because gateway-world/1 cannot validate its internal payload contract."
+"os_x_configuration_profile.self_service" = "Presentation configuration outside the records/scope model."
+"Classic /users" = "Superseded by GET /v1/users/{id}, which Jamf marks as full parity; using both would split id types."
+"webhooks" = "Event payloads are documented but no event entity is in this eight-entity scope."
+
+[compiler_limitations]
+nested_unique = "Nested scalar uniqueness is supported, but hardware.serialNumber is not declared unique by the pinned OpenAPI and is therefore not asserted."
+conditional_sections = "The contract has no conditional-required construct suitable for entity roots; requested computer sections are therefore represented as independently optional whole properties."
+openapi_date = "OpenAPI date is retained as format date; ComputerGeneral.initialEntryDate is modelled."
+classic_envelopes = "Classic list and detail reads have different wrappers. Entity properties preserve the union of their record forms, not HTTP envelope fields such as size."
+
+[verification]
+sandbox = "not available"
+tenant_round_trip = "skipped: no Jamf developer sandbox or trial credentials"
+goldens = "skipped: no consenting tenant capture; no customer data is included"
+synthetic_fixture = "not shipped: connector template layout does not support data files; ephemeral synthetic rows were inserted for all eight entities in /home/ubuntu/jamf-depth-verification-2"
+schema_compile_check = "passed: init, compile, and check returned status ok with domain hash 2c544719f091a190235f91e4e51b86cee3956975238b3eaf38a15a0d32f383a5"
+store_audit = "passed: one synthetic row per entity, both membership relationships resolved, declared enums validated, audit returned no violations"
+label = "subset"