Technology Partner Program guide

Everything you need to build, validate and launch an integration with Jamf.

Start here

This is the one page to bookmark. It walks the full partner journey in order: join the program, set up an environment, build your integration, meet Jamf's requirements, document your work and launch on the Jamf Marketplace.

Each phase includes a checklist. Work through them in order, and check the boxes as you go.

Jamf classifies an integration as any app or service that uses APIs, webhooks or data streams to extend Jamf technologies. That includes configuration-only integrations built on Managed App Configuration, and documentation-only integrations delivered as a deployment guide.

Phase 1: Join the program

Your partnership starts with a conversation. Jamf reviews every application so we can point you at the right products, the right APIs and the right people before you write any code.

• Submit your application through the Technology Partner Program page.
• Complete your introduction and discovery call with the Jamf partner team.
• Execute your partnership agreement.
• Review the Jamf API License Agreement, which governs your use of Jamf APIs.
• Confirm your team has access to Jamf Account with partner privileges.

Jamf Account is where the rest of this journey happens. It holds your environments, your API integrations and your licensing, so make sure the right people on your team can sign in before you move on.

Phase 2: Set up your development environment

You need a live Jamf environment and at least one enrolled device to build and test against. Partners provision their own, so you are not waiting on anyone.

Create your not-for-resale tenant

A not-for-resale (NFR) tenant is a full Jamf environment for internal development, testing and demos. You create it yourself in Jamf Account.

1. Sign in to Jamf Account and go to Solutions.
2. Click Create NFR tenant.
3. Choose the tenant type and the customer experience you want to mirror.
4. Add a tenant name and contact email.
5. Click Create tenant.

Full instructions are in Creating a Not-For-Resale Tenant.

Enroll a device and add test data

• Enroll at least one Mac, iPhone or iPad computer into your tenant. See the Jamf Pro Device Enrollment Guide.
• Populate test inventory so your integration has something to read. See Populating Dummy Data.

Get your team up to speed

• Work through the device management fundamentals in the Jamf Training Catalog. Jamf 100 is the recommended starting point for whoever administers your tenant.
• Bookmark the Jamf Learning Hub for product documentation.
• Join the Jamf Nation developer community to compare notes with other developers.

Phase 3: Create your API integration

Build on the Platform API Gateway. It is one entry point for every Jamf API: you create a single integration in Jamf Account, grant it the capabilities it needs, and use one set of credentials to reach blueprints, device inventory, Jamf Pro, Jamf Security Cloud and the rest of the platform. One permission model covers all of them.

This replaces the old pattern of separate credentials and separate privilege models per product. It also means the capabilities you grant are the record of what your integration can do, so there is no separate privilege mapping exercise.

Create the integration

1. Sign in to Jamf Account and select Integrations.
2. Click Create integration and name it.
3. Set the scope level to organization management, platform environment or tenant, then select what it applies to.
4. Assign permissions by browsing capabilities. Grant only what your integration needs.
5. Click Create integration, then store your client secret. It appears once.

Which scope level to pick, where to find your base URL, how to exchange credentials for a token and how to pass tenant and environment context in headers are all covered in Getting started with the Platform API Gateway.

• Created your integration in Jamf Account and stored the client secret.
• Made a successful authenticated API call.
• Reviewed Platform API fundamentals for regions, permissions, pagination and error handling.
• Planned for credential rotation. Integrations are valid for six months, and access tokens expire after 900 seconds.
• Granted least privilege. Audit your capability list before you ship.

Already built on a product API?

If your integration predates the Platform API Gateway and calls the Jamf Pro API, the Classic API or the Jamf Protect API directly, Move an existing integration to the Platform API Gateway covers what to change. The Jamf Pro permissions map translates old privilege names into their capability equivalents.

Tools that do the wiring for you

• Jamf Platform Terraform provider for infrastructure as code.
• jamf-cli handles base URLs, context headers, token exchange and pagination automatically. Install it with brew install Jamf-Concepts/tap/jamf-cli.
• Jamf's MCP server puts these API docs inside your AI coding assistant. See Start building with AI.

Phase 4: Build to Jamf's requirements

Every integration listed on the Jamf Marketplace meets these requirements. Three are non-negotiable.

• Required: Send a unique User-Agent header on every API request. Use the form <product_name>/<product_version> <comment>, and percent-encode any spaces. See Application Header Best Practices, then email [email protected] to confirm your value.
• Required: Follow the Jamf Pro API scalability best practices. Your integration shares an environment with everyone else's.
• Required: Your integration must not interfere with native Jamf workflows or features. Adding to, augmenting or supplementing them is welcome. Replacing or breaking them is not.
• Handle rate limits, pagination and error responses gracefully.
• Send an Accept header when an API can return more than one format.

Configuration integrations

If your integration uses Managed App Configuration or Jamf Pro's Apps & Custom Settings features, complete these as well.

• Required: Your application is publicly available through Apple's App Store or a B2B program.
• Required: All available application settings are publicly documented.
• Apps supporting Managed App Configuration have a specification file generated and published. See Managed App Configuration Best Practices.
• macOS applications have a settings schema published for Application & Custom Settings.

Building for Jamf School

Jamf School has its own API, which sits outside the Platform API Gateway today. If your integration targets education customers on Jamf School, start with the Jamf School API guide and talk to [email protected] about the right approach.

Phase 5: Document your integration

Deployment guides are how IT administrators actually get your product running. A clear one shortens every deployment, and a vague one generates support tickets for both of us.

Read Deployment Guide Best Practices, then validate your workflow on the device you enrolled in Phase 2 before you write anything down.

• Documentation includes current screenshots from both the Jamf and vendor applications.
• Documentation states minimum supported versions for both the Jamf and vendor applications.
• Documentation includes contact information for vendor support.
• Every applicable setting, script or attachment is easy to copy or download from the documentation.
• You validated the whole workflow end to end on a real enrolled device.

Phase 6: Launch on the Jamf Marketplace

The Jamf Marketplace is where Jamf customers, prospects, sellers and resellers discover what you built.

• Read Creating your Marketplace Listing and draft your content.
• Submit your listing at jamf.it/GetListed. See Submit your Marketplace Listing.
• Complete a technical review of your solution with your Jamf partner engineer.
• Share your roadmap or project plan and timeline with your Jamf partner manager.
• Agree on a launch plan with your Solution Partner Manager.
• Discuss go-to-market activities: guest blogs, JNUC, joint webinars and market awareness support.
• Schedule a recurring checkpoint with your Jamf partner manager and engineer.

Support and contacts

Reference