11.28.0 Changes

Smart Group criteria: stricter andOr validation in V2

The new UnifiedSmartGroupCriteriaV2, ComputerSmartGroupCriteriaV2, and MobileDeviceSmartGroupCriteriaV2 schemas validate andOr against an enum of and or or (case-insensitive). The legacy V1 SmartGroupCriteria schema accepted any string, which made silent misspellings possible. If you've been sending values like AND or Or, those still work; anything outside the enum will now be rejected on the V2 endpoints.

Static group assignments are now sets

StaticComputerGroupAssignment.assignments is now declared as uniqueItems: true. Sending the same computer ID twice in a single request is no longer meaningful — duplicates are collapsed.

Group names are capped at 255 characters

Static group and static computer group payloads now enforce maxLength: 255 on the name field. Existing groups longer than 255 characters (if any exist) will not be retroactively trimmed, but new and updated names must fit.

MembershipTestSearchResponse adds isMemberByUuid

Membership test responses now include both isMember and isMemberByUuid, giving you a UUID-based membership signal alongside the existing ID-based one.

EnableLostModeCommand documentation clarifications

The Lost Mode command schema now documents that at least one of lostModeMessage or lostModePhone must be provided, and the field-level descriptions explain what each value renders on the device's Lock Screen. The behavior is unchanged.

SettingsCommand.bootstrapTokenAllowed is deprecated

The bootstrapTokenAllowed field on SettingsCommand is now marked deprecated. macOS 11 and later manage bootstrap tokens automatically, so the field is no longer necessary. It remains functional for backward compatibility.