Jamf Protect - Types

Objects, input objects, enums, and scalars in the Jamf Protect schema

The schema defines 29 objects, 42 input objects, 16 enums, 8 scalars, 0 interfaces, and 0 unions.

📘
Type notation: [X] is a list of X; ! means non-null (required). For example, [Alert!]! is a required list of non-null Alert objects.

Objects

Alert

An Alert associated with a specific Computer

Field	Type	Description
`computer`	`Computer`	The computer on which the alert was raised.
`created`	`AWSDateTime`	When Jamf Protect created the alert record.
`updated`	`AWSDateTime`	When the record was last updated (ISO 8601 timestamp).
`received`	`AWSDateTime`	When the event was received by Jamf Protect Cloud.
`eventTimestamp`	`AWSDateTime`	When the underlying event occurred on the device.
`id`	`ID`	Unique identifier of the record.
`uuid`	`ID`	Unique identifier (UUID) of the record.
`status`	`ALERT_STATUS`	Triage state of the alert: `New`, `InProgress`, `Resolved`, or `AutoResolved`.
`severity`	`SEVERITY`	Severity assigned to the alert: `High`, `Medium`, `Low`, or `Informational`.
`actions`	`[String]`	Actions taken in response to the alert.
`tags`	`[String]`	Tags associated with the record.
`eventType`	`String`	The type of event that triggered the alert.
`plan`	`Plan`	The plan in effect on the computer when the alert was raised.
`json`	`AWSJSON`	The full raw event payload as JSON.

AlertConnection

A paginated list of alerts. Use pageInfo.next to page through results.

Field	Type	Description
`items`	`[Alert]`	Fields to return in a query about Alerts
`pageInfo`	`PageInfo`

Analytic

A rule that detects a threat or unwanted behavior on a Computer

Field	Type	Description
`actions`	`[String]`
`tenantActions`	`[AnalyticActions]`	Custom configured actions for the Analytic
`analyticActions`	`[AnalyticActions]`	Jamf configured actions for the Analytic
`categories`	`[String]`	The categories for the Analytic
`context`	`[AnalyticContext]`	Additional conditions the Analytic evaluates in addition to its predicate
`created`	`AWSDateTime`	Date when the Analytic was created
`description`	`String`	Metadata (short description) that identifies and explains the function of the Analytic
`longDescription`	`String`	Long description that identifies and explains the function of the Analytic
`jamf`	`Boolean`	A boolean that specifies whether the Analytic is managed by Jamf
`startup`	`Boolean`	A boolean that specifies whether the analytic runs only after monitor startup
`filter`	`String`	The Analytic's predicate filter
`hash`	`String`	The hash value the Analytic
`inputType`	`String`	The event (sensor) type used by an Analytic, which determines the event types it monitors
`level`	`Int`	The Analytic's level, which determines the order in which Analytics run
`name`	`String`	The name of the Analytic, used as a key
`label`	`String`	The long form name of the Analytic, not used as a key
`snapshotFiles`	`[String]`	Specific files to monitor for changes
`tags`	`[String]`	Additional event-based identifiers for this Analytic
`updated`	`AWSDateTime`	Date when the Analytic was last updated
`uuid`	`ID`	A unique identifier assigned by Jamf Protect
`version`	`Int`	The version of the Analytic
`severity`	`SEVERITY`	A rank of how severe the issue is
`tenantSeverity`	`SEVERITY`	severity set by the tenant
`remediation`	`String`	Remediation details
`matchReason`	`String`	Human readable reason for alert
`osVersion`	`MinMaxVersion`	OS versions this analytic is limited to running on
`extVersion`	`MinMaxVersion`	Jamf Protect Extention versions this analytic is limited to running on

AnalyticActions

How Jamf Protect should respond to a specific Analytic returning 'True'

Field	Type	Description
`name`	`String`	Human-readable name.
`parameters`	`AWSJSON`

AnalyticConnection

A paginated list of analytics.

Field	Type	Description
`items`	`[Analytic]`	Fields to return in a query about Analytics
`pageInfo`	`PageInfo`

AnalyticContext

Additional conditions that an Analytic evaluates in addition to its core rule logic

Field	Type	Description
`exprs`	`[String]`
`name`	`String`	Human-readable name.
`type`	`String`

AnalyticSet

Field	Type	Description
`uuid`	`ID!`	Unique identifier (UUID) of the record.
`name`	`String!`	Human-readable name.
`description`	`String`	Human-readable description.
`analytics`	`[Analytic!]`
`plans`	`[Plan!]`
`created`	`AWSDateTime!`	When the record was created (ISO 8601 timestamp).
`updated`	`AWSDateTime!`	When the record was last updated (ISO 8601 timestamp).
`managed`	`Boolean!`
`types`	`[ANALYTIC_SET_TYPE!]`

AuditLog

A record of an administrative action performed in Jamf Protect.

Field	Type	Description
`date`	`AWSDateTime`	When the action occurred.
`args`	`AWSJSON`	Arguments supplied with the operation, as JSON.
`error`	`String`	Error message, if the operation failed.
`ips`	`String`	Source IP address(es) of the request.
`op`	`String`	The operation performed.
`user`	`String`	The user who performed the action.
`resourceId`	`String`	Identifier of the resource acted on.

AuditLogConnection

A paginated list of audit log entries. Use pageInfo.next to page through results.

Field	Type	Description
`items`	`[AuditLog]`	The audit log entries returned for this page.
`pageInfo`	`PageInfo`

CisId

Field	Type	Description
`osVersion`	`String`
`id`	`String`	Unique identifier of the record.

ComplianceInfo

Field	Type	Description
`label`	`String`	Custom label applied to the record.
`description`	`String`	Human-readable description.
`section`	`String`
`enabled`	`Boolean`	A boolean that specifies whether the Insight is enabled in Jamf Protect
`tags`	`[String]`	Tags for the Insight, such as the CIS Level
`cisid`	`[CisId]`

Computer

A macOS Computer reporting information via the Jamf Protect agent

Field	Type	Description
`arch`	`String`	Processor architecture type of the Computer
`certid`	`String!`	Certificate ID of the Computer
`configHash`	`String`	Hash of the config assigned to the computer
`created`	`AWSDateTime`	Date of the first connection with Jamf Protect
`hostName`	`String`	Hostname
`kernelVersion`	`String`	Kernel version
`memorySize`	`Float`	RAM size
`modelName`	`String`	Hardware Model Name
`osMajor`	`Int`	Major macOS version
`osMinor`	`Int`	Minor macOS Version
`osPatch`	`Int`	Patch macOS Version
`osString`	`String`	Complete macOS version as the string
`plan`	`Plan`	Plan assigned to the Computer
`serial`	`String`	Serial number of the Computer
`updated`	`AWSDateTime`	Date of the most recent connection with Jamf Protect
`uuid`	`ID!`	Device ID assigned by Jamf Protect
`version`	`String`	Current Jamf Protect agent version
`insights`	`AWSJSON`	Raw Insights data collected by the agent
`insightsStatsFail`	`Int`	Number of Insights with failing status
`insightsStatsPass`	`Int`	Number of Insights with passing status
`insightsStatsUnknown`	`Int`	Number of Insights with unknown status
`scorecard`	`[ComputerInsight]`	Insights compliance report for the Computer
`insightsUpdated`	`AWSDateTime`	Date of the last Insights check-in
`checkin`	`String`	Date of the last agent check-in
`signaturesVersion`	`Int`	Current Threat Prevention database version
`label`	`String`	Labels given to the Computer
`tags`	`[String]`	Tags given to the Computer
`provisioningUDID`	`String`	Provisioning UDID of the Computer
`installType`	`COMPUTER_INSTALL_TYPE_ENUM!`	Install Type given to the Computer
`connectionStatus`	`COMPUTER_CONNECTION_STATUS_ENUM`	Connection status of the Computer
`lastConnection`	`AWSDateTime`	Time of the Computer's last connection to Jamf Cloud's Protect endpoints
`lastConnectionIp`	`String`	Computer's last connection IP
`lastDisconnection`	`AWSDateTime`	Time of the Computer's last disconnection from Jamf Cloud's Protect endpoints
`lastDisconnectionReason`	`String`	Reason that the Computer disconnected
`webProtectionActive`	`Boolean`	Whether web threat protection is active on the device.
`fullDiskAccess`	`FULL_DISK_ACCESS_STATUS!`	Extension client's full disk access state

ComputerConnection

A paginated list of computers. Use pageInfo.next to page through results.

Field	Type	Description
`items`	`[Computer]`	Fields to return in a query about Computers
`pageInfo`	`PageInfo`

ComputerInsight

A specific Computer's status for a specific Insight

Field	Type	Description
`uuid`	`ID`	A unique identifier assigned by Jamf Protect
`label`	`String`	The title of the Insight
`description`	`String`	The description of the Insight
`section`	`String`	The category of the Insight
`pass`	`Boolean`	A boolean that specifies whether a Computer is compliant with the Insight
`tags`	`[String]`	Tags for the Insight, such as the CIS Level
`enabled`	`Boolean`	A boolean that specifies whether the Insight is enabled in Jamf Protect

ComputerTimeline

Field	Type	Description
`downloadUrl`	`String!`

Connection

Field	Type	Description
`id`	`ID!`	Unique identifier of the record.
`name`	`String!`	Human-readable name.
`created`	`AWSDateTime!`	When the record was created (ISO 8601 timestamp).
`updated`	`AWSDateTime!`	When the record was last updated (ISO 8601 timestamp).

Insight

A specific macOS setting that Jamf Protect is monitoring for compliance

Field	Type	Description
`uuid`	`ID`	A unique identifier assigned by Jamf Protect
`label`	`String`	The title of the Insight
`description`	`String`	The description of the Insight
`section`	`String`	The category of the Insight
`totalPass`	`Int`	Total number of Computers in compliance with the Insight
`totalFail`	`Int`	Total number of Computers that are out of compliance with the Insight
`totalNone`	`Int`	Total number of Computers with unknown status for the Insight
`tags`	`[String]`	Tags for the Insight, such as the CIS Level
`enabled`	`Boolean`	A boolean that specifies whether the Insight is enabled in Jamf Protect

MinMaxVersion

A version tuple that shows min and max ends of a range

Field	Type	Description
`min`	`String`
`max`	`String`

PageInfo

Pagination metadata for a list response.

Field	Type	Description
`next`	`String`	Opaque cursor for the next page; `null` when there are no more results.
`total`	`Int`	Total number of records matching the query.

Plan

A comprehensive security configuration that includes Analytics, an Action Configuration, and check-in settings

Field	Type	Description
`analytics`	`[Analytic!]`	Analytics added to the Plan
`analyticSets`	`[PlanAnalyticSet!]`	Analytic Sets added to the Plan
`created`	`AWSDateTime`	Date when the Plan was created
`description`	`String`	Description of the Plan
`hash`	`String`	The hash of the Plan
`id`	`ID!`	A unique identifier assigned by Jamf Protect
`uuid`	`ID`	A globally unique identifier assigned by Jamf Protect
`name`	`String`	The name of the Plan
`updated`	`AWSDateTime`	Date when the Plan was last updated
`logLevel`	`LOG_LEVEL_ENUM`	The log level used by Computers with this Plan

PlanAnalyticSet

Field	Type	Description
`type`	`ANALYTIC_SET_TYPE!`
`analyticSet`	`AnalyticSet!`

PlanConnection

A paginated list of plans. Use pageInfo.next to page through results.

Field	Type	Description
`items`	`[Plan]`	Fields to return in a query about Plans
`pageInfo`	`PageInfo`

PreventList

A Custom Prevent List with hash or signing information associated with processes that Jamf Protect should block

Field	Type	Description
`id`	`ID`	A unique identifier assigned by Jamf Protect
`created`	`AWSDateTime`	Date when the Custom Prevent List was created
`name`	`String`	The name of the Custom Prevent List
`tags`	`[String]`	Tags assigned to the Custom Prevent List
`type`	`PREVENT_LIST_TYPE`	The Prevent List type, which be file hash or signing information based
`list`	`[String]`	Custom Prevent List data containing values associated with processes that should be blocked
`count`	`Int`	The total number of listed values in a specific Custom Prevent List
`description`	`String`	Additional information about the Custom Prevent List

PreventListConnection

A paginated list of prevent lists. Use pageInfo.next to page through results.

Field	Type	Description
`items`	`[PreventList]`	Fields to return in a query about Custom Prevent Lists
`pageInfo`	`PageInfo`

ThreatPreventionVersion

A version of the Jamf Protect threat database

Field	Type	Description
`id`	`ID`	Unique identifier of the record.
`created`	`AWSDateTime`	When the record was created (ISO 8601 timestamp).

UnifiedLoggingFilter

A predicate-based filter for the macOS Unified Logging system

Field	Type	Description
`uuid`	`ID`	A unique identifier assigned by Jamf Protect
`name`	`String`	The name of a specific Unified Logging filter
`description`	`String`	An optional description of the Unified Logging filter
`created`	`AWSDateTime`	Date when the Unified Logging filter was created
`updated`	`AWSDateTime`	Date when the Unified Logging filter was last updated
`filter`	`String`	The predicate-based filter
`tags`	`[String]`	Tags assigned to the Unified Logging filter
`enabled`	`Boolean`	Boolean value indicating whether the filter is enabled

UnifiedLoggingFilterConnection

Field	Type	Description
`items`	`[UnifiedLoggingFilter]`	Fields to return in a query about Unified Log filters
`pageInfo`	`PageInfo`

User

Field	Type	Description
`id`	`ID!`	Unique identifier of the record.
`email`	`String`
`sub`	`String`
`connection`	`Connection`
`lastLogin`	`AWSDateTime`
`created`	`AWSDateTime!`	When the record was created (ISO 8601 timestamp).
`updated`	`AWSDateTime!`	When the record was last updated (ISO 8601 timestamp).

UserConnection

Field	Type	Description
`items`	`[User]`	The records returned for this page.
`pageInfo`	`PageInfo`

Input Objects

AlertFiltersInput

Field	Type	Description
`actions`	`TableStringArrayFilterInput`
`analytics`	`TableStringArrayFilterInput`
`computer`	`TableStringFilterInput`
`computerUuid`	`TableIdFilterInput`
`created`	`TableDatetimeFilterInput`	When the record was created (ISO 8601 timestamp).
`updated`	`TableDatetimeFilterInput`	When the record was last updated (ISO 8601 timestamp).
`eventType`	`TableStringFilterInput`
`plan`	`TableIdFilterInput`
`severity`	`TableSeverityFilterInput`
`status`	`TableStringFilterInput`
`tags`	`TableStringArrayFilterInput`	Tags associated with the record.
`or`	`[AlertFiltersInput!]`
`and`	`[AlertFiltersInput!]`
`not`	`AlertFiltersInput`

AlertOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`AlertOrderField!`

AlertQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`AlertOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`pageSize`	`Int`	Maximum number of records to return in a single page.
`filter`	`AlertFiltersInput`	Field-level filter criteria. Combine conditions with `and`, `or`, and `not`.

AlertUpdateInput

Field	Type	Description
`uuids`	`[ID!]!`
`status`	`ALERT_STATUS!`

AnalyticSetInput

Field	Type	Description
`name`	`String!`	Human-readable name.
`description`	`String`	Human-readable description.
`analytics`	`[ID!]!`
`types`	`[ANALYTIC_SET_TYPE!]`

AuditLogsDateConditionInput

Field	Type	Description
`dateRange`	`AuditLogsDateRangeConditionInput`	Used to specify a date range for all results

AuditLogsDateQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`AuditLogsOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`condition`	`AuditLogsDateConditionInput`
`pageSize`	`Int`	Maximum number of records to return in a single page.

AuditLogsDateRangeConditionInput

Field	Type	Description
`startDate`	`AWSDateTime!`
`endDate`	`AWSDateTime!`

AuditLogsOpConditionInput

Field	Type	Description
`dateRange`	`AuditLogsOpDateRangeConditionInput`	Used to specify a date range for results for a specific operation. Cannot be combined with 'beginsWith'.
`beginsWith`	`String`	Used to specify an incomplete or complete 'op' attribute for results, unbounded by date (e.g. 'create', 'createPlan'). Cannot be combined with 'dateRange'.

AuditLogsOpDateRangeConditionInput

Field	Type	Description
`op`	`String!`	This must be a complete 'op' attribute (e.g. 'createPlan')
`startDate`	`AWSDateTime!`
`endDate`	`AWSDateTime!`

AuditLogsOpQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`AuditLogsOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`condition`	`AuditLogsOpConditionInput`
`pageSize`	`Int`	Maximum number of records to return in a single page.

AuditLogsOrderInput

Field	Type	Description
`direction`	`OrderDirection`

AuditLogsUserConditionInput

Field	Type	Description
		`dateRange`	`AuditLogsUserDateRangeConditionInput`	Used to specify a date range for results for a specific user. Cannot be combined with 'beginsWith'.
`beginsWith`	`String`	Used to specify an incomplete or complete 'user' attribute for results, unbounded by date (e.g. 'laszlo', '[email protected]', '[email protected]#oidc	IDP	0670348325'). Cannot be combined with 'dateRange'.

AuditLogsUserDateRangeConditionInput

Field	Type	Description
`user`	`String!`	This must be a complete 'user' attribute (e.g. '[email protected]#oidc	IDP	0670348325')
`startDate`	`AWSDateTime!`
`endDate`	`AWSDateTime!`

AuditLogsUserQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`AuditLogsOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`condition`	`AuditLogsUserConditionInput`
`pageSize`	`Int`	Maximum number of records to return in a single page.

ComputerEditableInput

Inputs which can be edited for computer records. Currently, just label and tags

Field	Type	Description
`label`	`String`	Custom label applied to the record.
`tags`	`[String]`	Tags associated with the record.

ComputerFieldInput

Field	Type	Description
`field`	`ComputerStatField`

ComputerFiltersInput

Field	Type	Description
`provisioningUDID`	`TableStringFilterInput`
`label`	`TableStringFilterInput`	Custom label applied to the record.
`version`	`TableStringFilterInput`
`checkin`	`TableDatetimeFilterInput`
`created`	`TableDatetimeFilterInput`	When the record was created (ISO 8601 timestamp).
`insightsUpdated`	`TableDatetimeFilterInput`
`hostName`	`TableStringFilterInput`
`modelName`	`TableStringFilterInput`
`serial`	`TableStringFilterInput`
`signaturesVersion`	`TableIntFilterInput`
`tags`	`TableStringArrayFilterInput`	Tags associated with the record.
`osMajor`	`TableIntFilterInput`
`osMinor`	`TableIntFilterInput`
`osPatch`	`TableIntFilterInput`
`scorecard`	`TableJsonFilterInput`
`insightsStatsFail`	`TableIntFilterInput`
`insightsStatsPass`	`TableIntFilterInput`
`insightsStatsUnknown`	`TableIntFilterInput`
`installType`	`TableStringFilterInput`
`connectionStatus`	`TableStringFilterInput`
`lastConnection`	`TableDatetimeFilterInput`
`lastDisconnection`	`TableDatetimeFilterInput`
`lastDisconnectionReason`	`TableStringFilterInput`
`webProtectionActive`	`TableBooleanFilterInput`
`fullDiskAccess`	`TableStringFilterInput`
`or`	`[ComputerFiltersInput!]`
`and`	`[ComputerFiltersInput!]`
`not`	`ComputerFiltersInput`

ComputerOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`[ComputerOrderField!]`

ComputerPlan

Field	Type	Description
`plan`	`ID!`

ComputerQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`ComputerOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`filter`	`ComputerFiltersInput`	Field-level filter criteria. Combine conditions with `and`, `or`, and `not`.
`pageSize`	`Int`	Maximum number of records to return in a single page.

ComputerTimelineInput

Field	Type	Description
`uuid`	`ID!`	uuid of selected computer (equivalent to the Client ID or Device ID)
`startDate`	`AWSDate!`	Data starting from and including this date will be included. YYYY-MM-DD
`endDate`	`AWSDate`	Optional (defaults to today). Data up to and including this date will be included. YYYY-MM-DD

PlanOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`PlanOrderField!`

PlanQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`PlanOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`pageSize`	`Int`	Maximum number of records to return in a single page.

PreventListFilterInput

Field	Type	Description
`name`	`TableStringFilterInput`	Human-readable name.
`created`	`TableDatetimeFilterInput`	When the record was created (ISO 8601 timestamp).
`tags`	`TableStringArrayFilterInput`	Tags associated with the record.
`or`	`[PreventListFilterInput!]`
`and`	`[PreventListFilterInput!]`
`not`	`PreventListFilterInput`

PreventListInput

Field	Type	Description
`description`	`String`	Human-readable description.
`list`	`[String]!`
`name`	`String!`	Human-readable name.
`tags`	`[String]!`	Tags associated with the record.
`type`	`PREVENT_LIST_TYPE!`

PreventListOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`PreventListOrderField!`

PreventListQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`PreventListOrderInput!`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`pageSize`	`Int`	Maximum number of records to return in a single page.
`filter`	`PreventListFilterInput`	Field-level filter criteria. Combine conditions with `and`, `or`, and `not`.

TableBooleanFilterInput

A filter used for boolean fields.

Field	Type	Description
`isNull`	`Boolean`
`equals`	`Boolean`

TableDatetimeFilterInput

Field	Type	Description
`isNull`	`Boolean`
`equals`	`AWSDateTime`
`notEqual`	`AWSDateTime`
`lessThanOrEqual`	`AWSDateTime`
`lessThan`	`AWSDateTime`
`greaterThanOrEqual`	`AWSDateTime`
`greaterThan`	`AWSDateTime`
`beforeInterval`	`String`
`afterInterval`	`String`

TableIdFilterInput

A filter used for id fields.

Field	Type	Description
`isNull`	`Boolean`
`equals`	`String`
`notEqual`	`String`

TableIntFilterInput

Field	Type	Description
`isNull`	`Boolean`
`equals`	`Int`
`notEqual`	`Int`
`lessThanOrEqual`	`Int`
`lessThan`	`Int`
`greaterThanOrEqual`	`Int`
`greaterThan`	`Int`

TableJsonFilterInput

Field	Type	Description
`jsonContains`	`AWSJSON`
`jsonContainsKey`	`String`
`jsonContainsAllKeys`	`[String!]`
`jsonContainsAnyKeys`	`[String!]`
`jsonContainedBy`	`AWSJSON`

TableSeverityFilterInput

Field	Type	Description
`equals`	`SEVERITY`
`notEqual`	`SEVERITY`
`lessThanOrEqual`	`SEVERITY`
`lessThan`	`SEVERITY`
`greaterThanOrEqual`	`SEVERITY`
`greaterThan`	`SEVERITY`

TableStringArrayFilterInput

Field	Type	Description
`includes`	`[String]`

TableStringFilterInput

A filter used for string fields. Fields are combined with an 'AND' operator

Field	Type	Description
`isNull`	`Boolean`
`equals`	`String`
`notEqual`	`String`
`lessThanOrEqual`	`String`
`lessThan`	`String`
`greaterThanOrEqual`	`String`
`greaterThan`	`String`
`startsWith`	`String`
`endsWith`	`String`
`contains`	`String`
`notContains`	`String`
`in`	`[String]`
`notIn`	`[String]`

UnifiedLoggingFilterInput

Field	Type	Description
`name`	`String!`	Human-readable name.
`description`	`String`	Human-readable description.
`filter`	`String!`	Field-level filter criteria. Combine conditions with `and`, `or`, and `not`.
`tags`	`[String]!`	Tags associated with the record.
`enabled`	`Boolean`

UnifiedLoggingFiltersFilterInput

Field	Type	Description
`name`	`TableStringFilterInput`	Human-readable name.
`description`	`TableStringFilterInput`	Human-readable description.
`created`	`TableDatetimeFilterInput`	When the record was created (ISO 8601 timestamp).
`tags`	`TableStringArrayFilterInput`	Tags associated with the record.
`or`	`[UnifiedLoggingFiltersFilterInput!]`
`and`	`[UnifiedLoggingFiltersFilterInput!]`
`not`	`UnifiedLoggingFiltersFilterInput`

UnifiedLoggingFiltersListQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`UnifiedLoggingFiltersOrderInput!`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`pageSize`	`Int`	Maximum number of records to return in a single page.
`filter`	`UnifiedLoggingFiltersFilterInput`	Field-level filter criteria. Combine conditions with `and`, `or`, and `not`.

UnifiedLoggingFiltersOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`UnifiedLoggingFiltersOrderField!`

UserOrderInput

Field	Type	Description
`direction`	`OrderDirection!`
`field`	`UserOrderField!`

UserQueryInput

Field	Type	Description
`next`	`String`	Pagination cursor from a previous response's `pageInfo.next`; omit on the first request.
`order`	`UserOrderInput`	Sort field and direction (`ASC`/`DESC`) to apply to the results.
`pageSize`	`Int`	Maximum number of records to return in a single page.

Enums

ALERT_STATUS

The triage state of an alert.

Value	Description
`New`	Newly raised and not yet triaged.
`InProgress`	Under investigation.
`Resolved`	Manually resolved by an administrator.
`AutoResolved`	Automatically resolved by Jamf Protect.

AlertOrderField

Value	Description
`status`
`severity`
`computer`
`created`
`updated`
`actions`

ANALYTIC_SET_TYPE

Value	Description
`Prevent`
`Report`

COMPUTER_CONNECTION_STATUS_ENUM

Value	Description
`Connected`
`Disconnected`

COMPUTER_INSTALL_TYPE_ENUM

Value	Description
`daemon`
`systemExtension`

ComputerOrderField

Value	Description
`created`
`checkin`
`hostName`
`modelName`
`serial`
`plan`
`version`
`label`
`osMajor`
`osMinor`
`osPatch`
`insightsUpdated`
`signaturesVersion`
`insightsStatsFail`
`insightsStatsPass`
`insightsStatsUnknown`
`installType`
`connectionStatus`
`lastConnection`
`lastDisconnection`
`lastDisconnectionReason`
`webProtectionActive`
`fullDiskAccess`

ComputerStatField

Value	Description
`modelName`
`osString`
`version`
`macosVersion`
`tags`
`label`
`signaturesVersion`
`fullDiskAccess`

FULL_DISK_ACCESS_STATUS

Value	Description
`Authorized`
`Unauthorized`
`Unknown`

LOG_LEVEL_ENUM

Value	Description
`ERROR`
`WARNING`
`INFO`
`DEBUG`
`VERBOSE`

OrderDirection

Value	Description
`ASC`
`DESC`

PlanOrderField

Value	Description
`created`
`updated`
`name`

PREVENT_LIST_TYPE

The kind of identifier used in a prevent list.

Value	Description
`TEAMID`	Apple Developer Team ID.
`FILEHASH`	SHA-256 hash of a file.
`CDHASH`	Code directory hash of a binary.
`SIGNINGID`	Code signing identifier.

PreventListOrderField

Value	Description
`created`
`name`
`count`

SEVERITY

Severity level assigned to an alert or analytic.

Value	Description
`High`	High severity, likely malicious or high-impact activity.
`Medium`	Medium severity, suspicious activity warranting review.
`Low`	Low severity, low-risk or informational-leaning activity.
`Informational`	Informational, no risk implied; useful for visibility.

UnifiedLoggingFiltersOrderField

Value	Description
`created`
`name`
`description`
`enabled`
`updated`

UserOrderField

Value	Description
`email`
`sub`
`connection`
`lastLogin`
`created`
`updated`

Scalars

Scalar	Description
`AWSDate`	The `AWSDate` scalar type provided by AWS AppSync, represents a valid *extended* ISO 8601 Date string. In other words, this scalar type accepts date strings of the form `YYYY-MM-DD`. The scalar can also accept "negative years" of the form `-YYYY` which correspond to years before `0000`. For example, "-2017-05-01" and "-9999-01-01" are both valid dates. This scalar type can also accept an optional time zone offset. For example, "1970-01-01", "1970-01-01Z", "1970-01-01-07:00" and "1970-01-01+05:30" are all valid dates. The time zone offset must either be `Z` (representing the UTC time zone) or be in the format `±hh:mm:ss`. The seconds field in the timezone offset will be considered valid even though it is not part of the ISO 8601 standard.
`AWSDateTime`	The `AWSDateTime` scalar type provided by AWS AppSync, represents a valid *extended* ISO 8601 DateTime string. In other words, this scalar type accepts datetime strings of the form `YYYY-MM-DDThh:mm:ss.SSSZ`. The scalar can also accept "negative years" of the form `-YYYY` which correspond to years before `0000`. For example, "-2017-01-01T00:00Z" and "-9999-01-01T00:00Z" are both valid datetime strings. The field after the two digit seconds field is a nanoseconds field. It can accept between 1 and 9 digits. So, for example, "1970-01-01T12:00:00.2Z", "1970-01-01T12:00:00.277Z" and "1970-01-01T12:00:00.123456789Z" are all valid datetime strings. The seconds and nanoseconds fields are optional (the seconds field must be specified if the nanoseconds field is to be used). The time zone offset is compulsory for this scalar. The time zone offset must either be `Z` (representing the UTC time zone) or be in the format `±hh:mm:ss`. The seconds field in the timezone offset will be considered valid even though it is not part of the ISO 8601 standard.
`AWSJSON`	The `AWSJSON` scalar type provided by AWS AppSync, represents a JSON string that complies with RFC 8259. Maps like "{\"upvotes\": 10}", lists like "[1,2,3]", and scalar values like "\"AWSJSON example string\"", "1", and "true" are accepted as valid JSON and will automatically be parsed and loaded in the resolver mapping templates as Maps, Lists, or Scalar values rather than as the literal input strings. Invalid JSON strings like "{a: 1}", "{'a': 1}" and "Unquoted string" will throw GraphQL validation errors.
`Boolean`	The `Boolean` scalar type represents `true` or `false`.
`Float`	The `Float` scalar type represents signed double-precision fractional values as specified by IEEE 754.
`ID`	The `ID` scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as `"4"`) or integer (such as `4`) input value will be accepted as an ID.
`Int`	The `Int` scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.
`String`	The `String` scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

Jamf Protect API: Overview · Queries · Mutations · Types · Example Calls · Schema (SDL)

Type notation: [X] is a list of X; ! means non-null (required). For example, [Alert!]! is a required list of non-null Alert objects.

Objects

Alert

AlertConnection

Analytic

AnalyticActions

AnalyticConnection

AnalyticContext

AnalyticSet

AuditLog

AuditLogConnection

CisId

ComplianceInfo

Computer

ComputerConnection

ComputerInsight

ComputerTimeline

Connection

Insight

MinMaxVersion

PageInfo

Plan

PlanAnalyticSet

PlanConnection

PreventList

PreventListConnection

ThreatPreventionVersion

UnifiedLoggingFilter

UnifiedLoggingFilterConnection

User

UserConnection

Input Objects

AlertFiltersInput

AlertOrderInput

AlertQueryInput

AlertUpdateInput

AnalyticSetInput

AuditLogsDateConditionInput

AuditLogsDateQueryInput

AuditLogsDateRangeConditionInput

AuditLogsOpConditionInput

AuditLogsOpDateRangeConditionInput

AuditLogsOpQueryInput

AuditLogsOrderInput

AuditLogsUserConditionInput

AuditLogsUserDateRangeConditionInput

AuditLogsUserQueryInput

ComputerEditableInput

ComputerFieldInput

ComputerFiltersInput

ComputerOrderInput

ComputerPlan

ComputerQueryInput

ComputerTimelineInput

PlanOrderInput

PlanQueryInput

PreventListFilterInput

PreventListInput

PreventListOrderInput

PreventListQueryInput

TableBooleanFilterInput

TableDatetimeFilterInput

TableIdFilterInput

TableIntFilterInput

TableJsonFilterInput

TableSeverityFilterInput

TableStringArrayFilterInput

TableStringFilterInput

UnifiedLoggingFilterInput

UnifiedLoggingFiltersFilterInput

UnifiedLoggingFiltersListQueryInput

UnifiedLoggingFiltersOrderInput

UserOrderInput

UserQueryInput

Enums

ALERT_STATUS

AlertOrderField

ANALYTIC_SET_TYPE

COMPUTER_CONNECTION_STATUS_ENUM

COMPUTER_INSTALL_TYPE_ENUM

Type notation: `[X]` is a list of `X`; `!` means non-null (required). For example, `[Alert!]!` is a required list of non-null `Alert` objects.