Get the AI finding an AI tools ticket was opened for

curl --request GET \
  --url https://api.getprimo.com/ai-tools/tickets/{ticketId}/details \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.getprimo.com/ai-tools/tickets/{ticketId}/details', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.getprimo.com/ai-tools/tickets/{ticketId}/details")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "rule": "<string>",
  "severity": "critical",
  "severityLabel": "<string>",
  "title": "<string>",
  "description": "<string>",
  "ticket": {
    "ticketId": "<string>",
    "ticketReference": "<string>",
    "deviceId": "<string>",
    "rule": "<string>",
    "findingKey": "<string>",
    "openedBy": "policy",
    "openedAt": "<string>",
    "closedAt": "<string>",
    "closeReason": "<string>"
  },
  "device": {
    "deviceId": "<string>",
    "deviceName": "<string>",
    "serialNumber": "<string>",
    "platform": "ANDROID",
    "ownerId": "<string>",
    "ownerName": "<string>"
  },
  "finding": {
    "rule": "<string>",
    "severity": "critical",
    "severityLabel": "<string>",
    "title": "<string>",
    "description": "<string>",
    "findingKey": "<string>",
    "reportedAt": "<string>",
    "subjectType": "tool",
    "subjectName": "<string>",
    "toolKey": "<string>",
    "toolKind": "assistant_app",
    "evidence": {
      "secretEnvKeys": [
        "<string>"
      ],
      "runtimeFlags": [
        "<string>"
      ],
      "permissionMode": "<string>",
      "markers": [
        "<string>"
      ],
      "capabilities": [
        "<string>"
      ],
      "fromWebstore": true,
      "signedState": "<string>"
    },
    "path": "<string>",
    "policy": {
      "status": "not_reviewed",
      "source": "default",
      "decidedAt": "<string>"
    }
  }
}

AiTools

Get the AI finding an AI tools ticket was opened for

Start here when working an AI tools ticket: it answers what the ticket is about. Return as JSON the device and its owner, the rule (code, title, description, severity), the one finding the ticket tracks as the device still reports it, with what it is on, its evidence (what fleetd saw behind it: runtimeFlags null when the agent’s command line was not seen, fromWebstore: true a store extension a policy or another program installed), its path (the home folder written ~) and the tool’s policy, and the ticket itself: who opened it (policy, admin, agent) and, once Primo closed it, when and why. Its comments and status are getTicket. A 404 is final: the ticket is not an AI tools ticket, or the device no longer reports its finding (Primo then closes the ticket on the next sync); a retry returns the same 404. For the whole inventory of the device, getAiToolsDevice. AI tools are what Primo finds on Macs (assistant apps, coding agents, IDE plugins, browser extensions, MCP servers, AI connections, agent instruction files), as of the last sync (lastSyncedAt of getAiToolsOverview), with Primo’s severities, less the findings the company’s AI tools settings ignore. They are not the software catalog (getSoftwares, getDeviceSoftware), the company’s own AI agents (listAgents) nor AI credits (getAiUsage). A company without AI tools monitoring gets a 403, final.

GET

ai-tools

tickets

{ticketId}

details

Get the AI finding an AI tools ticket was opened for

curl --request GET \
  --url https://api.getprimo.com/ai-tools/tickets/{ticketId}/details \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.getprimo.com/ai-tools/tickets/{ticketId}/details', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.getprimo.com/ai-tools/tickets/{ticketId}/details"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.getprimo.com/ai-tools/tickets/{ticketId}/details")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "rule": "<string>",
  "severity": "critical",
  "severityLabel": "<string>",
  "title": "<string>",
  "description": "<string>",
  "ticket": {
    "ticketId": "<string>",
    "ticketReference": "<string>",
    "deviceId": "<string>",
    "rule": "<string>",
    "findingKey": "<string>",
    "openedBy": "policy",
    "openedAt": "<string>",
    "closedAt": "<string>",
    "closeReason": "<string>"
  },
  "device": {
    "deviceId": "<string>",
    "deviceName": "<string>",
    "serialNumber": "<string>",
    "platform": "ANDROID",
    "ownerId": "<string>",
    "ownerName": "<string>"
  },
  "finding": {
    "rule": "<string>",
    "severity": "critical",
    "severityLabel": "<string>",
    "title": "<string>",
    "description": "<string>",
    "findingKey": "<string>",
    "reportedAt": "<string>",
    "subjectType": "tool",
    "subjectName": "<string>",
    "toolKey": "<string>",
    "toolKind": "assistant_app",
    "evidence": {
      "secretEnvKeys": [
        "<string>"
      ],
      "runtimeFlags": [
        "<string>"
      ],
      "permissionMode": "<string>",
      "markers": [
        "<string>"
      ],
      "capabilities": [
        "<string>"
      ],
      "fromWebstore": true,
      "signedState": "<string>"
    },
    "path": "<string>",
    "policy": {
      "status": "not_reviewed",
      "source": "default",
      "decidedAt": "<string>"
    }
  }
}

Key: Read Scope: Company

Authorizations

Authorization

string

header

required

Use your Primo API key in the Authorization header as Bearer <API_KEY>.

Path Parameters

ticketId

string

required

Response

default - application/json

rule

string

required

Primo's code of the risk, e.g. plaintext_secret

severity

enum<string>

required

Primo's severity of the rule

Available options:

critical,

high,

medium,

low

severityLabel

string

required

The severity in words, e.g. Critical

title

string

required

What the rule means in a few words; the code itself for a rule Primo has not rated yet

description

string | null

required

One line on what the rule detects

ticket

object

required

Show child attributes

device

object

required

Show child attributes

finding

object

required

The finding the ticket tracks, as the device still reports it, with its path (the home folder written ~)

Show child attributes

Get started

API Reference

Get the AI finding an AI tools ticket was opened for

Authorizations

Path Parameters

Response