curl --request GET \
--url https://api.getprimo.com/compliance/alerts/{alertId}/details \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.getprimo.com/compliance/alerts/{alertId}/details"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.getprimo.com/compliance/alerts/{alertId}/details', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getprimo.com/compliance/alerts/{alertId}/details",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.getprimo.com/compliance/alerts/{alertId}/details"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.getprimo.com/compliance/alerts/{alertId}/details")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getprimo.com/compliance/alerts/{alertId}/details")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"alert": {
"id": "<string>",
"deviceId": "<string>",
"deviceName": "<string>",
"devicePlatform": "ANDROID",
"owner": {
"id": "<string>",
"firstName": "<string>",
"lastName": "<string>"
},
"complianceRuleId": "<string>",
"ruleType": "<string>",
"mdmControlId": "<string>",
"status": "ACTIVE",
"additionalStatus": "MALWAREBYTES_AGENT_NOT_INSTALLED",
"detail": "<string>",
"hasAlert": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"statusSince": "2023-11-07T05:31:56Z"
},
"mdmControl": {
"id": "<string>",
"name": "<string>",
"category": "<string>",
"type": "<string>",
"identifier": "<string>",
"enabled": true,
"profileFleetId": "<string>",
"configurationPayload": {}
},
"device": {
"fleet": {
"fleetHostId": 123,
"uuid": "<string>",
"displayName": "<string>",
"hardwareSerial": "<string>",
"status": "online",
"seenTime": "<string>",
"detailUpdatedAt": "<string>",
"refetchRequested": true,
"uptime": 123,
"lastRestartedAt": "<string>",
"orbitVersion": "<string>",
"platform": "<string>",
"osVersion": "<string>",
"build": "<string>",
"codeName": "<string>",
"gigsDiskSpaceAvailable": 123,
"mdm": {
"enrollmentStatus": "<string>",
"name": "<string>",
"serverUrl": "<string>",
"connectedToFleet": true,
"depProfileError": true,
"deviceStatus": "<string>",
"pendingAction": "<string>",
"lastEnrolledAt": "<string>",
"lastMdmEnrolledAt": "<string>",
"lastMdmCheckedInAt": "<string>"
},
"encryption": {
"diskEncryptionEnabled": true,
"encryptionKeyAvailable": true,
"osSettingsStatus": "<string>",
"osSettingsDetail": "<string>",
"appleActionRequired": "rotate_key"
},
"profiles": [
{
"profileUuid": "<string>",
"name": "<string>",
"status": "verified",
"operationType": "install",
"detail": "<string>",
"scope": "<string>"
}
],
"labelNames": [
"<string>"
],
"idpUsername": "<string>",
"idpFullName": "<string>",
"bootstrapPackageStatus": "<string>",
"bootstrapPackageDetail": "<string>"
},
"primo": {
"scriptsEnabled": true,
"naming": {
"name": "<string>",
"computerName": "<string>",
"hostname": "<string>",
"computerNameSuggestion": "<string>",
"hostnameSuggestion": "<string>",
"mdmCommandInProgress": true,
"lastMDMCommandRunAt": "<string>",
"aiSuggestionFailure": {
"attempts": 123,
"lastAttemptAt": "<string>",
"failureType": "EMPTY_OUTPUT",
"attemptedName": "<string>",
"conflictingDeviceId": "<string>"
}
},
"malwarebytes": {
"protectionStatus": "<string>",
"hasAgentInstalled": true,
"hasAlerts": true,
"lastActive": "<string>",
"lastScriptRunAt": "<string>"
},
"sentinelOne": {
"installed": true,
"registeredAt": "<string>",
"lastActiveDate": "<string>",
"scanFinishedAt": "<string>",
"uninstalledAt": "<string>",
"infected": true
},
"encryption": {
"encrypted": true,
"recoveryKeyRemotelyAvailable": true
},
"recoveryOsStatus": "<string>",
"localUsers": [
{
"id": "<string>",
"username": "<string>",
"rights": "<string>",
"accountType": "<string>",
"creationStatus": "<string>",
"creationSource": "<string>",
"groupName": "<string>",
"passwordChangePending": true,
"passwordChangedAt": "<string>",
"createdAt": "<string>"
}
]
}
},
"enforcement": {
"profile": {
"fleetId": "<string>",
"resendable": true,
"delivery": {
"profileUuid": "<string>",
"name": "<string>",
"status": "verified",
"operationType": "install",
"detail": "<string>",
"scope": "<string>"
},
"content": "<string>"
},
"script": {
"scriptId": 123,
"source": "<string>",
"lastExecution": {
"status": "ran",
"executedAt": "<string>",
"exitCode": 123,
"output": "<string>"
},
"policies": [
{
"id": 123,
"name": "<string>",
"query": "<string>",
"resolution": "<string>",
"response": "pass"
}
]
},
"software": {
"appId": "<string>",
"install": {
"softwareId": "<string>",
"softwareName": "<string>",
"status": "installed",
"installedVersion": "<string>",
"availableVersion": "<string>",
"lastInstalledAt": "2023-11-07T05:31:56Z"
}
},
"command": {
"id": "<string>",
"command": "<string>",
"status": "<string>",
"type": "<string>",
"source": "<string>",
"initiator": "<string>",
"remoteId": "<string>",
"payload": "<unknown>",
"result": "<unknown>",
"uuid": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}
}Get the full remediation context of one compliance alert
Return everything needed to diagnose and remediate one compliance alert (from getComplianceAlerts): the alert, the MDM control behind it with its configuration in clear, the device on both sides (device.fleet for the live MDM state — enrollment, last check-in, delivered profiles, failing checks; device.primo for what Primo tracks itself — naming, Malwarebytes, SentinelOne, encryption, local admin accounts), and enforcement, holding one key per artifact the control carries — a control can carry several. Other mcp tools at your disposal, per key: profile → resendDeviceProfile (only if profile.resendable); script → runDeviceScript with its scriptId; software → installDeviceSoftware with its install.softwareId (never appId, the MDM application id); command → syncPrimoDevice with forceEnforcerExecution. No key at all means the enforcement happens outside MDM — the evidence is in device.primo, and there is nothing to re-push. Remediation is asynchronous: re-read this same alert id once the device has checked in. A 404 means the check no longer applies to the device, not that the id expired, and is final. To read several alerts, use getComplianceAlertsDetails instead of one call per alert. For the full MDM command history, use getDeviceCommands.
curl --request GET \
--url https://api.getprimo.com/compliance/alerts/{alertId}/details \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.getprimo.com/compliance/alerts/{alertId}/details"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.getprimo.com/compliance/alerts/{alertId}/details', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getprimo.com/compliance/alerts/{alertId}/details",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.getprimo.com/compliance/alerts/{alertId}/details"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.getprimo.com/compliance/alerts/{alertId}/details")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getprimo.com/compliance/alerts/{alertId}/details")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"alert": {
"id": "<string>",
"deviceId": "<string>",
"deviceName": "<string>",
"devicePlatform": "ANDROID",
"owner": {
"id": "<string>",
"firstName": "<string>",
"lastName": "<string>"
},
"complianceRuleId": "<string>",
"ruleType": "<string>",
"mdmControlId": "<string>",
"status": "ACTIVE",
"additionalStatus": "MALWAREBYTES_AGENT_NOT_INSTALLED",
"detail": "<string>",
"hasAlert": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"statusSince": "2023-11-07T05:31:56Z"
},
"mdmControl": {
"id": "<string>",
"name": "<string>",
"category": "<string>",
"type": "<string>",
"identifier": "<string>",
"enabled": true,
"profileFleetId": "<string>",
"configurationPayload": {}
},
"device": {
"fleet": {
"fleetHostId": 123,
"uuid": "<string>",
"displayName": "<string>",
"hardwareSerial": "<string>",
"status": "online",
"seenTime": "<string>",
"detailUpdatedAt": "<string>",
"refetchRequested": true,
"uptime": 123,
"lastRestartedAt": "<string>",
"orbitVersion": "<string>",
"platform": "<string>",
"osVersion": "<string>",
"build": "<string>",
"codeName": "<string>",
"gigsDiskSpaceAvailable": 123,
"mdm": {
"enrollmentStatus": "<string>",
"name": "<string>",
"serverUrl": "<string>",
"connectedToFleet": true,
"depProfileError": true,
"deviceStatus": "<string>",
"pendingAction": "<string>",
"lastEnrolledAt": "<string>",
"lastMdmEnrolledAt": "<string>",
"lastMdmCheckedInAt": "<string>"
},
"encryption": {
"diskEncryptionEnabled": true,
"encryptionKeyAvailable": true,
"osSettingsStatus": "<string>",
"osSettingsDetail": "<string>",
"appleActionRequired": "rotate_key"
},
"profiles": [
{
"profileUuid": "<string>",
"name": "<string>",
"status": "verified",
"operationType": "install",
"detail": "<string>",
"scope": "<string>"
}
],
"labelNames": [
"<string>"
],
"idpUsername": "<string>",
"idpFullName": "<string>",
"bootstrapPackageStatus": "<string>",
"bootstrapPackageDetail": "<string>"
},
"primo": {
"scriptsEnabled": true,
"naming": {
"name": "<string>",
"computerName": "<string>",
"hostname": "<string>",
"computerNameSuggestion": "<string>",
"hostnameSuggestion": "<string>",
"mdmCommandInProgress": true,
"lastMDMCommandRunAt": "<string>",
"aiSuggestionFailure": {
"attempts": 123,
"lastAttemptAt": "<string>",
"failureType": "EMPTY_OUTPUT",
"attemptedName": "<string>",
"conflictingDeviceId": "<string>"
}
},
"malwarebytes": {
"protectionStatus": "<string>",
"hasAgentInstalled": true,
"hasAlerts": true,
"lastActive": "<string>",
"lastScriptRunAt": "<string>"
},
"sentinelOne": {
"installed": true,
"registeredAt": "<string>",
"lastActiveDate": "<string>",
"scanFinishedAt": "<string>",
"uninstalledAt": "<string>",
"infected": true
},
"encryption": {
"encrypted": true,
"recoveryKeyRemotelyAvailable": true
},
"recoveryOsStatus": "<string>",
"localUsers": [
{
"id": "<string>",
"username": "<string>",
"rights": "<string>",
"accountType": "<string>",
"creationStatus": "<string>",
"creationSource": "<string>",
"groupName": "<string>",
"passwordChangePending": true,
"passwordChangedAt": "<string>",
"createdAt": "<string>"
}
]
}
},
"enforcement": {
"profile": {
"fleetId": "<string>",
"resendable": true,
"delivery": {
"profileUuid": "<string>",
"name": "<string>",
"status": "verified",
"operationType": "install",
"detail": "<string>",
"scope": "<string>"
},
"content": "<string>"
},
"script": {
"scriptId": 123,
"source": "<string>",
"lastExecution": {
"status": "ran",
"executedAt": "<string>",
"exitCode": 123,
"output": "<string>"
},
"policies": [
{
"id": 123,
"name": "<string>",
"query": "<string>",
"resolution": "<string>",
"response": "pass"
}
]
},
"software": {
"appId": "<string>",
"install": {
"softwareId": "<string>",
"softwareName": "<string>",
"status": "installed",
"installedVersion": "<string>",
"availableVersion": "<string>",
"lastInstalledAt": "2023-11-07T05:31:56Z"
}
},
"command": {
"id": "<string>",
"command": "<string>",
"status": "<string>",
"type": "<string>",
"source": "<string>",
"initiator": "<string>",
"remoteId": "<string>",
"payload": "<unknown>",
"result": "<unknown>",
"uuid": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}
}Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Path Parameters
Response
Show child attributes
Show child attributes
The MDM control behind the alert — null for built-in checks (enrollment, online, iCloud lock, Primo requirement).
Show child attributes
Show child attributes
Show child attributes
Show child attributes
How this control is enforced on this device. A key is present only when the control carries that artifact, and a control can carry several. All keys absent means the enforcement happens outside MDM — read device.primo.
Show child attributes
Show child attributes