> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Get the full remediation context of one compliance alert
> Return everything needed to diagnose and remediate one compliance alert (from `getComplianceAlerts`): the alert itself, the MDM control behind it with its configuration in clear, the state of the device on both sides (`device.fleet` for the live MDM state — enrollment, last check-in, delivered profiles, failing checks, disk-encryption action required; `device.primo` for what Primo tracks itself — naming, Malwarebytes, SentinelOne, encryption, local admin accounts), and `enforcement`, which describes how the control reaches this device. `enforcement` holds one key per artifact the control actually carries, and a control can carry several: `profile` (rendered profile + its delivery state), `script` (source + last execution with output + attached checks), `software` (the installed app and its install state), `command` (the last matching MDM command with its payload and result). All keys absent means the enforcement happens outside MDM — read `device.primo` for the evidence. An unknown or recomputed alert ID returns 404 — list alerts again to get fresh IDs. For the full MDM command history of the device, use `getDeviceCommands`.
Key: ReadScope: Company
## OpenAPI
````yaml https://api.getprimo.com/openapi.json get /compliance/alerts/{alertId}/details
openapi: 3.1.1
info:
title: Public API - BETA
description: Read docs on https://docs.getprimo.com/
version: '1.0'
contact: {}
servers:
- url: https://api.getprimo.com
security:
- apikey: []
tags: []
paths:
/compliance/alerts/{alertId}/details:
get:
tags:
- Compliance
summary: Get the full remediation context of one compliance alert
description: >-
Return everything needed to diagnose and remediate one compliance alert
(from `getComplianceAlerts`): the alert itself, the MDM control behind
it with its configuration in clear, the state of the device on both
sides (`device.fleet` for the live MDM state — enrollment, last
check-in, delivered profiles, failing checks, disk-encryption action
required; `device.primo` for what Primo tracks itself — naming,
Malwarebytes, SentinelOne, encryption, local admin accounts), and
`enforcement`, which describes how the control reaches this device.
`enforcement` holds one key per artifact the control actually carries,
and a control can carry several: `profile` (rendered profile + its
delivery state), `script` (source + last execution with output +
attached checks), `software` (the installed app and its install state),
`command` (the last matching MDM command with its payload and result).
All keys absent means the enforcement happens outside MDM — read
`device.primo` for the evidence. An unknown or recomputed alert ID
returns 404 — list alerts again to get fresh IDs. For the full MDM
command history of the device, use `getDeviceCommands`.
operationId: getComplianceAlertDetails
parameters:
- name: alertId
required: true
in: path
schema:
type: string
responses:
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/GetComplianceAlertDetails_Output'
components:
schemas:
GetComplianceAlertDetails_Output:
type: object
properties:
alert:
type: object
properties:
id:
type: string
deviceId:
type: string
deviceName:
anyOf:
- type: string
- type: 'null'
devicePlatform:
anyOf:
- type: string
enum:
- ANDROID
- IOS
- IPADOS
- MACOS
- WINDOWS
- LINUX
- CHROME_OS
- UNKNOWN
- type: 'null'
owner:
description: Employee the alerting device is assigned to.
anyOf:
- type: object
properties:
id:
type: string
firstName:
type: string
lastName:
type: string
required:
- id
- firstName
- lastName
additionalProperties: false
- type: 'null'
complianceRuleId:
type: string
ruleType:
description: Type of the compliance rule behind the alert.
anyOf:
- type: string
- type: 'null'
mdmControlId:
anyOf:
- type: string
- type: 'null'
status:
type: string
enum:
- ACTIVE
- NOT_PROTECTED
- OFFLINE_7_DAYS
- PENDING
- PROTECTED
- FAILED
- NOT_ENCRYPTED
- MISSING_RECOVERY_KEY
- ENCRYPTED
- ACTION_REQUIRED
- GRACE_PERIOD
- UP_TO_DATE
- NOT_UP_TO_DATE
- ENFORCED
- ERROR
- CREATION_PENDING
- DEMOTION_PENDING
- CREATED
- CREATION_FAILED
- SUCCESS
- INSTALLED
- MDM_ON
- MDM_OFF
- MDM_ON_IN_ANOTHER_MDM
- READY_ZTD
- MISSING_AGENT
- ONLINE
- OFFLINE
- ENABLED
- DISABLED
- MISSING_BYPASS_CODE
- MEETS_REQUIREMENTS
- BELOW_MINIMUM_VERSION
- UNSUPPORTED_OS_EDITION
hasAlert:
type: boolean
createdAt:
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
updatedAt:
description: When the compliance of the device was last checked.
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
required:
- id
- deviceId
- deviceName
- devicePlatform
- owner
- complianceRuleId
- ruleType
- mdmControlId
- status
- hasAlert
- createdAt
- updatedAt
additionalProperties: false
mdmControl:
description: >-
The MDM control behind the alert — null for built-in checks
(enrollment, online, iCloud lock, Primo requirement).
anyOf:
- type: object
properties:
id:
type: string
name:
type: string
category:
type: string
type:
type: string
identifier:
type: string
enabled:
type: boolean
profileFleetId:
description: >-
MDM identifier of the profile this control deploys — matches
an entry of device.fleet.profiles.
anyOf:
- type: string
- type: 'null'
configurationPayload:
description: >-
The Primo configuration the control enforces on the device,
secret values included.
anyOf:
- type: object
propertyNames:
type: string
additionalProperties: {}
- type: 'null'
required:
- id
- name
- category
- type
- identifier
- enabled
- profileFleetId
- configurationPayload
additionalProperties: false
- type: 'null'
device:
type: object
properties:
fleet:
description: >-
Live MDM state of the device — null when the device is no longer
enrolled.
anyOf:
- type: object
properties:
fleetHostId:
description: >-
MDM identifier of the host — the join key for MDM
operations.
type: number
uuid:
type: string
displayName:
type: string
hardwareSerial:
description: Can be an empty string — never use it as a join key.
type: string
status:
description: Liveness — caps any device-side remediation.
type: string
enum:
- online
- offline
- missing
- new
seenTime:
description: When the device last checked in.
type: string
detailUpdatedAt:
description: How fresh the inventory below is.
anyOf:
- type: string
- type: 'null'
refetchRequested:
description: True when a refresh of this host is already queued.
type: boolean
uptime:
description: Nanoseconds since boot.
anyOf:
- type: number
- type: 'null'
lastRestartedAt:
anyOf:
- type: string
- type: 'null'
orbitVersion:
description: null means the device does not run the MDM agent.
anyOf:
- type: string
- type: 'null'
platform:
description: >-
Raw MDM platform: darwin | windows | ubuntu | debian |
fedora…
type: string
osVersion:
type: string
build:
anyOf:
- type: string
- type: 'null'
codeName:
description: OS code name; the edition string on Windows.
anyOf:
- type: string
- type: 'null'
gigsDiskSpaceAvailable:
description: Absolute free space in GB.
anyOf:
- type: number
- type: 'null'
mdm:
type: object
properties:
enrollmentStatus:
anyOf:
- type: string
- type: 'null'
name:
anyOf:
- type: string
- type: 'null'
serverUrl:
anyOf:
- type: string
- type: 'null'
connectedToFleet:
type: boolean
depProfileError:
type: boolean
deviceStatus:
description: unlocked | locked | wiped
anyOf:
- type: string
- type: 'null'
pendingAction:
anyOf:
- type: string
- type: 'null'
lastEnrolledAt:
anyOf:
- type: string
- type: 'null'
lastMdmEnrolledAt:
anyOf:
- type: string
- type: 'null'
lastMdmCheckedInAt:
anyOf:
- type: string
- type: 'null'
required:
- enrollmentStatus
- name
- serverUrl
- connectedToFleet
- depProfileError
- deviceStatus
- pendingAction
- lastEnrolledAt
- lastMdmEnrolledAt
- lastMdmCheckedInAt
additionalProperties: false
encryption:
type: object
properties:
diskEncryptionEnabled:
anyOf:
- type: boolean
- type: 'null'
encryptionKeyAvailable:
description: >-
Whether a recovery key is escrowed. The key itself
is never returned.
anyOf:
- type: boolean
- type: 'null'
osSettingsStatus:
description: >-
verified | verifying | pending | action_required |
failed
anyOf:
- type: string
- type: 'null'
osSettingsDetail:
description: The root cause when encryption is not verified.
anyOf:
- type: string
- type: 'null'
appleActionRequired:
description: >-
The end-user action Apple requires to finish
encryption.
anyOf:
- type: string
enum:
- rotate_key
- log_out
- type: 'null'
required:
- diskEncryptionEnabled
- encryptionKeyAvailable
- osSettingsStatus
- osSettingsDetail
- appleActionRequired
additionalProperties: false
profiles:
description: All configuration profiles and their delivery status.
type: array
items:
type: object
properties:
profileUuid:
description: >-
MDM identifier of the profile. Not a valid UUID
despite the name — pass verbatim.
type: string
name:
type: string
status:
description: MDM delivery status of the profile on the device.
anyOf:
- type: string
enum:
- verified
- verifying
- pending
- failed
- type: 'null'
operationType:
anyOf:
- type: string
enum:
- install
- remove
- type: 'null'
detail:
description: >-
Delivery error detail reported by MDM when the
profile failed.
type: string
scope:
anyOf:
- type: string
- type: 'null'
required:
- profileUuid
- name
- status
- operationType
- detail
- scope
additionalProperties: false
labelNames:
description: MDM label names the device belongs to.
type: array
items:
type: string
idpUsername:
description: >-
Identity-provider account the MDM associates with the
device.
anyOf:
- type: string
- type: 'null'
idpFullName:
anyOf:
- type: string
- type: 'null'
bootstrapPackageStatus:
anyOf:
- type: string
- type: 'null'
bootstrapPackageDetail:
anyOf:
- type: string
- type: 'null'
required:
- fleetHostId
- uuid
- displayName
- hardwareSerial
- status
- seenTime
- detailUpdatedAt
- refetchRequested
- uptime
- lastRestartedAt
- orbitVersion
- platform
- osVersion
- build
- codeName
- gigsDiskSpaceAvailable
- mdm
- encryption
- profiles
- labelNames
- idpUsername
- idpFullName
- bootstrapPackageStatus
- bootstrapPackageDetail
additionalProperties: false
- type: 'null'
primo:
description: Device state Primo tracks itself, outside of MDM.
type: object
properties:
scriptsEnabled:
description: >-
Whether MDM scripts can run on the device — null when
unknown. Primo-verified, not the unreliable agent-reported
flag: no script remediation when false.
anyOf:
- type: boolean
- type: 'null'
naming:
description: >-
Expected versus actual device naming — the gap is what a
deviceNaming alert reports.
anyOf:
- type: object
properties:
name:
anyOf:
- type: string
- type: 'null'
computerName:
anyOf:
- type: string
- type: 'null'
hostname:
anyOf:
- type: string
- type: 'null'
computerNameSuggestion:
anyOf:
- type: string
- type: 'null'
hostnameSuggestion:
anyOf:
- type: string
- type: 'null'
mdmCommandInProgress:
anyOf:
- type: boolean
- type: 'null'
lastMDMCommandRunAt:
anyOf:
- type: string
- type: 'null'
required:
- name
- computerName
- hostname
- computerNameSuggestion
- hostnameSuggestion
- mdmCommandInProgress
- lastMDMCommandRunAt
additionalProperties: false
- type: 'null'
malwarebytes:
anyOf:
- type: object
properties:
protectionStatus:
anyOf:
- type: string
- type: 'null'
hasAgentInstalled:
type: boolean
hasAlerts:
type: boolean
lastActive:
anyOf:
- type: string
- type: 'null'
lastScriptRunAt:
anyOf:
- type: string
- type: 'null'
required:
- protectionStatus
- hasAgentInstalled
- hasAlerts
- lastActive
- lastScriptRunAt
additionalProperties: false
- type: 'null'
sentinelOne:
anyOf:
- type: object
properties:
installed:
anyOf:
- type: boolean
- type: 'null'
registeredAt:
anyOf:
- type: string
- type: 'null'
lastActiveDate:
anyOf:
- type: string
- type: 'null'
scanFinishedAt:
anyOf:
- type: string
- type: 'null'
uninstalledAt:
anyOf:
- type: string
- type: 'null'
infected:
anyOf:
- type: boolean
- type: 'null'
required:
- installed
- registeredAt
- lastActiveDate
- scanFinishedAt
- uninstalledAt
- infected
additionalProperties: false
- type: 'null'
encryption:
anyOf:
- type: object
properties:
encrypted:
anyOf:
- type: boolean
- type: 'null'
recoveryKeyRemotelyAvailable:
anyOf:
- type: boolean
- type: 'null'
required:
- encrypted
- recoveryKeyRemotelyAvailable
additionalProperties: false
- type: 'null'
recoveryOsStatus:
anyOf:
- type: string
- type: 'null'
localUsers:
description: >-
Local accounts on the device, with their creation status and
password-rotation state.
type: array
items:
type: object
properties:
id:
type: string
username:
type: string
rights:
type: string
accountType:
type: string
creationStatus:
anyOf:
- type: string
- type: 'null'
creationSource:
type: string
groupName:
anyOf:
- type: string
- type: 'null'
passwordChangePending:
anyOf:
- type: boolean
- type: 'null'
passwordChangedAt:
anyOf:
- type: string
- type: 'null'
createdAt:
type: string
required:
- id
- username
- rights
- accountType
- creationStatus
- creationSource
- groupName
- passwordChangePending
- passwordChangedAt
- createdAt
additionalProperties: false
required:
- scriptsEnabled
- naming
- malwarebytes
- sentinelOne
- encryption
- recoveryOsStatus
- localUsers
additionalProperties: false
required:
- fleet
- primo
additionalProperties: false
enforcement:
type: object
description: >-
How this control is enforced on this device. A key is present only
when the control carries that artifact, and a control can carry
several. All keys absent means the enforcement happens outside MDM —
read `device.primo`.
properties:
profile:
type: object
properties:
fleetId:
type: string
delivery:
description: >-
Delivery state of the profile enforcing this control on this
device — null when the profile never reached the device.
anyOf:
- type: object
properties:
profileUuid:
description: >-
MDM identifier of the profile. Not a valid UUID
despite the name — pass verbatim.
type: string
name:
type: string
status:
description: MDM delivery status of the profile on the device.
anyOf:
- type: string
enum:
- verified
- verifying
- pending
- failed
- type: 'null'
operationType:
anyOf:
- type: string
enum:
- install
- remove
- type: 'null'
detail:
description: >-
Delivery error detail reported by MDM when the
profile failed.
type: string
scope:
anyOf:
- type: string
- type: 'null'
required:
- profileUuid
- name
- status
- operationType
- detail
- scope
additionalProperties: false
- type: 'null'
content:
description: The rendered configuration profile deployed to the device.
anyOf:
- type: string
- type: 'null'
required:
- fleetId
- delivery
- content
additionalProperties: false
script:
type: object
properties:
scriptId:
anyOf:
- type: number
- type: 'null'
source:
description: The enforcement script deployed to the device.
anyOf:
- type: string
- type: 'null'
lastExecution:
anyOf:
- type: object
properties:
status:
type: string
enum:
- ran
- pending
- error
executedAt:
type: string
exitCode:
anyOf:
- type: number
- type: 'null'
output:
description: Tail of the script output (truncated).
anyOf:
- type: string
- type: 'null'
required:
- status
- executedAt
- exitCode
- output
additionalProperties: false
- type: 'null'
policies:
description: Compliance checks attached to this control.
type: array
items:
type: object
properties:
id:
type: number
name:
type: string
query:
description: The osquery check evaluated on the device.
type: string
resolution:
anyOf:
- type: string
- type: 'null'
response:
description: >-
Latest device response for the check — empty or null
when not yet evaluated.
anyOf:
- type: string
enum:
- pass
- fail
- ''
- type: 'null'
required:
- id
- name
- query
- resolution
- response
additionalProperties: false
required:
- scriptId
- source
- lastExecution
- policies
additionalProperties: false
software:
type: object
properties:
appId:
description: >-
The software this control installs — inspect it with
getDeviceSoftware.
type: string
install:
description: >-
Install state of that software on this device — null when no
install record exists.
anyOf:
- type: object
properties:
softwareId:
type: string
softwareName:
type: string
status:
type: string
enum:
- installed
- failed
- in_progress
- not_installed
installedVersion:
anyOf:
- type: string
- type: 'null'
availableVersion:
anyOf:
- type: string
- type: 'null'
lastInstalledAt:
anyOf:
- type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
- type: 'null'
required:
- softwareId
- softwareName
- status
- installedVersion
- availableVersion
- lastInstalledAt
additionalProperties: false
- type: 'null'
required:
- appId
- install
additionalProperties: false
command:
type: object
properties:
id:
type: string
command:
type: string
status:
type: string
type:
anyOf:
- type: string
- type: 'null'
source:
type: string
initiator:
type: string
remoteId:
anyOf:
- type: string
- type: 'null'
payload:
description: >-
What was sent to the device — the script itself for script
commands.
result:
description: What the device answered.
uuid:
anyOf:
- type: string
- type: 'null'
createdAt:
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
updatedAt:
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
required:
- id
- command
- status
- type
- source
- initiator
- remoteId
- payload
- result
- uuid
- createdAt
- updatedAt
additionalProperties: false
additionalProperties: false
required:
- alert
- mdmControl
- device
- enforcement
additionalProperties: false
securitySchemes:
apikey:
scheme: bearer
bearerFormat: API key
type: http
description: >-
Use your Primo API key in the Authorization header as `Bearer
`.
````