> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List the MDM controls that apply to a device

> Return the complete list of enabled MDM controls that TARGET ONE device — the policies this machine is meant to receive (disk encryption, screen lock, OS restrictions, installed profiles…), each with its id, name, type, platform, tags and how it reaches the device (`targetMethod`). Targeting only: a control listed here is INTENDED for the device, which does NOT mean it is installed on it or that the device complies with it — for that, read `getComplianceAlerts` on the same device, whose alerts carry `mdmControlId`. Disabled controls are never listed, and a device that is not enrolled in MDM still has targeted controls (none of them applied). Not paginated, the list is complete. For the company-wide list of controls, use `getMdmControls`; for one control full configuration and targeting, use `getMdmControl`.

<span className="badge-read">Key: Read</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json get /devices/{deviceId}/mdm-controls
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /devices/{deviceId}/mdm-controls:
    get:
      tags:
        - Devices
      summary: List the MDM controls that apply to a device
      description: >-
        Return the complete list of enabled MDM controls that TARGET ONE device
        — the policies this machine is meant to receive (disk encryption, screen
        lock, OS restrictions, installed profiles…), each with its id, name,
        type, platform, tags and how it reaches the device (`targetMethod`).
        Targeting only: a control listed here is INTENDED for the device, which
        does NOT mean it is installed on it or that the device complies with it
        — for that, read `getComplianceAlerts` on the same device, whose alerts
        carry `mdmControlId`. Disabled controls are never listed, and a device
        that is not enrolled in MDM still has targeted controls (none of them
        applied). Not paginated, the list is complete. For the company-wide list
        of controls, use `getMdmControls`; for one control full configuration
        and targeting, use `getMdmControl`.
      operationId: getDeviceMdmControls
      parameters:
        - name: deviceId
          required: true
          in: path
          schema:
            type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetDeviceMdmControls_Output'
components:
  schemas:
    GetDeviceMdmControls_Output:
      type: object
      properties:
        data:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type: string
              type:
                type: string
                enum:
                  - malwarebyte_macos
                  - malwarebyte_windows
                  - malwarebyte_linux
                  - recoveryOs_macos
                  - softwareUpdate_macos
                  - appBlocking_macos
                  - wifi_macos
                  - wifi_ios
                  - wifi_ipados
                  - wifi_windows
                  - wifi_android
                  - wifi_linux
                  - adminUserManagement_macos
                  - adminUserManagement_windows
                  - adminUserPasswordRotation_macos
                  - adminUserPasswordRotation_windows
                  - deviceNaming_macos
                  - deviceNaming_windows
                  - deviceNaming_linux
                  - googleChrome_macos
                  - googleChrome_windows
                  - firewall_macos
                  - firewall_windows
                  - usbBlocking_macos
                  - usbBlocking_windows
                  - usbBlocking_linux
                  - entraSSO_macos
                  - oktaSSO_macos
                  - primoSSO_macos
                  - customFile_macos
                  - customFile_ios
                  - customFile_ipados
                  - customFile_windows
                  - customFile_android
                  - customFile_linux
                  - passwordPolicy_macos
                  - passwordPolicy_windows
                  - passwordPolicy_ios
                  - passwordPolicy_ipados
                  - passwordPolicy_android
                  - sentinelOne_macos
                  - sentinelOne_windows
                  - sentinelOne_windows_arm64
                  - sentinelOne_linux_deb
                  - sentinelOne_linux_deb_arm64
                  - sentinelOne_linux_rpm
                  - sentinelOne_linux_rpm_arm64
                  - diskEncryption_all
                  - osUpdate_macos
                  - osUpdate_windows
                  - osUpdate_ios
                  - osUpdate_ipados
                  - rustdesk_macos
                  - rustdesk_windows
                  - disableProfilesPane_macos
                  - screenCapture_macos
                  - disableAirdrop_macos
                  - airPrint_macos
                  - webClip_macos
                  - webClip_ios
                  - webClip_ipados
              platform:
                type: string
                enum:
                  - macos
                  - windows
                  - ios
                  - ipados
                  - android
                  - linux
                  - chromeos
                  - unknown
              tags:
                type: array
                items:
                  type: string
              targetMethod:
                description: >-
                  How the control reaches this device: All (every device),
                  DeviceGroup, or CustomTarget
                type: string
                enum:
                  - All
                  - DeviceGroup
                  - CustomTarget
            required:
              - id
              - name
              - type
              - platform
              - tags
              - targetMethod
            additionalProperties: false
      required:
        - data
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````