> ## Documentation Index > Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt > Use this file to discover all available pages before exploring further. # Add a Primo remediation kit to Fleet > Put in place everything a kit Primo maintains for a known issue needs: its scripts in your script library, and its reports in Fleet, which each computer runs every hour to tell what is left to fix. Returns each script with its `scriptId`, its purpose (`check`, `remediate` or `manual`) and the platforms to run it on, and each report. Nothing is run on a device: run a script with `runScript`, and read the reports with `getRemediationKitFindings`. Safe to call again: a script the library already holds under the same name is left as it is and reported `present`, or `differs` when its source is not the kit's; a report is brought back to the kit when it drifted. Kits: `emudhra_ca_compromise`, the eMudhra CA compromise of October 2026 (https://docs.getprimo.com/guides/security/emudhra-ca-compromise). Its scripts: `check-emudhra-exposure.sh` (macOS and Linux, read-only, also sees pip's own certifi and Node.js installed with nvm, fnm, Volta, asdf or mise) and Fleet's `remediate-emudhra-ca-compromise-macos.sh` and `-linux.sh`, which remove trust in the compromised roots and keep a `*.pre-emudhra` backup of each file they edit. On Windows, `distrust-emudhra-intermediates-windows.ps1` downloads the 16 compromised intermediates from crt.sh, checks each one's SHA-256, and adds them to the machine's Untrusted Certificates (exit 2 when crt.sh cannot be reached); Fleet's `remediate-emudhra-ca-compromise-windows.ps1` is `manual`: it embeds the certificates, so Microsoft Defender blocks it (`ScriptContainedMaliciousContent` in its output). Key: WriteScope: Company ## OpenAPI ````yaml https://api.getprimo.com/openapi.json post /scripts/remediation-kits openapi: 3.1.1 info: title: Public API - BETA description: Read docs on https://docs.getprimo.com/ version: '1.0' contact: {} servers: - url: https://api.getprimo.com security: - apikey: [] tags: [] paths: /scripts/remediation-kits: post: tags: - Scripts summary: Add a Primo remediation kit to Fleet description: >- Put in place everything a kit Primo maintains for a known issue needs: its scripts in your script library, and its reports in Fleet, which each computer runs every hour to tell what is left to fix. Returns each script with its `scriptId`, its purpose (`check`, `remediate` or `manual`) and the platforms to run it on, and each report. Nothing is run on a device: run a script with `runScript`, and read the reports with `getRemediationKitFindings`. Safe to call again: a script the library already holds under the same name is left as it is and reported `present`, or `differs` when its source is not the kit's; a report is brought back to the kit when it drifted. Kits: `emudhra_ca_compromise`, the eMudhra CA compromise of October 2026 (https://docs.getprimo.com/guides/security/emudhra-ca-compromise). Its scripts: `check-emudhra-exposure.sh` (macOS and Linux, read-only, also sees pip's own certifi and Node.js installed with nvm, fnm, Volta, asdf or mise) and Fleet's `remediate-emudhra-ca-compromise-macos.sh` and `-linux.sh`, which remove trust in the compromised roots and keep a `*.pre-emudhra` backup of each file they edit. On Windows, `distrust-emudhra-intermediates-windows.ps1` downloads the 16 compromised intermediates from crt.sh, checks each one's SHA-256, and adds them to the machine's Untrusted Certificates (exit 2 when crt.sh cannot be reached); Fleet's `remediate-emudhra-ca-compromise-windows.ps1` is `manual`: it embeds the certificates, so Microsoft Defender blocks it (`ScriptContainedMaliciousContent` in its output). operationId: addRemediationKit parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AddRemediationKitBody' responses: default: description: '' content: application/json: schema: $ref: '#/components/schemas/AddRemediationKit_Output' components: schemas: AddRemediationKitBody: type: object properties: kit: description: >- The kit. `emudhra_ca_compromise`: the eMudhra CA compromise of October 2026. type: string enum: - emudhra_ca_compromise required: - kit AddRemediationKit_Output: type: object properties: kit: type: string enum: - emudhra_ca_compromise scripts: type: array items: type: object properties: id: description: >- Identifier of the saved script, used as `scriptId` when running it. type: number name: type: string purpose: description: >- `check`: read-only, exits 0 when nothing is left to fix and 2 when its output lists findings. `remediate`: changes the device, exits 0 when it is protected and 2 when a step was skipped. `manual`: kept in the library for an admin to run by hand where their antivirus allows it, never run by an agent. type: string enum: - check - remediate - manual platforms: description: Platforms to run it on. Pass exactly these to `runScript`. type: array items: type: string enum: - macos - windows - linux status: description: >- `added` by this call, `present` with the kit source, or `differs`: a script of this name whose source is not the kit’s, left as it is. type: string enum: - added - present - differs sourceUrl: description: Where the script comes from. type: string required: - id - name - purpose - platforms - status - sourceUrl additionalProperties: false reports: type: array items: type: object properties: id: type: number name: type: string platform: type: string enum: - macos - windows - linux status: description: >- `added` by this call (its first results arrive within the hour), `present`, or `updated` back to the kit (its stored results restart). type: string enum: - added - present - updated required: - id - name - platform - status additionalProperties: false required: - kit - scripts - reports additionalProperties: false securitySchemes: apikey: scheme: bearer bearerFormat: API key type: http description: >- Use your Primo API key in the Authorization header as `Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.