EXTENSIONS

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Manage a ZEDEDA Cloud (ZEDCloud) tenant and the EVE-OS edge nodes it controls, over the ZEDCloud REST API. Bearer auth with a vault-resolved session token, plus a two-step token-exchange method for rotating it before its 90-day expiry. Read controller and tenant status, sweep the whole object graph in one fan-out inventory call, list and inspect edge nodes with fleet-wide health rollup, and read app instances, logs, events, and time-series metrics. Onboard nodes zero-touch by minting a single-use EVE-OS installer bound to one node, drive node lifecycle (activate, deactivate, reboot, prepare-power-off, offboard), open EdgeView remote-access sessions, run EVE-OS base image upgrades, deploy and control application instances, create node-local network instances, and reach any other endpoint through a generic authenticated passthrough.