EXTENSIONS

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Manage a Cisco IOS switch (e.g. Catalyst 2960) over SSH after console bootstrap — capture running-config and device facts, run verification commands, and push idempotent baselines: secure-access hardening, SNMPv2c, and Layer-3/VLAN/access-port config. Shells out to OpenSSH; vault-resolved credentials; live reachability pre-flight check.