EXTENSIONS

Read fantasy league state from the Sleeper platform's public read-only API — no key, no OAuth, no write surface. Resolve a username to a user ID, list leagues and drafts, and read a league in depth: settings and scoring, rosters with owners joined and standings derived, weekly matchups paired head to head, the transaction log, traded picks, playoff brackets, the draft board, and league-wide add/drop trends. Player IDs are resolved to names from a locally cached catalogue, and a missing record (which Sleeper reports as HTTP 200 with a null body) fails loudly instead of reading as empty.

Broad Microsoft Graph extension — nine model types over one shared app-only client: calendar (room/user calendarView, current/next meeting), places (room resources), users (Entra directory reads, manager, memberOf), groups, mail (Outlook messages), teams (chats/teams/channels/messages), presence, sharepoint (document-library navigation, search, and file download, working under either Sites.Read.All or Sites.Selected), and intune (enrolled devices, compliance policies, configuration profiles and settings catalog, remediation scripts, confirmation-gated device actions, and async report exports). Token caching, automatic paging, and a raw-bytes downloader; app credentials supplied from a vault. Supersedes the narrow ms-graph-calendar and absorbs azure-ad-user's lookup.

Read and administer an Apple Business Manager organization over the Apple Business API. OAuth 2 client-credentials auth with an ES256 JWT client assertion signed in WebCrypto — no JWT library, no native dependencies — with in-process token caching, 429 and 5xx retry honouring Retry-After, and automatic re-mint on a mid-flight 401. Accepts the private key whether it is PKCS#8 or SEC1, detected from the DER rather than the PEM label, because Apple issues a PKCS#8 key under EC PRIVATE KEY armour. Roll the whole organization up in one call — devices tallied by product family, status, and purchase source alongside the device management service inventory. Sweep devices, device management services, blueprints, configurations, users, user groups, organizational units, apps, and packages, each fully paged through links.next and filterable client-side with a CEL selector since the API offers no server-side filtering. Drill into a single device, its AppleCare coverage, its assigned management service, or an enrolled device's OS, storage, FileVault, firewall, lock, and erase state. Assign and unassign devices to a device management service as one batched activity and poll it to completion, read the organization audit log over a time window, and reach any unwrapped endpoint through an authenticated passthrough. Works against Apple School Manager by pointing apiBaseUrl at api-school.apple.com and setting the scope to school.api.

Manage a ZEDEDA Cloud (ZEDCloud) tenant and the EVE-OS edge nodes it controls, over the ZEDCloud REST API. Bearer auth with a vault-resolved session token, plus a two-step token-exchange method for rotating it before its 90-day expiry. Read controller and tenant status, sweep the whole object graph in one fan-out inventory call, list and inspect edge nodes with fleet-wide health rollup, and read app instances, logs, events, and time-series metrics. Onboard nodes zero-touch by minting a single-use EVE-OS installer bound to one node, drive node lifecycle (activate, deactivate, reboot, prepare-power-off, offboard), open EdgeView remote-access sessions, run EVE-OS base image upgrades, deploy and control application instances, create node-local network instances, and reach any other endpoint through a generic authenticated passthrough.

MikroTik RouterOS management over the REST API: decomposed, per-object typed resources for system, interfaces, bridge, and IP — plus port enable/disable, set-identity, and reboot. Queryable with CEL.

Wrap the Neat Pulse REST API to read Teams-Room device sensor data and enumerate the org's rooms and devices. Provides people count, temperature, humidity, CO2/air quality, occupancy, and privacy-shutter state from Neat Sense-capable devices (Neat Bar, Neat Bar Pro, Neat Board). Used as the room-sensor signal source in the Identity-Aware Room Services (IARS) meeting-agent. Requires Neat Pulse Plus or Pro plan. Credentials: api-token + org-id from the neat vault.

Query the Shodan internet-wide scan database to find and profile internet-exposed devices. Single API key resolved from vault. Read the account plan and remaining credits, run searches that return trimmed device records (IP, org, product, location, open port, CVEs) with facet rollups, count results without spending query credits, pull the full banner history for one IP, do keyless InternetDB lookups (ports, CPEs, tags, CVEs), and request on-demand scans of IPs you own. Built for AV/IoT exposure recon.

Integrate with a CybrIQ (Sepio) asset-visibility / hardware-access-control platform over its REST + GraphQL API. Local-login bearer auth with vault-resolved credentials. Read the asset dashboard, inventory, device types, risk insights, switches, external scan engines (Netpollers), events, alarm destinations, policies, scopes, tags, and user attributes; create tags, user attributes, policies, and scopes; and reach any other endpoint through a generic authenticated passthrough.