ABM API Helper

A Python tool for integrating Apple Business Manager (ABM) device data with Jamf Pro, enabling automated synchronization of device purchasing information and management workflows.

Features

• ABM Device Retrieval: Fetch device details from Apple Business Manager using OAuth2 authentication
• Jamf Pro Integration: Automatically populate device purchasing information in Jamf Pro
• Vendor Mapping: Convert ABM purchase source IDs to human-readable vendor names
• Batch Processing: Process multiple devices from Jamf computer groups
• Comprehensive Logging: Detailed logging for troubleshooting and audit trails

Project Structure

abm-api-helper/
├── ABM/
│   └── ABMdevices.py          # Apple Business Manager API client
├── Jamf/
│   ├── JamfAuth.py            # Jamf Pro authentication
│   ├── JamfComputers.py       # Jamf computer management
│   └── JamfComputerGroup.py   # Jamf computer group operations
├── constants.py               # Vendor mappings and configuration
├── get_abm_device_details.py  # CLI tool for individual device lookup
├── populate_abm_data_to_jamf.py # Batch sync ABM data to Jamf Pro
├── generate_client_assertion.py # JWT client assertion generator
├── requirements.txt           # Python dependencies
└── README.md                  # This file

Prerequisites

• Python 3.7+
• Apple Business Manager account with API access
• Jamf Pro instance with API access
• Valid ABM client credentials and private key certificate

Installation

1. Clone the repository:

   git clone https://github.com/ZeroSegFault/abm-api-helper.git
   cd abm-api-helper

2. Create and activate a virtual environment:

   ABM API Helper

   This project integrates Apple Business Manager (ABM) with Jamf Pro. It fetches device purchasing metadata (order date, PO number, vendor) from ABM and updates Jamf Pro computer inventory records, so purchasing info stays accurate without manual entry.

   What’s Inside

   • ABM client (ABM/ABMdevices.py): Authenticates with ABM using OAuth2 + JWT assertion and retrieves device data.
   • Jamf clients (Jamf/): Auth, computer inventory access, and smart group membership.
   • CLI tools:
     • get_abm_device_details.py: Look up a single device by serial and print its ABM data.
     • populate_abm_data_to_jamf.py: Sync ABM purchasing info into Jamf for a target smart group.
   • Config (constants.py): Vendor ID → name mapping and the Jamf group ID to process.

   Requirements

   • Python 3.8+ (recommended)
   • Access to ABM APIs and Jamf Pro APIs
   • ABM OAuth client set up with private key for JWT assertion

   Install dependencies:

   python3 -m venv .venv
   source .venv/bin/activate
   pip install -r requirements.txt
   

   Configure

   1. Create .env in the repo root:

   ABM_CLIENT_ID=your_abm_client_id
   ABM_TEAM_ID=your_abm_team_id
   ABM_KEY_ID=your_abm_key_id
   PRIVATE_KEY_FILE=EUC-Reporter.pem
   
   JAMF_BASE_URL=https://your-instance.jamfcloud.com
   JAMF_CLIENT_ID=your_jamf_client_id
   JAMF_CLIENT_SECRET=your_jamf_client_secret

   2. Generate the ABM client assertion (JWT):

   python generate_client_assertion.py

   This writes client_assertion.txt used by the tools to obtain an ABM access token.

   3. Adjust vendor mapping and group:
   • Edit constants.py to ensure VENDORS includes your purchase source IDs. You can get this information from your vendor IDs in ABM
   • Set GROUP_TO_UPDATE to the Jamf smart group ID you want to process.

   How to Use

   Look up a single device (ABM)

   Returns pretty JSON for the given serial number:

   python get_abm_device_details.py --device-id <SERIAL_NUMBER>
   
   # Example
   python get_abm_device_details.py --device-id FVFHQ0SYQ05N

   Output includes order date, PO number, vendor, and other ABM attributes.

   Sync ABM purchasing info to Jamf

   Processes members of GROUP_TO_UPDATE and updates Jamf computer inventory purchasing fields:

   python populate_abm_data_to_jamf.py

   What it does:

   • Fetches smart group membership from Jamf
   • Loads inventory details for each computer
   • Queries ABM by serial
   • Updates Jamf with purchased, poNumber, vendor, and poDate

   Logs

   • get_abm_device_details.log: Device lookup logs
   • abm_to_jamf.log: Batch sync logs

   Logs go to the console and to files in the project root.

   Troubleshooting

   • Ensure .env variables are present (the scripts exit if missing).
   • Verify client_assertion.txt exists and is fresh (ABM tokens require valid JWT assertion).
   • Check vendor IDs in constants.py match your ABM purchase source IDs.
   • Confirm Jamf URL and credentials have API access.

   Notes on Auth

   • ABM: OAuth2 client credentials using JWT client assertion (ES256) signed with your private key.
   • Jamf: OAuth2 client credentials (/api/oauth/token).

   Security

   • Do not commit .env, private keys, or client_assertion.txt.
   • Restrict file permissions on key material.
   • Rotate credentials regularly.

   References

   • Apple Business Manager API: https://developer.apple.com/documentation/devicemanagement
   • Jamf Pro API: https://developer.jamf.com/jamf-pro/reference/