Skip to content

Pro Command Renames

Jump to bottom
Neil Martin edited this page Sep 11, 2026 · 2 revisions

Pro Command Renames

In v1.29.0 the jamf-cli pro resource command names changed source: they come from the Jamf Pro API's own OpenAPI tags and URL paths instead of the filename each resource's paths were split into. 163 resources became 135: 38 renamed, 24 merged, 13 split.

100 former names resolve to their replacement until 2027-03-09 and warn on stderr. Three refuse. Names in the protect, school, security and platform namespaces did not move, and the 53 Classic API (/JSSResource) resources keep theirs. One exception to watch: pro classic-ldap is a modern Pro API resource at /v1/classic-ldap/{id}, renamed from pro classic-ldaps. The Classic API's LDAP resource is pro classic-ldap-servers, which is unchanged.

Find your symptom, then read that section.

Symptom Exit code Section
It works, and prints warning: … is a deprecated name unchanged The migration window
`pro X Y` no longer exists: the operation moved … 2 48 invocations an alias cannot cover
`pro X Y` no longer names this operation … 2 3 verbs whose meaning moved
`pro X` no longer exists: … with no replacement named 1 3 withdrawn names
It exits 0 and prints help text where it used to print data 0 3 former leaves that are now command groups

The migration window

Each of the 100 retired names prints a warning on stderr naming its replacement, then runs:

$ jamf-cli pro icons get 1
warning: `icons` is a deprecated name for `icon` and stops working after 2027-03-09. Use `pro icon`.
{
  "id": 1,
  "url": "https://euw2.ics.services.jamfcloud.com/icon/hash_ff1733d65bba..."
}

stdout is unchanged, so a pipeline keeps working. Neither --quiet nor --no-hints suppresses the warning, and it fires wherever a global flag sits, so jamf-cli pro -p ci-svc icons get 1 warns too.

After 2027-03-09 the aliases are deleted and all 100 names answer unknown command at exit 2.

Retired names and curated short aliases both appear in the aliases field of jamf-cli commands -o json, which does not separate them. The warning does: a retired name warns, a curated short alias does not. pro jcds and pro jcds-files are curated short aliases, so they do not expire and do not warn.

The renamed resources

96 names, each a cobra alias on its replacement. Each warns and works.

Was Is now
pro access-managements pro enrollment
pro account-preferences pro jamf-pro-account-preferences
pro activation-codes pro activation-code
pro api-roles-privileges pro api-role-privileges
pro app-installer-deployments pro app-installers-deployments
pro app-installer-titles pro app-installers-titles
pro app-requests pro app-request
pro authentications pro api-authentication
pro cache pro cache-settings
pro certificate-authorities pro certificate-authority
pro change-passwords pro jamf-pro-user-account-settings
pro classic-ldaps pro classic-ldap
pro cloud-azure-defaults pro cloud-azure
pro cloud-azures pro cloud-azure
pro cloud-distribution-points pro cloud-distribution-point
pro cloud-id-p-configurations pro cloud-idp
pro cloud-id-p-histories pro cloud-idp
pro cloud-id-p-test-searches pro cloud-idp
pro cloud-informations pro cloud-information
pro cloud-ldap-connections pro cloud-ldap
pro cloud-ldap-defaults pro cloud-ldap
pro cloud-ldap-key-stores pro cloud-ldap
pro cloud-ldap-mappings pro cloud-ldap
pro cloud-ldaps pro cloud-ldap
pro computer-prestage-scopes pro computer-prestages
pro computer-smart-groups pro computer-inventory
pro computers-inventory pro computer-inventory
pro country-codes pro app-store-country-codes
pro csas pro csa
pro dashboards pro dashboard
pro database-connections pro jamf-pro-initialization
pro ddm-status pro declarative-device-management
pro ddm-syncs pro declarative-device-management
pro device-compliance-informations pro conditional-access
pro device-enrollment-instance-sync-states pro device-enrollments
pro device-enrollment-instances pro device-enrollments
pro digi-cert-settings pro digicert
pro distribution-points pro distribution-point
pro dss-proxies pro declarative-device-management
pro enrollment-customization-panels pro enrollment-customization
pro enrollment-customizations pro enrollment-customization
pro enrollment-settings pro enrollment
pro erase-device-computers pro computer-inventory
pro erase-device-mobiles pro mobile-devices
pro health-checks pro health-check
pro icons pro icon
pro inventory-informations pro inventory-information
pro inventory-preloads pro inventory-preload
pro jamf-connect-deployment-tasks pro jamf-connect
pro jamf-connects pro jamf-connect
pro jamf-packages pro jamf-package
pro jamf-pro-informations pro jamf-pro-information
pro jamf-pro-versions pro jamf-pro-version
pro jamf-protect-deployment-tasks pro jamf-protect
pro jamf-protect-plans pro jamf-protect
pro jamf-remote-assist-session-histories pro jamf-remote-assist
pro last-logins pro last-login
pro ldap-rs pro ldap
pro local-admin-passwords pro local-admin-password
pro log-flushings pro log-flushing
pro mac-os-managed-software-updates pro macos-managed-software-updates
pro mdm-commands pro mdm
pro mdm-renewals pro mdm-renewal
pro mobile-device-enrollment-profiles pro mobile-device-enrollment-profile
pro mobile-device-inventory-details pro mobile-devices
pro mobile-device-prestage-scopes pro mobile-device-prestages
pro mobile-device-prestage-sync-states pro mobile-device-prestages
pro mobile-device-smart-groups pro mobile-devices
pro notifications pro jamf-pro-notifications
pro oauth-token-sessions pro sso-oauth-session-tokens
pro oidcs pro oidc
pro onboarding-configuration pro onboarding
pro onboardings pro onboarding
pro package-deployments pro mdm
pro patch-policy-logs pro patch-policies
pro patch-titles pro patch-management
pro reenrollment pro re-enrollment
pro remove-computer-mdm-profiles pro computer-inventory
pro remove-mobile-device-mdm-profiles pro mobile-devices
pro renew-mdm-profiles pro mdm
pro return-to-service-configurations pro return-to-service
pro schedulers pro scheduler
pro self-service-branding-images pro self-service
pro service-discovery pro service-discovery-enrollment
pro slasas pro slasa
pro sso-failovers pro sso-settings
pro static-computer-groups pro computer-groups-static-groups
pro systems pro jamf-pro-initialization
pro teacher-settings pro teacher-app
pro team-viewer-remote-administrations pro team-viewer-remote-administration
pro user-accounts pro accounts
pro user-preferences pro jamf-pro-user-account-settings
pro user-smart-groups pro users
pro venafis pro venafi
pro vpp-locations pro volume-purchasing-locations
pro vpp-subscriptions pro volume-purchasing-subscriptions

Four that redirect two tokens deep

These four resolve to a nested command. Each warns and works.

Was Is now
pro account-driven-user-enrollment-session-token-settings pro enrollment adue-session-token-settings
pro app-installer-global-settings pro app-installers global-settings
pro self-service-settings pro self-service settings
pro sso-settings-cert pro sso-settings cert

3 withdrawn names

These three have no command to alias to, so they refuse at exit 1. --help on any of them prints a Removed line carrying the same reason, at exit 0.

$ jamf-cli pro servers
`pro servers` no longer exists: `/settings/issueTomcatSslCertificate` was an
unversioned legacy endpoint with no replacement in the versioned API

$ jamf-cli pro remote-administration-configurations
`pro remote-administration-configurations` no longer exists: the bare
`/preview/remote-administration-configurations` collection is no longer ingested;
the family under it ships as `pro team-viewer-remote-administration`

$ jamf-cli pro redeploy-jamf-management-frameworks
`pro redeploy-jamf-management-frameworks` no longer exists: the redeploy action
moved to `pro computer-inventory redeploy-framework` (aliased `comp`), which
targets by serial, name or group

48 invocations an alias cannot cover

An alias maps one resource name to one replacement. Two cases escape it: a resource that split, and an operation whose name derives from a path segment that now sits under a different resource. In both the alias resolves the resource and the subcommand does not exist, so all 48 answer at exit 2 with the new invocation named:

$ jamf-cli pro policy-properties policy-properties
`pro policy-properties policy-properties` no longer exists: the operation moved
when command names started coming from the spec
hint: the endpoint is unchanged; run `jamf-cli pro policy-properties get`

Both spellings reach the refusal: the old resource name through its alias, and the new name as typed. pro schedulers triggers and pro scheduler triggers both name pro scheduler-jobs triggers. The endpoint is unchanged in all 48 cases, and the refusals retire with the aliases on 2027-03-09.

45 are in the table below. The other three are verbs whose meaning moved, in 3 verbs whose meaning moved.

Two refusals name two replacements each, because two pairs of old invocations collapse onto one name once the alias resolves and each pair's endpoints went to different places:

$ jamf-cli pro enrollment-settings list
warning: `enrollment-settings` is a deprecated name for `enrollment` and stops working after 2027-03-09. Use `pro enrollment`.
`pro enrollment list` no longer exists: the operation moved when command names
started coming from the spec
hint: two commands share the old name: `jamf-cli pro enrollment access-management` and
`jamf-cli pro enrollment-access-groups list`

pro mobile-device-prestages delete-multiple and pro mobile-device-prestage-scopes delete-multiple answer the same way, naming attachments-delete-multiple and scope-delete-multiple. Pick by the endpoint in the table.

Was Is now Endpoint
pro access-managements list pro enrollment access-management GET /v4/enrollment/access-management
pro activation-codes patch pro activation-code organization-name patch PATCH /v1/activation-code/organization-name
pro api-roles-privileges api-role-privileges pro api-role-privileges list GET /v1/api-role-privileges
pro app-requests create pro app-request-form-input-fields create POST /v1/app-request/form-input-fields
pro app-requests delete pro app-request-form-input-fields delete DELETE /v1/app-request/form-input-fields/{id}
pro app-requests list pro app-request-form-input-fields list GET /v1/app-request/form-input-fields
pro app-requests settings pro app-request get GET /v1/app-request/settings
pro app-requests update-settings pro app-request update PUT /v1/app-request/settings
pro cloud-distribution-points cloud-distribution-point pro cloud-distribution-point list GET /v1/cloud-distribution-point
pro computer-inventory-collection-settings create pro computer-inventory-collection-settings-custom-path create POST /v2/computer-inventory-collection-settings/custom-path
pro computer-inventory-collection-settings delete pro computer-inventory-collection-settings-custom-path delete DELETE /v2/computer-inventory-collection-settings/custom-path/{id}
pro csas delete pro csa token delete DELETE /v1/csa/token
pro enrollment-languages filtered-language-codes pro enrollment filtered-language-codes GET /v3/enrollment/filtered-language-codes
pro enrollment-languages language-codes pro enrollment language-codes GET /v3/enrollment/language-codes
pro enrollment-settings create pro enrollment-access-groups create POST /v3/enrollment/access-groups
pro enrollment-settings delete pro enrollment-access-groups delete DELETE /v3/enrollment/access-groups/{id}
pro enrollment-settings enrollment pro enrollment get GET /v4/enrollment
pro enrollment-settings list pro enrollment-access-groups list GET /v3/enrollment/access-groups
pro enrollment-settings update-enrollment pro enrollment update PUT /v4/enrollment
pro health-checks health-check pro health-check list GET /v1/health-check
pro jamf-connects jamf-connect pro jamf-connect list GET /v1/jamf-connect
pro jamf-connects update pro jamf-connect-config-profiles update PUT /v1/jamf-connect/config-profiles/{id}
pro jcds delete pro jamf-cloud-distribution-service-files delete DELETE /v1/jcds/files/{fileName}
pro jcds files pro jamf-cloud-distribution-service-files create POST /v1/jcds/files
pro jcds get pro jamf-cloud-distribution-service-files get GET /v1/jcds/files/{fileName}
pro jcds list pro jamf-cloud-distribution-service-files list GET /v1/jcds/files
pro local-admin-passwords update pro local-admin-password settings update PUT /v2/local-admin-password/settings
pro log-flushings delete pro log-flushing-task delete DELETE /v1/log-flushing/task/{id}
pro log-flushings get pro log-flushing-task get GET /v1/log-flushing/task/{id}
pro log-flushings log-flushing pro log-flushing list GET /v1/log-flushing
pro log-flushings task pro log-flushing-task create POST /v1/log-flushing/task
pro managed-software-updates-plans abandon pro managed-software-updates-plans feature-toggle abandon POST /v1/managed-software-updates/plans/feature-toggle/abandon
pro managed-software-updates-plans status pro managed-software-updates-plans feature-toggle status GET /v1/managed-software-updates/plans/feature-toggle/status
pro managed-software-updates-plans update pro managed-software-updates-plans feature-toggle update PUT /v1/managed-software-updates/plans/feature-toggle
pro mdm-renewals patch pro mdm-renewal-device-common-details patch PATCH /v1/mdm-renewal/device-common-details
pro mobile-device-prestage-scopes delete-multiple pro mobile-device-prestages scope-delete-multiple POST /v2/mobile-device-prestages/{id}/scope/delete-multiple
pro mobile-device-prestages delete-multiple pro mobile-device-prestages attachments-delete-multiple POST /v3/mobile-device-prestages/{id}/attachments/delete-multiple
pro policy-properties policy-properties pro policy-properties get GET /v1/policy-properties
pro policy-properties update-policy-properties pro policy-properties update PUT /v1/policy-properties
pro schedulers summary pro scheduler list GET /v1/scheduler/summary
pro schedulers triggers pro scheduler-jobs triggers GET /v1/scheduler/jobs/{jobKey}/triggers
pro self-service-plus get pro self-service-plus settings get GET /v1/self-service-plus/settings
pro self-service-plus update pro self-service-plus settings update PUT /v1/self-service-plus/settings
pro sso-failovers list pro sso-settings failover GET /v1/sso/failover
pro sso-settings-cert cert pro sso-settings cert create POST /v2/sso/cert

3 verbs whose meaning moved

enrollment-customization-panels and enrollment-customization are one resource now, and its plain create, update and delete address the customization: POST /v2/enrollment-customizations and PUT/DELETE /v2/enrollment-customizations/{id}. The three panel writes under the panels spelling are refused at exit 2:

$ jamf-cli pro enrollment-customization-panels update 1 2
warning: `enrollment-customization-panels` is a deprecated name for `enrollment-customization` and stops working after 2027-03-09. Use `pro enrollment-customization`.
`pro enrollment-customization-panels update` no longer names this operation:
`enrollment-customization-panels` and `enrollment-customization` are one resource
now, and its plain verbs are the resource's own
hint: run `jamf-cli pro enrollment-customization ldap-update`
Was Is now Endpoint
pro enrollment-customization-panels create pro enrollment-customization ldap-create POST /v1/enrollment-customization/{id}/ldap
pro enrollment-customization-panels update pro enrollment-customization ldap-update PUT /v1/enrollment-customization/{id}/ldap/{panel-id}
pro enrollment-customization-panels delete pro enrollment-customization all-delete DELETE /v1/enrollment-customization/{id}/all/{panel-id}

The panel reads under that spelling (all, ldap, sso, text, markdown, parse-markdown) are unchanged.

3 former leaves that are now command groups

These three paths resolve, exit 0 and print usage text where they returned data before. A job piping one of them into jq gets a usage message.

Was (returned data) Is now The data is at
pro csas token the pro csa token group pro csa token get
pro local-admin-passwords settings the pro local-admin-password settings group pro local-admin-password settings get
pro managed-software-updates-plans feature-toggle the … feature-toggle group pro managed-software-updates-plans feature-toggle get

Passing --output/-o, --field, --select or --out-file to one of the three exits 2 and names the leaf:

$ jamf-cli pro csas token -o json
warning: `csas` is a deprecated name for `csa` and stops working after 2027-03-09. Use `pro csa`.
`pro csa token` is a command group and returns no data; it returned data before
the sub-resource split
hint: run `jamf-cli pro csa token get`

A bare invocation prints help, as any command group in this CLI does, and a typo beneath one is unchanged. The exit-2 refusal retires with the aliases on 2027-03-09; the command groups are permanent.

9 sub-path command groups

A sub-path carrying PUT, PATCH or DELETE on the sub-path itself is a command of its own. A POST-only sub-path stays flat, and so does a sub-path holding all of its group's operations: pro app-request get and pro service-discovery-enrollment get keep their shape.

New command Endpoint
pro activation-code organization-name /v1/activation-code/organization-name
pro app-installers global-settings /v1/app-installers/global-settings
pro csa token /v1/csa/token
pro enrollment adue-session-token-settings /v1/adue-session-token-settings
pro local-admin-password settings /v2/local-admin-password/settings
pro managed-software-updates-plans feature-toggle /v1/managed-software-updates/plans/feature-toggle
pro self-service settings /v1/self-service/settings
pro self-service-plus settings /v1/self-service-plus/settings
pro sso-settings cert /v2/sso/cert

Their verbs are plain, so pro sso-settings cert get|create|update|delete and pro sso-settings cert download|parse. The invocations the split moved are in the 48-invocation table.

Two SSO commands moved with it:

  • pro sso-settings download sends the SAML metadata, GET /v3/sso/metadata/download. For the certificate, run pro sso-settings cert download.
  • pro sso-settings delete no longer exists. To delete the SSO certificate, run pro sso-settings cert delete.

19 write operations that now ship

A resource's plain verbs are its root's, and a sub-path's write is qualified by the segment that owns it. The HTTP method separates two operations that share one path. 19 writes v1.28.0 dropped ship as a result.

Three are the enrollment-customization CRUD: create, update and delete, on POST /v2/enrollment-customizations and PUT/DELETE /v2/enrollment-customizations/{id}.

Four are the prestage scope writes: create-scope and update-scope on pro computer-prestages, and the same pair on pro mobile-device-prestages.

The remaining twelve:

Command Endpoint
pro enrollment-customization sso-create / sso-update / sso-delete POST …/{id}/sso, PUT/DELETE …/{id}/sso/{panel-id}
pro enrollment-customization text-create / text-update / text-delete the same three on …/{id}/text
pro enrollment-customization ldap-delete DELETE /v1/enrollment-customization/{id}/ldap/{panel-id}
pro packages manifest-delete DELETE /v1/packages/{id}/manifest
pro venafi proxy-trust-store-create / proxy-trust-store-delete POST/DELETE /v1/pki/venafi/{id}/proxy-trust-store
pro patch-software-title-configurations dashboard-delete DELETE /v3/patch-software-title-configurations/{id}/dashboard
pro computer-inventory attachments-delete DELETE /v4/computers-inventory/{id}/attachments/{attachmentId}

3 apply commands are gone

apply is synthesized from a resource's list, create and update. Those three no longer co-reside on pro app-requests, pro enrollment-settings or pro managed-software-updates-plans, so none of the three ships an apply and each answers unknown command at exit 2.

Two of the splits carry the verb instead: pro app-request-form-input-fields apply and pro enrollment-access-groups apply. /v1/managed-software-updates/plans publishes no update endpoint, so use pro managed-software-updates-plans create.

9 endpoints are no longer ingested

The gateway withdrew these nine from its published API, and each is superseded. The CLI stopped sending them in v1.29.0.

Endpoint Use instead
GET/POST/PUT/DELETE /v1/inventory-preload{,/{id}} (5) pro inventory-preload-records, which serves the v2 paths under records/
GET /preview/remote-administration-configurations pro team-viewer-remote-administration, which serves the family under that collection
POST /settings/issueTomcatSslCertificate nothing: the versioned API has no replacement
POST /v1/computer-inventory/{id}/{erase,remove-mdm-profile} (2) pro comp erase and pro comp remove-mdm, which target by serial, name or group

Migrating a script tree

1. Diff your scripts against what the binary ships

jamf-cli commands -o json is authoritative for the binary you have; this page is a snapshot of v1.29.0.

# Every pro resource name this binary ships, one per line.
jamf-cli commands -o json --no-hints \
  | jq -r '.[].command' \
  | grep -E '^pro [a-z0-9-]+$' | cut -d' ' -f2 | sort -u > /tmp/jamf-current.txt

# Every pro resource token your scripts name.
grep -rhoE '\bpro[^A-Za-z0-9-]+[a-z0-9-]{3,}' ./scripts \
  | grep -oE '[a-z0-9-]{3,}$' | sort -u > /tmp/jamf-used.txt

# What you use that is not a shipped resource name.
comm -23 /tmp/jamf-used.txt /tmp/jamf-current.txt

The jq pipe reads command names only: the aliases field mixes the 100 expiring names in with the curated short ones. The cost is that curated short aliases (comp, computers, cat, dept, scr, bld, dev, pdev, pdg, ddm, jcds, jcds-files, smart-computer-groups) come back as false positives. They are permanent, so ignore them and look the rest up in the renamed-resources table.

The grep is loose about what separates pro from the resource token, so it catches a quoted argv list (["jamf-cli", "pro", "vpp-locations", "list"]) as well as a shell line. It does not catch a resource name held in a variable.

2. Run each invocation and fail on the warning

The stderr warning is the per-invocation signal, and the only one that separates an expiring alias from a permanent one. Neither --quiet nor --no-hints suppresses it, so this holds however the job is invoked.

Wrap the call so the warning fails the job and the command's own exit code still reaches the caller:

run_checked() {
  err=$(mktemp)
  "$@" 2>"$err"; rc=$?
  cat "$err" >&2
  if grep -q 'deprecated name' "$err"; then
    echo "retired jamf-cli name in: $*" >&2
    rm -f "$err"; return 1
  fi
  rm -f "$err"; return $rc
}

run_checked jamf-cli pro dashboards list   # returns 1, prints the warning
run_checked jamf-cli pro dashboard list    # returns whatever the command returned

out=$(jamf-cli … 2>&1 >/dev/null) with a case on the string is the one-liner, and it discards the exit code.

For a read-only sweep, append --help instead of running the command: it reaches the alias without authenticating or sending a request. The four nested aliases and the three withdrawn names print their notice under --help. The 96 plain aliases print no warning under help, so --help is no substitute for check 1.

3. Check the three that keep exiting 0

grep -rn 'csas token\|local-admin-passwords settings\|managed-software-updates-plans feature-toggle' ./scripts

A hit that also passes -o, --output, --field, --select or --out-file exits 2 with the leaf named. A hit without one of those prints help text at exit 0. See 3 former leaves that are now command groups.

Related

Repository · Issues · Releases

jamf-cli Wiki

Products

  • Jamf Pro: jamf-cli pro
  • Jamf Platform API: jamf-cli pro (blueprints, benchmarks, DDM reports)
  • Jamf Platform: jamf-cli platform (AI Governance, Jamf Account, audit)
  • Jamf Protect: jamf-cli protect
  • Jamf School: jamf-cli school
  • Jamf Security Cloud: jamf-cli security

Clone this wiki locally