List MDM commands does not return DeviceLock by default

[mason-buettner]

Fleet version: 4.73

Web browser and operating system: Chrome 139 on macOS 15.6.1

---

💥  Actual behavior

When using the GET /api/v1/fleet/commands endpoint, commands with a request_type of DeviceLock are not returned unless the parameter is included.

For example:

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <token>' 'https://testURL/api/v1/fleet/commands?host_identifier=<identifier>&order_key=updated_at&order_direction=asc'

Returns output, but no DeviceLock commands. However, if you were to change the command to include the DeviceLock parameter:

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <token>' 'https://testURL/api/v1/fleet/commands?request_type=DeviceLock&host_identifier=<identifier>&order_key=updated_at&order_direction=asc'

It would show DeviceLock commands.

🛠️ To fix

TBD

Product designer: _________________________

🧑‍💻  Steps to reproduce

1. Lock a macOS device.
2. List the MDM commands for the device with no parameters aside from the host_identifier.
3. Note the output's lack of DeviceLock commands.
4. List the MDM commands with a filter for the request_type of DeviceLock

🕯️ More info (optional)

N/A

[PezHub]

QA Notes:

So far unable to reproduce. After sending a lock command via API or Fleet UI my curl output shows the DeviceLock commands:

Example without the request type (you can see both locks I sent):

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <redacted>' 'https://pezhub.ngrok.app/api/v1/fleet/commands?host_identifier=C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3&order_key=updated_at&order_direction=asc'
{
  "results": [
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "a44d4023-a46b-4ade-b779-1d0a12d83c7a",
      "updated_at": "2025-09-12T05:53:43Z",
      "request_type": "InstallEnterpriseApplication",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "5b8539ec-040b-4299-95b6-f6b96c4ec37d",
      "updated_at": "2025-09-12T05:53:44Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "a1c3d61d-2116-44af-95b0-60939028d963",
      "updated_at": "2025-09-12T05:53:44Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "51d87da6-b164-46ff-bb26-09d58ffec67a",
      "updated_at": "2025-09-12T05:58:14Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "93ee9ade-19d2-4ede-bf47-447fca2aa927",
      "updated_at": "2025-09-12T05:58:14Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "37a2dc3f-6446-402e-bf5f-597d1236237a",
      "updated_at": "2025-09-12T05:58:43Z",
      "request_type": "InstallEnterpriseApplication",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "e6c0263f-8e6b-490f-b7d1-0cd08b4d7654",
      "updated_at": "2025-09-12T15:26:27Z",
      "request_type": "DeviceLock",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "981a0839-bf26-4f7b-9751-baaf89b57627",
      "updated_at": "2025-09-12T15:34:32Z",
      "request_type": "DeviceLock",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    }
  ]
}

Example with request_type=DeviceLock

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <redacted>' 'https://pezhub.ngrok.app/api/v1/fleet/commands?request_type=DeviceLock&host_identifier=C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3&order_key=updated_at&order_direction=asc'
{
  "results": [
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "e6c0263f-8e6b-490f-b7d1-0cd08b4d7654",
      "updated_at": "2025-09-12T15:26:27Z",
      "request_type": "DeviceLock",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    },
    {
      "host_uuid": "C47AB6DD-DBCF-5162-A1F7-AFDE301C97B3",
      "command_uuid": "981a0839-bf26-4f7b-9751-baaf89b57627",
      "updated_at": "2025-09-12T15:34:32Z",
      "request_type": "DeviceLock",
      "status": "Acknowledged",
      "hostname": "Airs-MacBook-Air.local"
    }
  ]
}

running fleetctl get mdm-commands also shows them:

The list of 20 most recent commands:

+----------------------------------------------------------+----------------------+------------------------------+--------------+-----------------------------+
|                           UUID                           |         TIME         |             TYPE             |    STATUS    |          HOSTNAME           |
+----------------------------------------------------------+----------------------+------------------------------+--------------+-----------------------------+
| 981a0839-bf26-4f7b-9751-baaf89b57627                     | 2025-09-12T15:34:32Z | DeviceLock                   | Acknowledged | Airs-MacBook-Air.local      |
+----------------------------------------------------------+----------------------+------------------------------+--------------+-----------------------------+
| e6c0263f-8e6b-490f-b7d1-0cd08b4d7654                     | 2025-09-12T15:26:27Z | DeviceLock                   | Acknowledged | Airs-MacBook-Air.local      |
+----------------------------------------------------------+----------------------+------------------------------+--------------+-----------------------------+
| abf6607a-361a-46f3-969c-3269858aa46a                     | 2025-09-12T06:23:44Z | InstallProfile               |          200 | Win11-VM-Pez                |
+----------------------------------------------------------+----------------------+------------------------------+--------------+-----------------------------+
| 5808a87d-f354-4f20-bf9c-8a81fe5777cd                     | 2025-09-12T06:23:44Z | InstallProfile               |          200 | Win11-
VM-Pez                |

[PezHub]

Hi @mason-buettner can you confirm with the customer I'm going thru the same workflow as them? I haven't been to repro yet.

[georgekarrv]

@mason-buettner Do we know the permission level of the api user they were seeing this with?

[PezHub]

I revisited this issue and am getting different results, I'm honestly not sure how I was able to see the DeviceLock without specifying the request type the first time...and I haven't been able to repro using various users 🤷‍♂️ (prob copy/paste user error so apologies)

Latest QA Results:

Summary - I can reproduce what the customer is seeing but this appears to be working as designed to prevent someone from grabbing the exposed unlock PIN when viewing the command results.

@georgekarrv @marko-lisica can you confirm? cc: @mason-buettner

Repro steps:

1. Lock the host
2. Send the following curl and view results (no DeviceLock is shown)

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <redacted>' 'https://pezhub.ngrok.app/api/v1/fleet/commands?host_identifier=4FA64DAD-7B64-557A-9E2E-CF08A711B760&order_key=updated_at&order_direction=asc'
{
  "results": [
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "6c18ce29-1d65-4b43-b620-4e0c74560fe8",
      "updated_at": "2025-09-12T04:56:12Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    },
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "f9d7c206-2148-485b-9fcc-99c537e2adfe",
      "updated_at": "2025-09-12T04:56:15Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    },
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "37cc4d9d-c11c-4910-8391-acb551148a90",
      "updated_at": "2025-09-12T04:56:15Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    },
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "272767d7-64c2-4bdc-a092-5683521aa68a",
      "updated_at": "2025-09-12T04:56:15Z",
      "request_type": "InstallProfile",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    },
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "04dac179-3233-4efa-a0f0-d6f7113affed",
      "updated_at": "2025-09-12T04:56:17Z",
      "request_type": "DeclarativeManagement",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    },
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "19f75f00-5b19-4d30-b2d7-5a075fb8e740",
      "updated_at": "2025-09-12T04:56:42Z",
      "request_type": "InstallEnterpriseApplication",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    }
}

3. Adding the DeviceLock request type shows the commands as expected

curl --location -H 'Content-Type:application/json' -H 'Authorization: Bearer <redacted>' 'https://pezhub.ngrok.app/api/v1/fleet/commands?request_type=DeviceLock&host_identifier=4FA64DAD-7B64-557A-9E2E-CF08A711B760&order_key=updated_at&order_direction=asc'
{
  "results": [
    {
      "host_uuid": "4FA64DAD-7B64-557A-9E2E-CF08A711B760",
      "command_uuid": "7d5724d5-2c50-4802-9d29-83cd6e0cfdb2",
      "updated_at": "2025-09-16T18:02:42Z",
      "request_type": "DeviceLock",
      "status": "Acknowledged",
      "hostname": "pezs-mbp"
    }
  ]
}

4. Grab the command_uuid (from above) then running get mdm-command-results exposes the PIN

./build/fleetctl get mdm-command-results --id=7d5724d5-2c50-4802-9d29-83cd6e0cfdb2                                              11:07:30 AM
ID:
7d5724d5-2c50-4802-9d29-83cd6e0cfdb2

TIME:
2025-09-16T18:02:42Z

TYPE:
DeviceLock

STATUS:
Acknowledged

HOSTNAME:
pezs-mbp

PAYLOAD:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>CommandUUID</key>
    <string>7d5724d5-2c50-4802-9d29-83cd6e0cfdb2</string>
    <key>Command</key>
    <dict>
      <key>RequestType</key>
      <string>DeviceLock</string>
      <key>PIN</key>
      <string>029448</string>
    </dict>
  </dict>
</plist>


RESULTS:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>CommandUUID</key>
    <string>7d5724d5-2c50-4802-9d29-83cd6e0cfdb2</string>
    <key>Status</key>
    <string>Acknowledged</string>
    <key>UDID</key>
    <string>4FA64DAD-7B64-557A-9E2E-CF08A711B760</string>
  </dict>
</plist>

[mason-buettner]

@georgekarrv I was able to reproduce with an administrator account.

@PezHub this workflow mirrors what I was seeing in my testing. I had a bit of uncertainty on whether this was a feature or bug, so if this is working as expected I'd be happy to close this out and make sure we let other customers know in the future.

[marko-lisica]

Grab the command_uuid (from above) then running get mdm-command-results exposes the PIN

@PezHub When you ran this, did you get activity that you viewed PIN?

[PezHub]

no