Public API Reference

MantisRMM · API v1 · Base URL https://api.rmm.mantisops.net

The MantisRMM Public API is a simple REST/JSON interface for reading your fleet and updating device metadata programmatically — for dashboards, integrations, and automation. Every request is authenticated with an API key and scoped to the tenant that issued it.

Overview

Base URL: https://api.rmm.mantisops.net
Version: all endpoints are under the /public/v1 prefix.
Format: JSON request and response bodies; UTF-8.
Auth: a Bearer API key on every request (below).
Tenancy: a key only ever sees data for the tenant that created it.

Authentication

Create keys in the RMM app under Settings → API Keys (admin only). A key is displayed once at creation — store it securely; it cannot be retrieved again. If a key is lost or exposed, revoke it and issue a new one.

Pass the key in the Authorization header as a Bearer token:

curl https://api.rmm.mantisops.net/public/v1/agents \
  -H "Authorization: Bearer mk_live_xxxxxxxxxxxxxxxxxxxxxxxx"

Verify a key and see its scopes with the ping endpoint:

curl https://api.rmm.mantisops.net/public/v1/ping \
  -H "Authorization: Bearer mk_live_..."

{ "ok": true, "product": "rmm", "version": "v1",
  "tenant": "t_abc123", "scopes": ["read"] }

⚠

Keys are stored only as a hash. MantisOps cannot recover a key for you — if it's lost, revoke it and create a new one. Treat keys like passwords and never commit them to source control.

Scopes

Each key is granted one of two scopes when created:

Scope	Grants
read	All `GET` endpoints — list and read agents.
read & write	Everything `read` allows, plus write endpoints (e.g. setting custom fields).

A request to a write endpoint with a read-only key returns 403. Grant the narrowest scope an integration needs.

ℹ

Rate limit: 120 requests / 60 s per key (429 + Retry-After when exceeded). CORS is enabled (Access-Control-Allow-Origin: *) so browser apps can call the API with a key.

ℹ

Pagination: list endpoints accept ?limit=N&offset=M (limit capped at 1000). Omit limit to receive the full list (default — unchanged behavior). List responses include limit, offset, hasMore, and (on most endpoints) total alongside the items — page by incrementing offset until hasMore is false.

Errors

Errors use standard HTTP status codes and a JSON body of the form { "error": "message" }.

Status	Meaning
400	Malformed request (e.g. a required field is missing).
401	Missing, malformed, revoked, or unknown API key.
403	The key is valid but lacks the required scope.
404	The resource (e.g. an agent or custom field) was not found.

Endpoints

GET/public/v1/pingread

Verify an API key and return the tenant it belongs to plus its scopes. Useful as a connection test.

curl https://api.rmm.mantisops.net/public/v1/ping \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "ok": true, "product": "rmm", "version": "v1",
  "tenant": "t_abc123", "scopes": ["read", "write"] }

GET/public/v1/agentsread

List every agent in your tenant. Returns an array of agent objects and a total count.

curl https://api.rmm.mantisops.net/public/v1/agents \
  -H "Authorization: Bearer mk_live_..."

200 OK
{
  "count": 2,
  "agents": [
    {
      "id": "ag_9f2c...", "name": "WIN-SVR-01", "hostname": "win-svr-01",
      "platform": "windows", "osVersion": "10.0.26200", "arch": "amd64",
      "agentVersion": "1.0.541", "status": "online",
      "lastSeenAt": 1751990400000, "ipAddress": "10.0.1.14",
      "alarmCount": 0, "customFields": { "Location": "HQ" }
    }
  ]
}

GET/public/v1/agents/{id}read

Fetch a single agent by its id. Returns 404 if no such agent exists in your tenant.

curl https://api.rmm.mantisops.net/public/v1/agents/ag_9f2c... \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "id": "ag_9f2c...", "name": "WIN-SVR-01", "platform": "windows",
  "status": "online", "cpuModel": "Intel Xeon...", "memTotal": 34359738368,
  "manufacturer": "Dell Inc.", "model": "PowerEdge R640", "customFields": {} }

POST/public/v1/agents/{id}/custom-fieldswrite

Set a custom field value on an agent. The field must already exist for your tenant (create fields under Settings → Custom Fields); reference it by its label. Send value: null to clear it.

curl -X POST https://api.rmm.mantisops.net/public/v1/agents/ag_9f2c.../custom-fields \
  -H "Authorization: Bearer mk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "label": "Location", "value": "HQ - Floor 3" }'

200 OK
{ "ok": true, "agentId": "ag_9f2c...", "label": "Location", "value": "HQ - Floor 3" }

ℹ

Request body fields: label (required) — the exact label of an existing custom field; value (string, or null to clear). A label with no matching field returns 404.

GET/public/v1/sitesread

List every site in your tenant. Fields: id, name, description, createdAt.

curl https://api.rmm.mantisops.net/public/v1/sites \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "sites": [ { "id": "site_1a2b", "name": "HQ", "description": "", "createdAt": 1751000000000 } ] }

GET/public/v1/alertsread

List threshold alert events (most recent first, last 7 days). Query: ?active=1 for unacknowledged only, ?agentId=, ?limit=. Fields: id, agentId, hostname, metric, value, threshold, firedAt, resolvedAt, acknowledgedAt, active.

curl "https://api.rmm.mantisops.net/public/v1/alerts?active=1" \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "alerts": [ { "id": "al_...", "agentId": "ag_9f2c...",
  "hostname": "ws-01", "metric": "cpu", "value": 98.2, "threshold": 90,
  "firedAt": 1751990400000, "acknowledgedAt": null, "active": true } ] }

GET/public/v1/jobsread

List recent jobs (scripts, patch installs, etc.). Query: ?agentId=, ?limit=. Fields: id, agentId, type, status, error, createdAt, startedAt, finishedAt.

curl https://api.rmm.mantisops.net/public/v1/jobs \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "jobs": [ { "id": "jb_...", "agentId": "ag_9f2c...",
  "type": "script", "status": "completed", "createdAt": 1751988000000,
  "finishedAt": 1751988012000 } ] }

GET/public/v1/softwareread

Fleet-wide software inventory — one row per (platform, title) with the machine count and observed versions. Fields: name, publisher, platform, machines, versions[].

curl https://api.rmm.mantisops.net/public/v1/software \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "software": [ { "name": "7-Zip", "publisher": "Igor Pavlov",
  "platform": "windows", "machines": 42, "versions": ["23.01", "22.01"] } ] }

GET/public/v1/patchesread

Installed OS-patch history (KBs applied per agent), most recent first. Query: ?agentId=, ?limit=. Fields: id, agentId, hostname, kbId, title, resultCode, installedAt.

curl https://api.rmm.mantisops.net/public/v1/patches \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "patches": [ { "id": "up_...", "agentId": "ag_9f2c...",
  "hostname": "ws-01", "kbId": "KB5034123", "title": "2025-01 Cumulative Update",
  "resultCode": 2, "installedAt": 1751980000000 } ] }

GET/public/v1/activityread

Tenant-wide activity / audit log, most recent first. Query: ?action= (prefix match), ?limit=. Fields: id, userEmail, action, target, details, createdAt.

curl "https://api.rmm.mantisops.net/public/v1/activity?action=agent." \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "count": 1, "activity": [ { "id": "au_...", "userEmail": "admin@acme.com",
  "action": "agent.delete", "target": "ag_9f2c...", "createdAt": 1751990400000 } ] }

POST/public/v1/alerts/{id}/acknowledgewrite

Acknowledge an alert so it stops showing as active. Requires a read & write key. Returns { ok, acknowledged } (acknowledged: false if it was already acknowledged or not found).

curl -X POST https://api.rmm.mantisops.net/public/v1/alerts/al_.../acknowledge \
  -H "Authorization: Bearer mk_live_..."

200 OK
{ "ok": true, "acknowledged": true }

Agent object

Fields returned for an agent. Optional fields are omitted when not available for a device.

Field	Type	Description
id	string	Unique agent identifier.
name	string	Display name.
hostname	string	Reported hostname.
platform	string	`windows`, `linux`, or `darwin`.
osVersion	string	Operating-system version string.
arch	string	CPU architecture (e.g. `amd64`, `arm64`).
agentVersion	string	Installed agent version.
status	string	`online` or `offline`.
lastSeenAt	number	Last check-in (Unix epoch ms).
firstSeenAt	number	Enrollment time (Unix epoch ms).
currentUser	string	Logged-in user, if reported.
ipAddress	string	Primary IP address.
macAddress	string	Primary MAC address.
manufacturer / model / serialNumber	string	Hardware identity.
cpuModel / cpuCount / memTotal	string / number	CPU model, logical core count, total RAM in bytes.
companyId / siteId / groupId	string	Organizational placement.
labels	string[]	Agent labels.
alarmCount	number	Active (unacknowledged) alerts.
customFields	object	Map of custom-field label → value.

💡

More endpoints are on the roadmap. Need one that isn't here yet? Let us know.