Public API Reference

MantisRMM · API v1 · Base URL https://api.rmm.mantisops.net

The MantisRMM Public API is a simple REST/JSON interface for reading your fleet and updating device metadata programmatically — for dashboards, integrations, and automation. Every request is authenticated with an API key and scoped to the tenant that issued it.

Overview

• Base URL: https://api.rmm.mantisops.net
• Version: all endpoints are under the /public/v1 prefix.
• Format: JSON request and response bodies; UTF-8.
• Auth: a Bearer API key on every request (below).
• Tenancy: a key only ever sees data for the tenant that created it.

Authentication

Create keys in the Customer Portal (portal.mantisops.net) → API keys → Create API key. Account owners and admins can create keys. Set MantisRMM to Read or Write (and the other products to None unless the integration needs them), choose any limits (below), check the Review step, and create the key. Confirming it's you is required. If you grant more than one product, you get one key per product.

The key is shown once. Copy it, then click Run test from here or run the curl command shown to check it works. It can't be shown again. If a key is lost or exposed, revoke it and create a new one. MantisRMM keys begin with mk_live_.

Keys are created only in the Customer Portal. In MantisRMM, Admin settings → API Keys shows your existing keys and their limits, and you can revoke a key there.

Pass the key in the Authorization header as a Bearer token:

Verify a key and see its scopes with the ping endpoint:

Key limits

You set these when you create a key in the Customer Portal. To change them later, choose Edit limits… in the key's row menu: you can change the companies, allowed IP addresses and expiry; the key itself stays the same. The name and permissions can't be changed: create a new key instead.

The key list in the Portal shows when each key was last used and from which IP address, and warns about keys that have expired, expire within 14 days or have never been used.

Scopes

Each key is granted one of two scopes when created. In the Customer Portal, Read gives read and Write gives read & write.

A request to a write endpoint with a read-only key returns 403. Grant the narrowest scope an integration needs.

Errors

Errors use standard HTTP status codes and a JSON body of the form { "error": "message" }.

Endpoints

Verify an API key and return the tenant it belongs to plus its scopes. Useful as a connection test.

List every agent in your tenant. Returns an array of agent objects and a total count.

Fetch a single agent by its id. Returns 404 if no such agent exists in your tenant.

Set a custom field value on an agent. The field must already exist for your tenant (create fields under Settings → Custom Fields); reference it by its label. Send value: null to clear it.

List every site in your tenant. Fields: id, name, description, createdAt.

List threshold alert events (most recent first, last 7 days). Query: ?active=1 for unacknowledged only, ?agentId=, ?limit=. Fields: id, agentId, hostname, metric, value, threshold, firedAt, resolvedAt, acknowledgedAt, active.

List recent jobs (scripts, patch installs, etc.). Query: ?agentId=, ?limit=. Fields: id, agentId, type, status, error, createdAt, startedAt, finishedAt.

Fleet-wide software inventory — one row per (platform, title) with the machine count and observed versions. Fields: name, publisher, platform, machines, versions[].

Installed OS-patch history (KBs applied per agent), most recent first. Query: ?agentId=, ?limit=. Fields: id, agentId, hostname, kbId, title, resultCode, installedAt.

Tenant-wide activity / audit log, most recent first. Query: ?action= (prefix match), ?limit=. Fields: id, userEmail, action, target, details, createdAt.

Acknowledge an alert so it stops showing as active. Requires a read & write key. Returns { ok, acknowledged } (acknowledged: false if it was already acknowledged or not found).

Agent object

Fields returned for an agent. Optional fields are omitted when not available for a device.