Kandji setup - Configview Support

ConfigView pulls your Apple device fleet from Kandji through a single API token — devices and their full hardware/OS detail, the library items assigned to them, blueprints, vulnerabilities, threat detections, and the Prism inventory tables. You will end up with 2 secrets in ConfigView (KANDJI_API_KEY, KANDJI_SUBDOMAIN) when setup is complete.

Read the “Device secrets” section before you enable everything. Seven of the 59 scripts retrieve FileVault recovery keys, unlock PINs, recovery lock passwords and Activation Lock bypass codes. Those are the credentials that unlock your fleet, and enabling those scripts copies them into your ConfigView database. That may be exactly what you want for break-glass reporting — but it is a deliberate decision, not a default.

Step 1: Create the Kandji API token

Sign in to your Kandji tenant as an administrator
Go to Settings → Access → API Token
Create a new token and name it ConfigView
Copy the token — it is shown once
Grant the token permissions for the areas you intend to collect. Kandji scopes API tokens per endpoint family, so a token without a given permission returns 403 on just those scripts rather than failing wholesale.

Note your subdomain — the tenant prefix in your Kandji URL. If you sign in at https://acme.kandji.io, the subdomain is acme.

Step 2: Add the secrets to ConfigView

Go to your ConfigView dashboard: https://{companyname}.configview.com/admin/integrations/kandji
Under Credentials, enter each value and click the save icon on its row:

Secret name	Value	Example
`KANDJI_API_KEY`	The token from Step 1
`KANDJI_SUBDOMAIN`	Tenant prefix only — not the full host	`acme`

KANDJI_SUBDOMAIN is the single most common setup mistake. ConfigView builds the API host as https://{subdomain}.api.kandji.io/api/v1. Putting the full hostname in produces a 404 on every script, which the health check calls out explicitly.

Step 3: Enable the Kandji scripts in ConfigView

Go to: https://{companyname}.configview.com/admin/integrations/kandji
Click Connect. ConfigView creates its tables and schedules every collector at your default run time.
Click Verify now to confirm the credentials work.

Devices

Devices is the parent for thirteen others — enable it first, and ConfigView will run it before the rest automatically.

Script	Notes
Devices	The fleet list. Every device sub-resource below depends on this.
Device Details	Full hardware, OS, network and security detail per device.
Device Apps	Installed applications per device.
Device Library Items	Which library items are assigned to each device, and their state.
Device Activity	Per-device activity history.
Device Commands	MDM commands issued to each device.
Device Status	Current status per device.
Device Parameters	Kandji parameter results per device.
Device Notes	Admin notes attached to devices.
Device Lost Mode	Lost-mode state and location.

Device secrets — read before enabling

These four retrieve recovery credentials. Each is a per-device call.

Script	What it stores
Firevault Recovery Key	The FileVault personal recovery key for each Mac.
Device Unlock Pin	The unlock PIN for each device.
Device Recovery Lock Password	The recovery lock password for Apple silicon Macs.
Activation Lock Bypass Code	The Activation Lock bypass code for each device.

Enable these only if you have a specific reason to hold that material in ConfigView, and make sure the access controls on your ConfigView database match the sensitivity. If you only want to know whether FileVault is on, use Prism — FileVault instead: it reports encryption state without copying the keys.

Prism

Prism is Kandji’s own inventory-reporting layer. Each script is one Prism table, and none of them depend on anything.

Scripts
Activation Lock, Application Firewall, Applications, Cellular, Certificates, Desktop and Screensaver, Device Information, FileVault, Gatekeeper and XProtect, Installed Profiles, Kernel Extensions, Launch Agents and Daemons, Local Users, Startup Settings, System Extensions, Transparency Database

Library and blueprints

Script	Notes
Library — Custom Apps / Custom Profiles / Custom Scripts / In-House Apps	The four library item types.
Library Item Status	Install status per library item. Depends on all four library scripts.
Library Item Activity	Activity history per library item. Depends on all four library scripts.
Blueprint	Blueprints defined in the tenant.
Blueprint Library	Library items attached to each blueprint. Depends on Blueprint.
Blueprint Templates	Blueprint templates.
Blueprint Routing / Blueprint Routing Activity	Assignment rules and their history.

Vulnerabilities and threats

Script	Notes
Vulnerabilities	The CVE list. Three scripts depend on it.
Vulnerability Details	Detail per CVE. Depends on Vulnerabilities.
Vulnerability — Affected Devices	Which devices are affected per CVE. Depends on Vulnerabilities.
Vulnerability — Affected Software	Which software is affected per CVE. Depends on Vulnerabilities.
Vulnerability Detections	Raw detections.
Threat Details / Threat Details (v2)	Malware threat detail. See the v1/v2 note below.
Behavioral Detections / Behavioral Detections (v2)	Behavioural detections. See the v1/v2 note below.

Everything else

Script	Notes
Users	Kandji user directory.
Users Info	Detail per user. Depends on Users.
ADE Integrations	Automated Device Enrollment tokens.
ADE Devices	Devices across all ADE tokens.
ADE Devices by Token	Devices per ADE token. Depends on ADE Integrations.
Tags	Device tags.
Audit Events	Kandji audit log.
Licensing	Seat licensing for the tenant.
Self Service Categories	Self Service catalogue structure.

Step 4: Verify

Go to: https://{companyname}.configview.com/admin/integrations/kandji
Click Verify now to confirm the credentials work.

It probes the three top-level resources — devices, blueprints and users — because everything else hangs off those. If a check fails:

401 — KANDJI_API_KEY is wrong or was revoked. Reissue from Step 1.
404 — KANDJI_SUBDOMAIN is wrong. It is the tenant prefix, not the full host.
One family returns 403 while others work — The token is missing that permission. Kandji scopes tokens per endpoint family, so this is normal and fixable in Settings → Access without reissuing the token.

Data Tables

All tables include a run_at column for historical tracking. Every path below is relative to https://{subdomain}.api.kandji.io/api/v1.

Table	Source
`kandji_devices`	`/devices`
`kandji_device_details`	`/devices/{id}/details`
`kandji_devices_apps`	`/devices/{id}/apps`
`kandji_devices_library_items`	`/devices/{id}/library-items`
`kandji_device_activity`	`/devices/{id}/activity`
`kandji_device_commands`	`/devices/{id}/commands`
`kandji_device_status`	`/devices/{id}/status`
`kandji_device_parameters`	`/devices/{id}/parameters`
`kandji_device_notes`	`/devices/{id}/notes`
`kandji_device_lost_mode`	`/devices/{id}/details/lostmode`
`kandji_device_firevault_recovery_key`	`/devices/{id}/secrets/filevaultkey`
`kandji_device_unlock_pin`	`/devices/{id}/secrets/unlockpin`
`kandji_device_recovery_lock_password`	`/devices/{id}/secrets/recoverypassword`
`kandji_device_activation_lock_bypass_code`	`/devices/{id}/secrets/bypasscode`
`kandji_prism_*` (16 tables)	`/prism/{table}`
`kandji_library_custom_apps`	`/library/custom-apps`
`kandji_library_custom_profiles`	`/library/custom-profiles`
`kandji_library_custom_scripts`	`/library/custom-scripts`
`kandji_library_inhouse_apps`	`/library/ipa-apps`
`kandji_library_item_status`	`/library/library-items/{id}/status`
`kandji_library_item_activity`	`/library/library-items/{id}/activity`
`kandji_blueprint`	`/blueprints`
`kandji_blueprint_library`	`/blueprints/{id}/list-library-items`
`kandji_blueprint_templates`	`/blueprints/templates/`
`kandji_blueprint_routing`	`/blueprint-routing/`
`kandji_blueprint_routing_activity`	`/blueprint-routing/activity`
`kandji_vulnerabilities`	`/vulnerability-management/vulnerabilities`
`kandji_vulnerability_details`	`/vulnerability-management/vulnerabilities/{cve}`
`kandji_vulnerability_affected_devices`	`/vulnerability-management/vulnerabilities/{cve}/devices`
`kandji_vulnerability_affected_software`	`/vulnerability-management/vulnerabilities/{cve}/software`
`kandji_vulnerability_detections`	`/vulnerability-management/detections`
`kandji_threat_details` / `_v2`	`/threat-details` / `/threat/threat-details`
`kandji_behavioral_detections` / `_v2`	`/behavioral-detections` / `/threat/behavioral-detections/events`
`kandji_users` / `kandji_users_info`	`/users` / `/users/{id}`
`kandji_ade_integrations`	`/integrations/apple/ade`
`kandji_ade_devices`	`/integrations/apple/ade/devices`
`kandji_ade_token_devices`	`/integrations/apple/ade/{token_id}/devices`
`kandji_tags`	`/tags`
`kandji_audit_events`	`/audit/events`
`kandji_licensing`	`/settings/licensing`
`kandji_self_service_categories`	`/self-service/categories`

Things worth knowing

Fourteen scripts make one call per device. Every Device * script iterates the fleet, so their runtime scales linearly with device count, not with how much changed. On a large fleet, enabling all fourteen turns a quick run into a long one. Pick the ones you actually query — Device Details and Device Apps carry most of the value — and schedule the rest less often. Prism duplicates some of what Device Details already has. Prism is Kandji’s own reporting layer, so kandji_prism_device_information and kandji_device_details overlap. Prism is one call per table rather than one per device, which makes it dramatically cheaper for fleet-wide questions. Prefer Prism for “how many Macs have X” and Device Details for per-device drill-down. There are v1 and v2 pairs for threats and behavioural detections. ConfigView ships both because tenants are on different Kandji versions and neither endpoint is universally available. Enable one of each pair — whichever returns data for your tenant — rather than both, or the two tables will tell overlapping stories. Kandji is the serial-number source of truth for Apple hardware. kandji_devices carries hardware serials, which makes it the natural join key against anything else that knows serials. Tools that only know hostnames or MACs — Rapid7, for instance — need a name-to-serial bridge through Kandji to reconcile. kandji_licensing answers the seat question directly. If you are reconciling what you pay Kandji against what you deploy, that table plus a count of kandji_devices is the whole comparison.

​Step 1: Create the Kandji API token

​Step 2: Add the secrets to ConfigView

​Step 3: Enable the Kandji scripts in ConfigView

​Devices

​Device secrets — read before enabling

​Prism

​Library and blueprints

​Vulnerabilities and threats

​Everything else

​Step 4: Verify

​Data Tables

​Things worth knowing