> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Kandji setup ConfigView pulls your Apple device fleet from **Kandji** through a single API token — devices and their full hardware/OS detail, the library items assigned to them, blueprints, vulnerabilities, threat detections, and the Prism inventory tables. You will end up with **2 secrets** in ConfigView (`KANDJI_API_KEY`, `KANDJI_SUBDOMAIN`) when setup is complete. > **Read the "Device secrets" section before you enable everything.** Seven of the 59 scripts retrieve FileVault recovery keys, unlock PINs, recovery lock passwords and Activation Lock bypass codes. Those are the credentials that unlock your fleet, and enabling those scripts copies them into your ConfigView database. That may be exactly what you want for break-glass reporting — but it is a deliberate decision, not a default. *** ## Step 1: Create the Kandji API token 1. Sign in to your Kandji tenant as an administrator 2. Go to **Settings** → **Access** → **API Token** 3. Create a new token and name it `ConfigView` 4. Copy the token — it is shown once 5. Grant the token permissions for the areas you intend to collect. Kandji scopes API tokens per endpoint family, so a token without a given permission returns `403` on just those scripts rather than failing wholesale. Note your **subdomain** — the tenant prefix in your Kandji URL. If you sign in at `https://acme.kandji.io`, the subdomain is `acme`. *** ## Step 2: Add the secrets to ConfigView 1. Go to your ConfigView dashboard: `https://{companyname}.configview.com/admin/integrations/kandji` 2. Under **Credentials**, enter each value and click the save icon on its row: | Secret name | Value | Example | | ------------------ | ------------------------------------------ | ------- | | `KANDJI_API_KEY` | The token from Step 1 | | | `KANDJI_SUBDOMAIN` | Tenant prefix only — **not** the full host | `acme` | > `KANDJI_SUBDOMAIN` is the single most common setup mistake. ConfigView builds the API host as `https://{subdomain}.api.kandji.io/api/v1`. Putting the full hostname in produces a `404` on every script, which the health check calls out explicitly. *** ## Step 3: Enable the Kandji scripts in ConfigView 1. Go to: `https://{companyname}.configview.com/admin/integrations/kandji` 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. 3. Click **Verify now** to confirm the credentials work. ### Devices **Devices** is the parent for thirteen others — enable it first, and ConfigView will run it before the rest automatically. | Script | Notes | | ------------------------ | ----------------------------------------------------------------- | | **Devices** | The fleet list. Every device sub-resource below depends on this. | | **Device Details** | Full hardware, OS, network and security detail per device. | | **Device Apps** | Installed applications per device. | | **Device Library Items** | Which library items are assigned to each device, and their state. | | **Device Activity** | Per-device activity history. | | **Device Commands** | MDM commands issued to each device. | | **Device Status** | Current status per device. | | **Device Parameters** | Kandji parameter results per device. | | **Device Notes** | Admin notes attached to devices. | | **Device Lost Mode** | Lost-mode state and location. | ### Device secrets — read before enabling These four retrieve recovery credentials. Each is a per-device call. | Script | What it stores | | --------------------------------- | -------------------------------------------------- | | **Firevault Recovery Key** | The FileVault personal recovery key for each Mac. | | **Device Unlock Pin** | The unlock PIN for each device. | | **Device Recovery Lock Password** | The recovery lock password for Apple silicon Macs. | | **Activation Lock Bypass Code** | The Activation Lock bypass code for each device. | > Enable these only if you have a specific reason to hold that material in ConfigView, and make sure the access controls on your ConfigView database match the sensitivity. If you only want to know *whether* FileVault is on, use **Prism — FileVault** instead: it reports encryption state without copying the keys. ### Prism Prism is Kandji's own inventory-reporting layer. Each script is one Prism table, and none of them depend on anything. | Scripts | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Activation Lock**, **Application Firewall**, **Applications**, **Cellular**, **Certificates**, **Desktop and Screensaver**, **Device Information**, **FileVault**, **Gatekeeper and XProtect**, **Installed Profiles**, **Kernel Extensions**, **Launch Agents and Daemons**, **Local Users**, **Startup Settings**, **System Extensions**, **Transparency Database** | ### Library and blueprints | Script | Notes | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | **Library — Custom Apps** / **Custom Profiles** / **Custom Scripts** / **In-House Apps** | The four library item types. | | **Library Item Status** | Install status per library item. **Depends on all four library scripts.** | | **Library Item Activity** | Activity history per library item. **Depends on all four library scripts.** | | **Blueprint** | Blueprints defined in the tenant. | | **Blueprint Library** | Library items attached to each blueprint. **Depends on Blueprint.** | | **Blueprint Templates** | Blueprint templates. | | **Blueprint Routing** / **Blueprint Routing Activity** | Assignment rules and their history. | ### Vulnerabilities and threats | Script | Notes | | ---------------------------------------------------------- | ------------------------------------------------------------------- | | **Vulnerabilities** | The CVE list. Three scripts depend on it. | | **Vulnerability Details** | Detail per CVE. **Depends on Vulnerabilities.** | | **Vulnerability — Affected Devices** | Which devices are affected per CVE. **Depends on Vulnerabilities.** | | **Vulnerability — Affected Software** | Which software is affected per CVE. **Depends on Vulnerabilities.** | | **Vulnerability Detections** | Raw detections. | | **Threat Details** / **Threat Details (v2)** | Malware threat detail. See the v1/v2 note below. | | **Behavioral Detections** / **Behavioral Detections (v2)** | Behavioural detections. See the v1/v2 note below. | ### Everything else | Script | Notes | | --------------------------- | ------------------------------------------------------- | | **Users** | Kandji user directory. | | **Users Info** | Detail per user. **Depends on Users.** | | **ADE Integrations** | Automated Device Enrollment tokens. | | **ADE Devices** | Devices across all ADE tokens. | | **ADE Devices by Token** | Devices per ADE token. **Depends on ADE Integrations.** | | **Tags** | Device tags. | | **Audit Events** | Kandji audit log. | | **Licensing** | Seat licensing for the tenant. | | **Self Service Categories** | Self Service catalogue structure. | *** ## Step 4: Verify 1. Go to: `https://{companyname}.configview.com/admin/integrations/kandji` 2. Click **Verify now** to confirm the credentials work. It probes the three top-level resources — devices, blueprints and users — because everything else hangs off those. If a check fails: * **`401`** — `KANDJI_API_KEY` is wrong or was revoked. Reissue from Step 1. * **`404`** — `KANDJI_SUBDOMAIN` is wrong. It is the tenant prefix, not the full host. * **One family returns `403` while others work** — The token is missing that permission. Kandji scopes tokens per endpoint family, so this is normal and fixable in **Settings** → **Access** without reissuing the token. *** ## Data Tables All tables include a `run_at` column for historical tracking. Every path below is relative to `https://{subdomain}.api.kandji.io/api/v1`. | Table | Source | | ------------------------------------------- | ----------------------------------------------------------------- | | `kandji_devices` | `/devices` | | `kandji_device_details` | `/devices/{id}/details` | | `kandji_devices_apps` | `/devices/{id}/apps` | | `kandji_devices_library_items` | `/devices/{id}/library-items` | | `kandji_device_activity` | `/devices/{id}/activity` | | `kandji_device_commands` | `/devices/{id}/commands` | | `kandji_device_status` | `/devices/{id}/status` | | `kandji_device_parameters` | `/devices/{id}/parameters` | | `kandji_device_notes` | `/devices/{id}/notes` | | `kandji_device_lost_mode` | `/devices/{id}/details/lostmode` | | `kandji_device_firevault_recovery_key` | `/devices/{id}/secrets/filevaultkey` | | `kandji_device_unlock_pin` | `/devices/{id}/secrets/unlockpin` | | `kandji_device_recovery_lock_password` | `/devices/{id}/secrets/recoverypassword` | | `kandji_device_activation_lock_bypass_code` | `/devices/{id}/secrets/bypasscode` | | `kandji_prism_*` (16 tables) | `/prism/{table}` | | `kandji_library_custom_apps` | `/library/custom-apps` | | `kandji_library_custom_profiles` | `/library/custom-profiles` | | `kandji_library_custom_scripts` | `/library/custom-scripts` | | `kandji_library_inhouse_apps` | `/library/ipa-apps` | | `kandji_library_item_status` | `/library/library-items/{id}/status` | | `kandji_library_item_activity` | `/library/library-items/{id}/activity` | | `kandji_blueprint` | `/blueprints` | | `kandji_blueprint_library` | `/blueprints/{id}/list-library-items` | | `kandji_blueprint_templates` | `/blueprints/templates/` | | `kandji_blueprint_routing` | `/blueprint-routing/` | | `kandji_blueprint_routing_activity` | `/blueprint-routing/activity` | | `kandji_vulnerabilities` | `/vulnerability-management/vulnerabilities` | | `kandji_vulnerability_details` | `/vulnerability-management/vulnerabilities/{cve}` | | `kandji_vulnerability_affected_devices` | `/vulnerability-management/vulnerabilities/{cve}/devices` | | `kandji_vulnerability_affected_software` | `/vulnerability-management/vulnerabilities/{cve}/software` | | `kandji_vulnerability_detections` | `/vulnerability-management/detections` | | `kandji_threat_details` / `_v2` | `/threat-details` / `/threat/threat-details` | | `kandji_behavioral_detections` / `_v2` | `/behavioral-detections` / `/threat/behavioral-detections/events` | | `kandji_users` / `kandji_users_info` | `/users` / `/users/{id}` | | `kandji_ade_integrations` | `/integrations/apple/ade` | | `kandji_ade_devices` | `/integrations/apple/ade/devices` | | `kandji_ade_token_devices` | `/integrations/apple/ade/{token_id}/devices` | | `kandji_tags` | `/tags` | | `kandji_audit_events` | `/audit/events` | | `kandji_licensing` | `/settings/licensing` | | `kandji_self_service_categories` | `/self-service/categories` | *** ## Things worth knowing **Fourteen scripts make one call per device.** Every `Device *` script iterates the fleet, so their runtime scales linearly with device count, not with how much changed. On a large fleet, enabling all fourteen turns a quick run into a long one. Pick the ones you actually query — **Device Details** and **Device Apps** carry most of the value — and schedule the rest less often. **Prism duplicates some of what Device Details already has.** Prism is Kandji's own reporting layer, so `kandji_prism_device_information` and `kandji_device_details` overlap. Prism is one call per table rather than one per device, which makes it dramatically cheaper for fleet-wide questions. Prefer Prism for "how many Macs have X" and Device Details for per-device drill-down. **There are v1 and v2 pairs for threats and behavioural detections.** ConfigView ships both because tenants are on different Kandji versions and neither endpoint is universally available. Enable one of each pair — whichever returns data for your tenant — rather than both, or the two tables will tell overlapping stories. **Kandji is the serial-number source of truth for Apple hardware.** `kandji_devices` carries hardware serials, which makes it the natural join key against anything else that knows serials. Tools that only know hostnames or MACs — Rapid7, for instance — need a name-to-serial bridge through Kandji to reconcile. **`kandji_licensing` answers the seat question directly.** If you are reconciling what you pay Kandji against what you deploy, that table plus a count of `kandji_devices` is the whole comparison.