Docs · Connect your tools
Connect Jamf Pro
StackWeaver reads, and never changes, the computer records in your Jamf Pro once a day. You create an API client in Jamf Pro with one read-only privilege and paste its URL, client ID and client secret into StackWeaver. This guide says what is read, what the privilege allows and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver lists your computers through the Jamf Pro API (Jamf). Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail. StackWeaver keeps counts and opaque Jamf computer ids. It does not keep serial numbers, computer names, user names or e-mail addresses (what is stored).
| Check (as shown in the portal) | What it looks at |
|---|---|
| Managed computers have disk encryption on | Whether FileVault 2 is on for each managed computer |
| Managed computers run a supported macOS | Managed computers below macOS 14 are shown as a failure: a StackWeaver threshold, not Apple's support status |
| Managed computers are in contact with Jamf Pro | Managed computers with no contact for 30 days or more |
| Managed and unmanaged computers | Counts only, no threshold |
2. What it does not do
- It never writes to Jamf Pro: one token request, then read requests only.
- It does not support Jamf Now. It connects to Jamf Pro only.
- It does not say your fleet meets any standard. A result is what Jamf Pro returned at a certain time.
3. The access it needs
One API privilege, Read Computers. Jamf's API sign-in does not support single sign-on (Jamf), so you create an API client: an API role with only Read Computers, and a client that uses it. API clients need Jamf Pro 10.49.0 or later (Jamf); the computer inventory version StackWeaver uses is newer, and Jamf's reference does not say from which Jamf Pro version it is available, so the connection test tells you if yours is too old.
StackWeaver does not use the older Classic API computer endpoints, which Jamf deprecates from Jamf Pro 11.15.0 (Jamf). It cannot see from the token how narrow your role is, so give the role no Create, Update or Delete privilege when you create it.
The Jamf Pro URL. It must be https, a public host name (not an IP address, not localhost, not an internal name), on port 443 or 8443, with no path. StackWeaver checks this before it sends anything, and does not follow redirects.
4. Connect steps
- In Jamf Pro, open Settings, System, API roles and clients. Create an API role with only the Read Computers privilege.
- Create an API client that uses that role, enable it, and generate the client secret. Copy the client ID and the secret.
- In StackWeaver, open Evidence, then the Jamf Pro section. Enter the Jamf Pro URL, the client ID and the client secret, and save. The secret is stored encrypted and is never shown again.
- Press Test connection. StackWeaver confirms it can read computers, then runs the checks.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | Jamf Pro returned data that meets the threshold at that time |
| Fail | Jamf Pro returned data that does not meet the threshold |
| Not enabled | There was nothing to check, for example no managed computers |
| Could not check | StackWeaver could not read the data, or the fleet was too large to read completely |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Jamf Pro section. StackWeaver deletes the stored client secret.
- In Jamf Pro, disable or delete the API client under API roles and clients, so the secret stops working there as well.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| The Jamf Pro URL is not valid | Use https://yourname.jamfcloud.com or your own host name, with no path and no IP address |
| Jamf Now is not supported | StackWeaver connects to Jamf Pro only |
| Jamf Pro refused the API client ID and secret | Check them, that the client is enabled, and that it has an API role |
| Jamf Pro would not let StackWeaver read computers | Give the API role the Read Computers privilege |
| This Jamf Pro does not offer the v4 computer inventory endpoint | Upgrade Jamf Pro, then test again |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.