Update custom fields and maintenance windows, run automation and retry writes safely.
The API and MCP support queued jobs, scheduled power, agent uninstall, endpoint diagnostics, command cancellation and third-party patch policies. Reuse idempotency keys and inspect receipts. Temporary administrator credentials are returned once. Traffic monitoring requires existing entitlement; billing remains in the application.
Check your permissions
Presets select individual capabilities; they do not change the access level. New credentials in Settings use FullAccess by default, but only the selected capabilities are allowed. Older ReadWrite credentials allow approved custom-field and maintenance changes. Automation and device control need FullAccess plus their specific capabilities. Check GET /v1/operations/capabilities before writing. Company scope and the current owner permissions still apply.
Avoid overwriting another change
Read the custom field and its version. Send your new value and the version you read to PATCH /v1/custom-fields/{fieldId}. A 409 version_conflict means someone changed it first. Read it again and decide whether your update is still appropriate.
Retry safely
For POST /v1/maintenance-windows, send an Idempotency-Key header. After an uncertain result, repeat the same key and body to retrieve the original window rather than create a duplicate. A changed body with the same key is rejected. DELETE /v1/maintenance-windows/{windowId} cancels a window.
Follow action receipts
Automation and management writes use idempotencyKey in the JSON body and return an operation receipt. Completed means the request handler finished; check the result or domain run to learn whether the device finished the work. For OutcomeUnknown, inspect the receipt and current state before deciding what to do. Never automatically resend under a new key: the action could run twice.