NomidAPI Reference
Complete reference documentation for the Nomid MDM External API. Find detailed information about endpoints, parameters, and response formats.
Base URL
https://api.nomid.tech/emm/api/v1 Documentation Sections
Authentication
Learn how to authenticate your API requests using API keys.
Assets
Endpoints for listing, filtering, and retrieving asset information.
Policies
Endpoints for accessing policy data and device assignments.
Errors
Understanding error responses and status codes.
BI Integration
Flattened data exports for Business Intelligence tools.
Device commands API
Send a command to one device at a time with a REST call, from lock, reboot and messages to destructive commands such as wipe.
Policy changes API
Change policy settings, apps, Wi-Fi networks and more, create a policy from scratch or as a copy, or roll one back, with a review step before anything is applied.
Provisioning QR codes API
Create a QR code that enrolls a new Android device with a policy, with its own enrollment token valid for 24 hours.
All Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /assets | List all assets with pagination and filtering |
| GET | /assets/count | Get total count of assets |
| GET | /assets/{id} | Get details of a specific asset |
| GET | /policies | List all policies |
| GET | /policies/{pathName} | Get details of a specific policy |
| GET | /assets/summary | Get aggregate fleet numbers: totals, a status breakdown and a security posture summary |
| GET | /assets/{assetId}/commands | List the most recent commands sent to a device |
| POST | /assets/{assetId}/commands/lock | Lock the device screen immediately. Android Management devices only. No request body. |
| POST | /assets/{assetId}/commands/lost-mode | Lock the device and show a message, with optional contact details, on its lock screen. Android Management devices only. |
| POST | /assets/{assetId}/commands/found | End lost mode. Nothing happens, and no error is returned, if the device was not in lost mode. Android Management devices only. No request body. |
| POST | /assets/{assetId}/commands/message | Show a plain-text push notification on the device. |
| POST | /assets/{assetId}/commands/status-report | Ask the device to send a fresh status report now. The report arrives later: read it with GET /assets/ASSET_ID. No request body. |
| POST | /assets/{assetId}/commands/location-update | Ask the device to report its current location now. The location arrives later: read it with GET /assets/ASSET_ID. No request body. |
| POST | /assets/{assetId}/commands/sync-policy | Send the device its current policy again. Devices managed by the Nomid agent (AOSP) only: Android Management devices receive policy changes automatically and answer 409. No request body. |
| POST | /assets/{assetId}/commands/reboot | Restart the device now. Whoever is using it is interrupted, and unsaved work may be lost. No request body. |
| POST | /assets/{assetId}/commands/shutdown | Power the device off now. It cannot be turned back on remotely. Devices managed by the Nomid agent (AOSP) only. No request body. |
| POST | /assets/{assetId}/commands/launch-app | Open an installed app on the device by package name. Devices managed by the Nomid agent (AOSP) only. |
| POST | /assets/{assetId}/commands/clear-app-data | Delete all data of the given apps (accounts, settings and files), as if they had just been installed. It cannot be undone. Android Management devices only. |
| POST | /assets/{assetId}/commands/change-policy | Move the device to another policy of the company. The device applies the new policy's apps, restrictions and settings, and anything only the current policy had is removed. Also needs POLICIES_READ. |
| POST | /assets/{assetId}/commands/wipe | Remove the device from management and erase its managed data. A company-owned device is factory reset: every app and all data on it are erased. On a personally owned device with a work profile, only the work profile and its apps and data are removed; personal apps and data stay. Irreversible. No request body. |
| POST | /assets/{assetId}/commands/reset-screen-lock | Remove the device's screen lock (PIN, pattern or password), so it can be unlocked without one. Android Management devices only. No request body. |
| POST | /assets/{assetId}/commands/change-screen-lock-password | Set a new screen lock password. The device locks, and only the new password unlocks it. Android Management devices only. |
| POST | /assets/{assetId}/commands/relinquish-ownership | Release a company-owned device to its user. The work profile and its data are removed, and the device is no longer managed. Irreversible. No request body. |
| GET | /policies/{policyId}/settings | The policy's editable settings, each with its current value, allowed values, group and whether changing it is high impact. Also returns the policy version, deviceCount, whether the policy is editable, and its apps, each with packageName, name, source, installType and managedByNomid, which is true for the apps that cannot be changed here. |
| GET | /policies/{policyId}/document | The policy's full configuration as JSON in value, or only the part at path, a JSON Pointer such as /openNetworkConfigurations. An app is addressed by its package name, as in /apps/com.example.app. Secrets come back as a marker, an object with redacted set to true, and so does every value of an app's managed configuration. Without path, apps are summarized with packageName, name, source, installType and managedConfigurationKeys. Also returns policyId, displayName, version, deviceCount, editable and lockedFields, the fields the edits endpoint refuses, each with the reason. A part longer than 30000 characters returns fieldSizes instead of value: read a narrower path. Returns 422 when path names an app the policy does not have. |
| GET | /policies/{policyId}/revisions | The policy's saved revisions, newest first, with when and by whom each was saved. limit is optional, from 1 to 100, default 20. |
| GET | /policy-proposals/{proposalId} | A proposal made by this key, with its change list and status: PENDING, EXECUTING, SUCCEEDED, FAILED, UNCONFIRMED or EXPIRED. |
| POST | /policies/{policyId}/changes | Propose setting changes to an existing policy. Returns 201 with the proposal. |
| POST | /policies/{policyId}/app-changes | Propose adding apps to an existing policy, removing them or changing how they are installed. Returns 201 with the proposal. |
| POST | /policies/{policyId}/edits | Propose changes to any editable part of an existing policy, as JSON Pointer edits of its document. Returns 201 with the proposal. |
| POST | /policies | Propose a new policy, with optional setting changes. With fromPolicyId it is a copy of that policy, and without changes a duplicate. Without fromPolicyId it starts from Nomid's defaults. Returns 201 with the proposal. |
| POST | /policies/{policyId}/rollbacks | Propose restoring the policy to an earlier revision. Returns 201 with the proposal. |
| POST | /policy-proposals/{proposalId}/apply | Apply a pending proposal. Returns 200 with the proposal and its result: policyId, displayName, version and a portal link. |
| POST | /policies/{policyId}/provisioning-qr-codes | Create a provisioning QR code for a policy, with a new enrollment token |
Content Types
All requests and responses use JSON format. Set the Content-Type header accordingly.
Content-Type: application/json