> ## Documentation Index
> Fetch the complete documentation index at: https://serval-hannah-docs-custom-access.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Kandji

## About Kandji

Kandji is a cloud-native Apple device-management (MDM) and security platform that helps IT and InfoSec teams deploy, configure and protect Apple devices at scale through deep automation and policy-driven controls. Connecting Kandji to Serval lets you pull real-time inventory, enforce compliance and run remote commands directly from chat.

## What the Kandji integration enables

| Capability           | Description                                                                 |
| -------------------- | --------------------------------------------------------------------------- |
| Access Management    | Remove users from Kandji                                                    |
| Automation workflows | Streamline device provisioning and management, enforce compliance, and more |

Anything defined in the [Kandji API](https://api-docs.kandji.io/#intro) can be accessed through Serval.

***

## Kandji configuration (generate an API token)

### Who Can Create API Tokens?

| Kandji Role                               | Access to Settings ▸ Access ▸ API Tokens | Notes                                                                                        |
| ----------------------------------------- | ---------------------------------------- | -------------------------------------------------------------------------------------------- |
| Account Owner                             | ✅                                        | Full, non-revocable access.                                                                  |
| Administrator                             | ✅                                        | Full access; can be revoked by other admins.                                                 |
| Standard / Help Desk / Auditor-type roles | ❌ (by default)                           | Can only create a token if their custom role is explicitly granted the API Token permission. |

> **Note:** Roles without Settings access (e.g., Standard, Help Desk) cannot reach the Access tab unless a custom permission set is applied.

***

### Kandji API Setup

Follow the steps provided by Kandji to create your API Token here: [Kandji API Setup Guide](https://support.kandji.io/kb/kandji-api#what-is-the-kandji-api)

<Note>
  **Converting your Kandji domain to Service Instance ID:**

  * If your Kandji instance is `acme.kandji.io`
  * Your Service Instance ID is `acme.api.kandji.io`
  * Simply insert `.api` after your subdomain

  For example: `[subdomain].kandji.io` → `[subdomain].api.kandji.io`
</Note>

***

With your Kandji API token and Service Instance ID (API domain) in hand, you're ready to move on to Part 4—connecting Serval so it can automate Apple device workflows on your behalf.

***

## Serval Configuration

<Note>
  **Quick reference:**

  * If your Kandji URL is: `https://acme.kandji.io`
  * Enter: `acme.api.kandji.io`
  * (Just add `.api` after your subdomain!)
</Note>

1. In Serval go to **Apps → Available → Kandji → Connect**.
2. Enter your **Service Instance ID** and the **Bearer Token** you generated above.
   * Service Instance ID format: `[your-subdomain].api.kandji.io`
   * Example: If you access Kandji at `acme.kandji.io`, enter `acme.api.kandji.io`
3. Click **Save**.

You can rotate or scope the token at any time—just reconnect the app to update the value in Serval to keep workflows running.