Skip to content
Go to k12panel.com
  • There are no suggestions because the search field is empty.

Getting started with the k12panel API

The k12panel API lets your own programs read and update your organization's data — assets, check-ins/outs, and people — without going through the web interface. This article walks through creating a key and making your first call.

The API is Windows/agent-agnostic: it works the same whether your devices run the agent or are synced from an MDM. No changes are made to any device by these calls.

Before you start

  • You need an administrator account in k12panel to create API keys.
  • Calls are made over HTTPS to https://<your-panel-domain>/api/public/v1/.
  • The full, always-current endpoint reference lives at https://<your-panel-domain>/api/public/v1/docs (interactive) — this KB teaches the concepts and common workflows; the reference documents every field.

Create an API key

  1. Go to Settings → API Keys.
  2. Click Create API Key.
  3. Give it a name (for example, "Ticketing System") — this name appears in check-in/out history so you can tell API actions apart from staff actions.
  4. Choose the permissions the key should have (see below).
  5. Optionally set an expiration date (leave blank for a key that never expires).
  6. Click Create Key. Copy the key now — it is shown only once. If you lose it, rotate the key to get a new one.

Permissions

 

Create separate keys for separate purposes — for example, a read-only key for a reporting tool, and a read-write key for a system that checks devices in and out.

The three monitoring permissions are separate so you can share a narrow slice: a key with inventory:read can report on hardware and patching without ever seeing antivirus threats.

A key only has the permissions you grant it. Available permissions:

Permission Allows
reference:read List your sites, groups, classes, and tags
assets:read List and view assets
assets:write Create, update, and retire assets
tags:write Flag and unflag devices with Asset Tags
checkouts:write Check devices in and out
people:read View people and what they have checked out
people:write Create, edit, and remove people, and manage their group membership
health:read Read PC Health state, open issues, and the policy in force
security:read Read antivirus posture and threat counts
inventory:read Read hardware, OS, and Windows Update inventory
health:write Mute and unmute health issues
security:write Acknowledge and restore Defender detections
cases:read Read service cases and their notes
commands:read Read device commands and the output they returned
commands:execute Force poll, reboot, shut down, restart the agent, run a Quick Command from your library, and cancel
commands:script Send arbitrary command text to a device

Create separate keys for separate purposes — for example, a read-only key for a reporting tool, and a read-write key for a system that checks devices in and out.

The three monitoring permissions are separate so you can share a narrow slice: a key with inventory:read can report on hardware and patching without ever seeing antivirus threats. 

The three command permissions are separate for the same reason, one level up: they are the only ones that act on a physical device. Most integrations need commands:execute (which includes running a script you have already reviewed and named in your Quick Command library) and never need commands:script. 

Make your first call

Send your key as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer k12_live_xxxxxxxxxxxx_yyyy..." \
   https://<your-panel-domain>/api/public/v1/sites

You'll get back your organization's sites, each with an id you can use in other calls. That id is the same id you see in the app and in CSV exports.