Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

At this year’s WWDC, Apple announced an expanded Apple Business API. This update allows IT admins to retrieve device information, review audit events, and assign or unassign devices directly via the API. It is a fantastic update for enterprise IT folks building on Apple and Apple Business, but properly configuring the API can be a bit frustrating according to reports from developers.

About Apple @ Work: Bradley Chambers has been an Apple IT admin since 2009. Through his experience deploying and managing firewalls, switches, a mobile device management system, enterprise grade WiFi, 1000s of Macs, and 1000s of iPads, Bradley will highlight ways in which Apple IT managers deploy Apple devices, build networks to support them, train users, share stories from the trenches of IT management, and ways Apple could improve its products for IT departments.

Navigating Apple Business roles

When testing these new APIs, it’s been reported that you are likely to encounter a 403 Forbidden error when using the Audit Events API. The API returns a message stating that the currently used API key does not allow the request.

Apple provides pretty detailed documentation for creating an API account in Apple Business. The data access section says you need permission to access audit events via the Admin API, but it’s not clear how to apply that same permission to your account.

While digging through the official API docs, you will find some limitations you should be aware of. Organizations can have up to 50 API accounts and create up to 15 custom roles in Apple Business Manager. Any user who can view, edit, and delete roles can change specific permissions for all default roles.

To fix the 403 error, you need to adjust the permissions on your API account. To create or edit a custom role, navigate to Settings> Roles and Permissions. When creating a custom role, you can base it on an existing role and simply add permissions.

The Roles Checker tool

The default Apple Business Manager roles include IT Administrator, Marketing Administrator, People Manager, Device Enrollment Manager, and Content Manager. Checking all the individual organization permissions for each role is incredibly tedious.

To solve this exact problem, the folks over at AppleShare IT built a really handy web tool to help guide you. Using Claude, they turned the massive Apple default roles and permissions document into a simple, wizard-style checklist that is 100% worth bookmarking.

With the Apple Business Roles Checker, you can simply check the specific organization permissions you need for your API account. The tool then tells you which default role already covers those permissions. If a default role doesn’t cover everything, it guides you exactly how to customize an existing role to meet your needs without starting from scratch.

9to5Mac’s take

This web app example of the MacAdmins community building tools to help their fellow IT person while solving a need for themselves. The expanded Apple Business API will be incredibly powerful for managing and automating large fleets of devices.

If you are setting up new API accounts and want to avoid the 403 forbidden error, do yourself a favor and bookmark the Roles Checker tool website. I love seeing the MacAdins community continue to give back to each other!

Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.