Read devices and agent versions

Enable Read → Devices (READ_DEVICES) on an API service key. Existing keys need the permission added explicitly. Oneleet Agent must be enabled for the workspace. This permission grants device reads, including device details and compliance status; it does not grant device updates or commands.

Use these existing REST endpoints:

GET /api/v1/tenants/{tenant}/tenant-devices
GET /api/v1/tenant-devices/{tenant-device}

The corresponding MCP tools are TenantDeviceList and TenantDeviceGet. Use agentInfo.agentVersion for the reported agent version and agentInfo.lastPing for the recorded contact time. Unreported values may be absent. Neither field establishes whether auto-update is working.

Service-key and OAuth lists default to 25 devices. Pass limit (1–100) and follow nextCursor as cursor with the same workspace until nextCursor is absent. Pages include archived devices and are ordered by workspace device ID. This is a live listing; changes during pagination may affect later pages.

curl --fail-with-body \
  -H "Authorization: Bearer $ONELEET_API_TOKEN" \
  "https://api.oneleet.com/api/v1/tenants/$ONELEET_TENANT_ID/tenant-devices?limit=25"

For MCP, the workspace is inferred from the connection; an explicit tenant must match it. TenantDeviceGet takes tenant-device, the id from a list row. MCP tool results are limited to 1 MiB; request smaller pages if needed. These tools return JSON to the client. Bulk artifact export is a separate feature.

OAuth connections require the corresponding READ_DEVICES permission configured and granted by the authorization server, plus fresh consent. The signed-in user’s normal workspace permissions still apply. Under the standard roles, members can list devices; device detail reads require an administrator or auditor role.