<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Mobile MDM Security Assessment

## iOS Profile Commands
```bash
security cms -D -i profile.mobileconfig       # Decode signed profile
plutil -p profile.mobileconfig                 # Pretty-print plist
ideviceprovision list                          # List provisioning profiles
ideviceinfo -q com.apple.mobile.lockdown       # Device lockdown info
cfgutil get-profile                            # Configuration Utility
```

## Android Device Policy
```bash
adb shell dumpsys device_policy                # Full policy dump
adb shell dumpsys device_policy | grep admin   # Active admins
adb shell getprop ro.crypto.state              # Encryption status
adb shell settings get secure lock_pattern_autolock  # Lock settings
adb shell pm list packages -e | grep mdm       # MDM packages
adb shell content query --uri content://com.android.providers.settings/system
```

## MDM API Endpoints (Common)
```bash
# Jamf Pro
curl https://jamf.corp.com/JSSResource/computers -u admin:pass
curl https://jamf.corp.com/api/v1/mobile-devices -H "Authorization: Bearer TOKEN"

# Microsoft Intune (Graph API)
curl https://graph.microsoft.com/v1.0/deviceManagement/managedDevices \
  -H "Authorization: Bearer TOKEN"

# Workspace ONE
curl https://ws1.corp.com/api/mdm/devices/search \
  -H "aw-tenant-code: TENANT" -H "Authorization: Basic BASE64"
```

## Certificate Analysis
```bash
openssl x509 -in cert.pem -text -noout         # Certificate details
openssl verify -CAfile ca.pem cert.pem          # Chain verification
openssl s_client -connect host:443              # TLS connection test
openssl pkcs12 -in identity.p12 -nokeys -out cert.pem  # Extract cert
```

## Profile Payload Types
| PayloadType | Description |
|-------------|-------------|
| `com.apple.mdm` | MDM enrollment |
| `com.apple.wifi.managed` | Wi-Fi configuration |
| `com.apple.vpn.managed` | VPN configuration |
| `com.apple.security.scep` | SCEP certificate enrollment |
| `com.apple.security.pkcs12` | Certificate identity |
| `com.apple.mail.managed` | Email account |
