An API for your tools. An MCP server for your AI.
The Customer API covers devices, local admin, runbooks, the app store and tenant setup, with OpenAPI docs you can try in the browser. The MCP server gives AI assistants read-only access to your fleet. And the PowerShell module scripts the onboarding.
- OpenAPI with interactive docs
- MCP server with six tools
- PowerShell module
- Open-source runbooks
# Device state, Intune part onlycurl -u "t-<tenant-id>:<api-secret>" \ "https://customer-api.realmjoin.com/device/<device-id>/state?path=Intune"# Request a support account for helpdeskcurl -u "t-<tenant-id>:<api-secret>" -X POST \ "https://customer-api.realmjoin.com/laps/request"
# User name t-<tenant-id>, password = API secret$cred = Get-CredentialInvoke-RestMethod -Authentication Basic -Credential $cred ` -Uri "https://customer-api.realmjoin.com/device/list"Invoke-RestMethod -Authentication Basic -Credential $cred ` -Uri "https://customer-api.realmjoin.com/tenant/stats"
// Example client configuration; the exact format depends on your client{ "mcpServers": { "realmjoin": { "url": "https://customer-api.realmjoin.com/mcp", "headers": { "Authorization": "Bearer rjm_…" } } }}
The Customer API
A REST API per tenant, authenticated with your tenant ID and an API secret. Each area is switched on separately, so a helpdesk integration gets LAPS and nothing else.
OpenAPI and Scalar
The spec at
/openapi/v1.json, an interactive reference at/scalar/v1.Scopes per tenant
Eight API areas plus the MCP server, each switched on on its own.
Rate limits
Device endpoints at 30 and MCP at 60 requests per minute per tenant.
Audit
Calls that change something are logged to your workspace like portal actions.Read the docs · Open the API reference
Endpoints
The customer-facing routes, grouped by area. Filter to see one area.
| Route | What it does |
|---|---|
| GET/device/list | Devices with primary and secondary users and last seen. |
| GET/device/{id}/state | Full device state by RealmJoin, Entra or Intune ID, or only the paths you ask for. |
| POST/laps/request | Request a support account; returns the time until the device's next check-in. |
| POST/laps/retrieve | Fetch the support account's password once it's escrowed. |
| POST/runbook/{runbookName}/run | Run a runbook and wait for the result, for jobs up to an hour. |
| POST/runbook/{runbookName}/start | Start a runbook in the background and get a job ID. |
| GET/runbook/jobs/{jobID}/status | Status of a job. |
| GET/runbook/jobs/{jobID}/output/text | Output as text. |
| GET/runbook/jobs/{jobID}/output/streams | All output streams. |
| GET/runbook/jobs/{jobID}/exception/text | Exception text of a failed job. |
| GET/store/apps | Search and page through the Package Store. |
| GET/store/apps/{id} | One package with its details. |
| GET/store/subscribed | Your subscribed packages. |
| POST/store/subscribed | Subscribe a package through Intune or RealmJoin, with automation, deferral, night window and time zone. |
| GET/store/subscribed/{id} | One subscription. |
| GET/store/subscribed/status/{id} | Progress of a subscribe operation. |
| POST/tenant/connect | Scripted onboarding with a one-time token. |
| POST/tenant/logingestion-config | Connect your Log Analytics workspace. |
| POST/tenant/runbooks-config | Connect your Azure Automation account. |
| GET/tenant/stats | Active and total devices, users and packages. |
Partner and display integrations have a few more routes; see the API reference.
Ask your fleet
The built-in MCP server lets AI assistants that speak the Model Context Protocol look things up in RealmJoin: a device's state, a machine by name, the spread of a package across the fleet. Tokens are named, expire, can be revoked at any time and show when they were last used.
Six read-only tools
The RealmJoin PowerShell module
For tenants that want every permission granted by hand, or partners who onboard many tenants, the module on the PowerShell Gallery does the setup: onboarding with a token from the portal, connecting Log Analytics and Azure Automation.
Install-Module RealmJoin
Complete-RJTenantOnboarding -Token <token>
Set-RJLogAnalyticsWorkspace
Set-RJAutomationAccountLog tables for KQL and Sentinel
RealmJoin writes into your workspace through the Logs Ingestion API with a data collection rule, no shared keys. Three custom tables hold what happened:
- RJAuditLogs_CL
- Who changed what
- RJOperationalLogs_CL
- What RealmJoin did
- RJRunbookLogs_CL
- Every runbook job
Open source, where it helps you
The parts you'd want to read, extend or reuse are public on GitHub.
Runbook library
175 runbooks for users, groups, devices and the organization.
Remediation scripts
Intune detection and remediation scripts, synced into the portal.
Runbook helper module
The PowerShell module behind
Use-RJInterfaceand friends.Your own runbooks
A starting point for customer-specific runbooks.
Custom packages
A jumpstarter for building your own packages.
.NET libraries
Lean clients for Microsoft Graph and Azure, and Blazor components.
Connect RealmJoin to the rest of your stack.
Your ITSM, your SIEM, your AI assistant. Start with a tenant and an API secret.