ionvoy MDM Documentation

Overview

ionvoy is a unified Mobile Device Management (MDM) platform that replaces separate tools like Jamf and Microsoft Intune. One REST API and one dashboard cover Apple (iPhone, iPad, Mac), Android Enterprise, Samsung Knox and interactive display devices.

All device commands are asynchronous — commands are queued and pushed to devices over their native protocol (APNs for Apple, FCM for Android). The API returns immediately; use webhooks to receive command results.

Quick start

1. Get an API key

Sign in to app.ionvoy.com, open Settings → API Keys and create a new key. Store it securely — it is shown only once.

2. List your devices

curl https://api.ionvoy.com/api/v1/devices \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "x-organization-id: YOUR_ORG_ID"

3. Send a command

curl -X POST https://api.ionvoy.com/api/v1/devices/DEVICE_ID/commands \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "x-organization-id: YOUR_ORG_ID" \
  -H "Content-Type: application/json" \
  -d '{"type": "LOCK_DEVICE"}'

The response contains a commandId. Poll GET /commands/:id or set up a webhook to receive the result when the device acknowledges the command.

Authentication

All API requests require two headers:

• Authorization: Bearer <api_key>
• x-organization-id: <org_id>

Your organization ID is visible in Settings → Organization in the dashboard. API keys are scoped to a single organization and can be granted read-only or read-write access.

Apple MDM

ionvoy implements the Apple MDM protocol over APNs. Both supervised (DEP / Apple Business Manager) and user-enrolled (OTA profile) flows are supported.

Enrollment methods

• DEP / ADE — zero-touch enrollment via Apple Business Manager or Apple School Manager. Devices enroll automatically on first boot.
• OTA profile — send users a link to download and install an enrollment profile. Best for BYOD.
• Apple Configurator 2 — USB enrollment for existing devices not in ABM.

Supported commands

• Lock device, set passcode lock
• Remote wipe (full wipe or Return to Service)
• Install / remove configuration profiles
• Install managed apps (VPP / App Store)
• Restart and shutdown
• Collect device information and inventory
• Enable / disable Lost Mode (supervised only)

APNs setup

You will need an APNs push certificate tied to your Apple MDM vendor ID. ionvoy manages this certificate automatically for accounts using our shared MDM infrastructure. Bring-your-own-certificate mode is available on the Enterprise plan.

Android Enterprise

ionvoy integrates with the Android Management API (AMAPI) for enterprise-grade Android device management without OEM dependencies.

Enrollment modes

• Fully managed — company-owned device, full control from first boot. Uses a QR code or NFC bump during device setup.
• Work profile (BYOD) — creates an isolated work profile alongside personal apps. Personal data stays private.
• COPE (Corporate-Owned, Personally Enabled) — company-owned device with a work profile and limited personal use.

Supported commands

• Lock device and set password
• Remote wipe (full wipe or work profile only)
• Install and remove managed apps
• Apply policy updates in real time
• Collect device info and compliance status
• Reboot device

Samsung Knox

For Samsung devices, ionvoy extends standard Android Enterprise with Knox-specific capabilities available via the Knox Platform for Enterprise (KPE) API.

Additional Knox features

• Knox Container (dual-persona profile isolation)
• Hardware-backed attestation and Knox Vault
• Granular network and VPN policy controls
• Kiosk / single-app mode (Knox Kiosk)
• USB and Bluetooth peripheral control
• Enhanced remote wipe with selective data removal

Knox features require a Knox license key, which you can obtain from Samsung Knox Portal. Enter your key in Settings → Integrations → Samsung Knox in the ionvoy dashboard.

Display Management

ionvoy manages interactive displays from Newline, DTEN and compatible Android-based panels using a unified command set that abstracts vendor differences.

Supported operations

• Power on / off and standby scheduling
• Push content and set home screen apps
• Lock display and prevent input
• Screenshot and status reporting
• Volume and brightness control
• OTA firmware updates

Displays enroll via the same Android Enterprise flow using a QR code shown during initial setup. Once enrolled, they appear in your device list with a display type tag.

API — Devices

Base URL: https://api.ionvoy.com/api/v1

Device object

{
  "id": "dev_01J...",
  "name": "Marketing MacBook Pro",
  "platform": "apple",
  "model": "MacBook Pro (M3, 14-inch)",
  "osVersion": "15.3.1",
  "serialNumber": "XXXXXXXXXXXX",
  "enrolledAt": "2025-11-04T09:12:00Z",
  "lastSeen": "2026-06-07T10:44:00Z",
  "status": "enrolled",
  "supervised": true,
  "organizationId": "org_01J...",
  "groupIds": ["grp_01J..."]
}

API — Commands

Command types

• LOCK_DEVICE
• REMOTE_WIPE
• RESTART_DEVICE
• COLLECT_DEVICE_INFO
• INSTALL_PROFILE — requires profilePayload (base64)
• REMOVE_PROFILE — requires profileId
• INSTALL_APP — requires appIdentifier
• REMOVE_APP — requires appIdentifier
• ENABLE_LOST_MODE (Apple supervised only)
• DISABLE_LOST_MODE (Apple supervised only)

Command states

• pending — queued, waiting for device to connect
• sent — push notification delivered
• acknowledged — device received and processed
• failed — device returned an error

API — Groups

Groups let you apply commands and policies to multiple devices at once.

API — Webhooks

ionvoy sends POST requests to your endpoint when device events occur. Configure webhook URLs in Settings → Webhooks.

Event types

• device.enrolled — new device enrollment complete
• device.unenrolled — device removed or wiped
• device.checkin — device checked in (inventory update)
• command.acknowledged — device processed a command
• command.failed — command rejected by device
• compliance.violation — device failed a compliance policy

Webhook payload

{
  "event": "command.acknowledged",
  "timestamp": "2026-06-07T10:44:00Z",
  "organizationId": "org_01J...",
  "data": {
    "commandId": "cmd_01J...",
    "deviceId": "dev_01J...",
    "type": "LOCK_DEVICE",
    "status": "acknowledged"
  }
}

Verify authenticity by checking the X-ionvoy-Signature header against an HMAC-SHA256 of the raw request body using your webhook secret.