Agent Protocols

The server exposes the native protocol expected by each Mac client. These routes are separate from the JSON API used by the web app.

Client	Route family	Authentication
Orbit	/api/fleet/orbit/...	Enrollment secret, then Orbit node key
osquery	/api/v1/osquery/...	Enrollment secret, then osquery node key
Santa	/santa/sync/...	Santa bearer secret
Munki	/munki/...	Munki bearer secret
Munki distribution point	/api/munki/distribution/...	Per-point key

Create the shared Orbit/osquery secret from Hosts > Enroll Hosts or the osquery overview. Santa and Munki secrets live on their integration overviews. The deployment profiles are documented with each protocol.

Orbit and osquery can enroll a new host. Santa and Munki require a host that has already enrolled with the same hardware UUID or serial number.

See Agent Secrets for the credential model and Mutual TLS for edge-terminated client certificate authentication.