PDQ Connect API

PDQ Connect provides an HTTP based, REST-style API that enables admins to securely integrate with their own scripts, integrations, and other tools. The API allows admins to read and search for device details, such as which software packages and versions and updates are installed, network and disk information, and more. The API can also be used to deploy software to devices using simple HTTP requests.

Capabilities

Detailed API usage documentation (including a comprehensive of available endpoints and schemas) is available at https://app.pdq.com/v1/docs. 

The list below is intended to be an overview of what functions you can expect to find in the API. 

Authentication

Before you can use the API, you will need to set up authentication using Connect’s secure, token-based authentication system. Only admins can create API keys.

The API keys page itself is only visible to users with the Admin role. If you don't see it under Settings, ask an admin on your team to generate or manage keys for you.

First, generate a new API key using the new “API keys” page in Connect’s settings page located in the lower left-hand corner of the console.

Then, in the “API keys” page, click on the “Create API key” button. Give your API key a descriptive name that helps you remember what you are using it for. Each key name has to be unique, so if you enter a name that is already in use, Connect shows an error and asks you to choose a different one. Next, set the access level for each resource: Devices, Deployments, Groups, Packages, Custom fields, and Vulnerabilities. Every resource starts at No access. Raise the ones the key needs to read, or to read and write, and leave the rest at No access. This limits the key to exactly what it should be able to do. Then press the “Generate key” button to create the key.

After you press the “Generate key” button, you will be given an opportunity to copy the API key to your computer’s clipboard. Press the copy button to the right of the hidden API key to copy it.   Make sure to save the API key somewhere safe, as this is the only chance you have to see the API key. If you lose it, you will have to make a new one.

Scopes and key visibility

Every new key is scoped, which means it only works for the actions you granted it. You can review the scopes on any key from the “API keys” page at any time.

The API ID column shows the last four characters of each API key. API IDs are only available for keys created after August 17, 2026.

API key names now appear in your Deployments and Audit logs, so you can see which key triggered a deployment or made a change.

Request Header Authentication

To use the new API key you generated, you will need to include it in an HTTP header to the Connect API endpoint. It must be included in each request.

Invoke-RestMethod -Uri https://app.pdq.com/v1/api/devices -Headers @{'Authorization' = 'Bearer API_KEY_HERE'}

You can now use the API key to interact with the Connect API. If you ever stop using an API key or if you have reason to believe your key has been viewed by someone who shouldn’t have API access, remember to revoke the API key as soon as possible. You can revoke a key by pressing the “Revoke” button and following the prompts.

Examples using PowerShell

Get Devices

#Get Devices
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/devices"

Get groups

#Get groups
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/groups"

Get devices in group

#Get devices in group
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/devices?group=[groupId]"

Get packages by name contains

#Get packages by name contains
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/packages?filter[name]=~windows"

Get package versions

#Get package versions
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/packages/[packageId]"

Start a deployment

#Start a deployment
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Method Post -Uri "$ConnectApiBaseUrl/deployments?package=[packageId, or packageVersionId]&targets=[deviceId or groupId]"

Example using Postman

1. Open Postman, and click + icon to Create new request (which will open in a new tab). 
2. In the method selection dropdown (set to GET by default), select the appropriate method for your request, and then enter your request in the text box. 
   (e.g. https://app.pdq.com/v1/api/devices)
3. Within the request, switch to the Authorization tab. 
4. Select an Auth Type of Bearer Token, and paste your PDQ Connect API key into the Token box.
5. (optional) In order to store your PDQ Connect API token more securely, click the padlock icon and then click Set as Variable.
   
   Enter a Variable name in the text box, and then click to select a Scope for the variable. Store the variable within a defined scope or in your vault in accordance with your organization's security practices. 
   (See Postman KB: Store and reuse values using variables)
6. Click Send to send the request. 
    

Rate Limits

The API is rate limited to 300 requests every 2 minutes per organization. 

The API will only return up to 100 responses at a time, so if you are querying more than 100 objects (devices, packages, etc.), then you will need to submit multiple requests which step through the results by page. See this blogpost for detailed instructions.

Changelog

August 19, 2026: API access on all plans

New: API access on all plans: the Connect API is now available on every plan.

August 18, 2026: API key IDs

New: API key IDs: the API keys page now shows the last four characters of each key, making keys easier to identify. API IDs are only available for keys created after August 17, 2026.

August 10, 2026: Scoped API keys

New: Scopes on API keys. When you create a key you can now limit what it can do. Give a key read only access, such as reading devices, or read and write access, such as listing and creating deployments. Grant only the scopes the key actually needs.

New: View key scopes. You can see the scopes assigned to any key from the “API keys” page.

New: Key names in logs. API key names now appear in your Deployments and Audit logs, so you can trace which key did what.

New: Unique key names. Key names have to be unique. If you reuse a name, Connect returns an error telling you the name is already taken.

Changed: Only admins can create keys. Creating API keys is now limited to admins.

Note: Existing keys keep full access to every endpoint and show as fully scoped keys. Every new key is scoped.

July 01, 2026: Deployment tracking, vulnerability data, and custom fields

Updated: Track deployments triggered through the API: deployments now return their ID (POST /v1/api/deployments). Your automation can hold onto the deployment it just started instead of firing blind.

New: list and inspect deployments (GET /v1/api/deployments, GET /v1/api/deployments/{id}), filterable by package or package version, with per-deployment counts of queued, succeeded, failed, and canceled targets. Close the loop from other systems: deploy a fix when a ticket opens, post the result when it finishes.

New: retrieve device vulnerabilities (GET /v1/api/devices/{id}/vulnerabilities), with CVE and CVSS per finding and the remediating package where PDQ knows one. Feed device risk into your reporting or ticketing tools without exporting from the console.

New: Custom Fields API management (GET/POST /v1/api/custom-fields, PUT /v1/api/devices/{id}/custom-fields/{fieldId}). The API's first write path for device data: if asset tags, owners, or ticket references live in another system, you can now stamp them onto PDQ device records automatically.

Improvements: Every list endpoint now returns pagination metadata (meta: { page, pageSize, totalPages }). Clients know exactly when the list ends instead of guessing from page size, so integrations paging through thousands of devices or packages no longer risk stopping early or fetching pages that aren't there.