PDQ Connect API

PDQ Connect provides an HTTP based, REST-style API that enables admins to securely integrate with their own scripts, integrations, and other tools. The API allows admins to read and search for device details, such as which software packages and versions and updates are installed, network and disk information, and more. The API can also be used to deploy software to devices using simple HTTP requests.

More detailed API usage documentation is available at https://app.pdq.com/v1/docs. 

Authentication

Before you can use the API, you will need to set up authentication using Connect’s secure, token-based authentication system. Only admins can create API keys.

First, generate a new API key using the new “API keys” page in Connect’s settings page located in the lower left-hand corner of the console.

Then, in the “API keys” page, click on the “Create API key” button. Give your API key a descriptive name that helps you remember what you are using it for. Each key name has to be unique, so if you enter a name that is already in use, Connect shows an error and asks you to choose a different one. Next, set the access level for each resource: Devices, Deployments, Groups, Packages, Custom fields, and Vulnerabilities. Every resource starts at No access. Raise the ones the key needs to read, or to read and write, and leave the rest at No access. This limits the key to exactly what it should be able to do. Then press the “Generate key” button to create the key.

After you press the “Generate key” button, you will be given an opportunity to copy the API key to your computer’s clipboard. Press the copy button to the right of the hidden API key to copy it.   Make sure to save the API key somewhere safe, as this is the only chance you have to see the API key. If you lose it, you will have to make a new one.

Scopes and key visibility

Every new key is scoped, which means it only works for the actions you granted it. You can review the scopes on any key from the “API keys” page at any time.

The API ID column shows the last four characters of each API key. API IDs are only available for keys created after August 17, 2026.

API key names now appear in your Deployments and Audit logs, so you can see which key triggered a deployment or made a change.

Request Header Authentication

To use the new API key you generated, you will need to include it in an HTTP header to the Connect API endpoint. It must be included in each request.

Invoke-RestMethod -Uri https://app.pdq.com/v1/api/devices -Headers @{'Authorization' = 'Bearer API_KEY_HERE'}

You can now use the API key to interact with the Connect API. If you ever stop using an API key or if you have reason to believe your key has been viewed by someone who shouldn’t have API access, remember to revoke the API key as soon as possible. You can revoke a key by pressing the “Revoke” button and following the prompts.

Examples using PowerShell

Get Devices

#Get Devices
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/devices"

Get groups

#Get groups
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/groups"

Get devices in group

#Get devices in group
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/devices?group=[groupId]"

Get packages by name contains

#Get packages by name contains
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/packages?filter[name]=~windows"

Get package versions

#Get package versions
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Uri "$ConnectApiBaseUrl/packages/[packageId]"

Start a deployment

#Start a deployment
$ConnectApiBaseUrl = "https://app.pdq.com/v1/api"
$ConnectApiToken = "YOUR CONNECT API TOKEN"
$headers = @{'authorization' = "Bearer $ConnectApiToken" }
Invoke-RestMethod -Headers $headers -Method Post -Uri "$ConnectApiBaseUrl/deployments?package=[packageId, or packageVersionId]&targets=[deviceId or groupId]"

Example using Postman

Get Devices

In the Headers tab, add a key called Authorization, with a value of Bearer followed by a single space followed by your Connect API key. No brackets or single/double quotes are required - just a single space between the Bearer and the API key.

Rate Limits

The API is rate limited to 300 requests every 2 minutes per organization. 

The API will only return up to 100 responses at a time, so if you are querying more than 100 objects (devices, packages, etc.), then you will need to submit multiple requests which step through the results by page. See this blogpost for detailed instructions.

Changelog

August 19, 2026: API access on all plans

New: API access on all plans: the Connect API is now available on every plan.

August 18, 2026: API key IDs

New: API key IDs: the API keys page now shows the last four characters of each key, making keys easier to identify. API IDs are only available for keys created after August 17, 2026.

August 10, 2026: Scoped API keys

New: Scopes on API keys. When you create a key you can now limit what it can do. Give a key read only access, such as reading devices, or read and write access, such as listing and creating deployments. Grant only the scopes the key actually needs.

New: View key scopes. You can see the scopes assigned to any key from the “API keys” page.

New: Key names in logs. API key names now appear in your Deployments and Audit logs, so you can trace which key did what.

New: Unique key names. Key names have to be unique. If you reuse a name, Connect returns an error telling you the name is already taken.

Changed: Only admins can create keys. Creating API keys is now limited to admins.

Note: Existing keys keep full access to every endpoint and show as fully scoped keys. Every new key is scoped.

July 01, 2026: Deployment tracking, vulnerability data, and custom fields

Updated: Track deployments triggered through the API: deployments now return their ID (POST /v1/api/deployments). Your automation can hold onto the deployment it just started instead of firing blind.

New: list and inspect deployments (GET /v1/api/deployments, GET /v1/api/deployments/{id}), filterable by package or package version, with per-deployment counts of queued, succeeded, failed, and canceled targets. Close the loop from other systems: deploy a fix when a ticket opens, post the result when it finishes.

New: retrieve device vulnerabilities (GET /v1/api/devices/{id}/vulnerabilities), with CVE and CVSS per finding and the remediating package where PDQ knows one. Feed device risk into your reporting or ticketing tools without exporting from the console.

New: Custom Fields API management (GET/POST /v1/api/custom-fields, PUT /v1/api/devices/{id}/custom-fields/{fieldId}). The API's first write path for device data: if asset tags, owners, or ticket references live in another system, you can now stamp them onto PDQ device records automatically.

Improvements: Every list endpoint now returns pagination metadata (meta: { page, pageSize, totalPages }). Clients know exactly when the list ends instead of guessing from page size, so integrations paging through thousands of devices or packages no longer risk stopping early or fetching pages that aren't there.