Connect & Integrate Addigy [Early Preview]
Last updated: July 27, 2026
This integration is in early preview and in the process of being tested.
Introduction
This guide explains how to connect YeshID with Addigy.
Addigy has two separate kinds of “users,” and YeshID handles them differently:
Addigy console users — the people who can log into the Addigy console. YeshID imports these as the application’s users and can create, update, and remove them, so console access is governed like any other app.
End users (device holders) — the people your Macs, iPhones, and iPads belong to. YeshID imports these into Resources along with the devices and policies themselves, giving you a live view of who has which device. Addigy only accepts new end users from your identity provider over its own SCIM connection, so YeshID reads this population rather than writing to it.
YeshID can also remotely lock or erase a user’s devices during offboarding.
You will need an Addigy API token created by a user with the owner role. Your Addigy organization ID is optional — YeshID discovers it from your Addigy data.
Steps
Log in to Addigy as a user with the owner role. (Only the owner role can add, edit, or remove Addigy console users.)
Navigate to Account > Integrations > API & Webhooks.
In the Addigy API section, click New API Token.
Grant the token the following permissions:
View Users
Create User
Edit User
Remove User
View Devices
Execute Commands
View End Users (only needed if you use Addigy’s End User Management)
Copy the token and store it somewhere safe. (Addigy shows it only once — if you lose it, create a new token and update it in YeshID.)
In YeshID, navigate to Applications, select Addigy, and open the provisioning setup.
Enter your credentials:
API Token — the token you copied in step 5.
Organization ID (optional) — leave this blank. YeshID reads your organization ID from your own Addigy data.
Enable the actions you want YeshID to run (Import Users, Create User, Update User, Delete User, Import Resources, Lock Device, Erase Device).
If you enable Create User, choose what new accounts should get:
Role:
owner,admin,user, or the name of a custom role you created in Addigy. The default isadmin.YeshID never sets or stores a password — Addigy handles first-time sign-in for the new account.
If you enable Lock Device, configure the action:
Lock PIN: A six-digit PIN sent with the lock command. This PIN is required to unlock a Mac afterward, so store it somewhere safe.
Lock Message (optional): Shown on the lock screen.
Phone Number (optional): Shown on the lock screen.
Agent IDs (optional): Leave blank so YeshID resolves the person’s devices for you.
If you enable Erase Device, configure the action:
Confirm Erase: Type
ERASEhere to arm the action. Erasing a device is irreversible, so YeshID will not send the command unless this is set.Find My PIN (optional): A six-character PIN required by Macs without an Apple M1 or T2 chip. Leave blank on newer Macs, iPhones, and iPads.
Obliteration Behavior: What macOS should do if it cannot Erase All Content and Settings. Default suits most fleets.
Agent IDs (optional): Leave blank so YeshID resolves the person’s devices for you.
Run Import Users to verify the connection. Your Addigy console users will appear in the application’s user list.
Run Import Resources to bring in your devices, policies, and device holders.
FAQ
What actions does the YeshID integration support today?
Import users (Addigy console users)
Create user (console user, with a configurable Addigy role)
Update user (name and phone; the role is never changed)
Delete user (revokes console access)
Lock device
Erase device
Import resources (devices, policies, and end users, with assignments)
Which Addigy users does YeshID manage?
YeshID manages Addigy console users — the people who can log into Addigy. That’s the population that matters for access governance: who can administer your device fleet. Most of your employees don’t have an Addigy login at all; they appear as end users in Resources instead.
Import Users only shows my IT team. Where is everyone else?
That’s expected. Most employees never log into Addigy — they just have a device enrolled to them. Those people and their devices come in through Import Resources.
Can YeshID create or deactivate end users in Addigy?
No. Addigy accepts end-user records only from your identity provider over its own SCIM connection (End User Management), which you configure between Addigy and Okta or Microsoft Entra ID. YeshID reads those end users and their device assignments, but the source of truth stays your IdP.
Do I need to fill in the Organization ID?
Almost never. Addigy has no endpoint that reports which organization a token belongs to, so YeshID works it out from your Addigy policies or, failing that, from one of your devices. If YeshID reports that it could not determine your organization ID — which only happens in an Addigy organization with no policies and no enrolled devices — copy the ID from your Addigy console and paste it here.
I get a 401 error that says “Error getting api configuration.” Why?
Addigy returns that when it doesn’t recognize the token. Confirm you pasted the whole token, that it hasn’t been deleted in Account > Integrations > API & Webhooks, and that you created it in the same Addigy organization you want YeshID to manage. Because Addigy shows a token only once, the safest fix is to create a new token and paste it into YeshID.
I get a 403 error. Why?
The token is missing a permission for the action you ran — most often View Users for Import Users, Execute Commands for Lock or Erase Device, or View End Users for Import Resources. Addigy permissions are fixed when a token is created, so add a new token with the permissions from step 4 and update it in YeshID.
Why did all my Addigy actions suddenly start failing?
Addigy rate limits each token to 1,000 requests per 10 seconds, and going over that blocks the token for the next 24 hours. YeshID paces itself well below that ceiling, but other tools sharing the same token can trip it. If your Addigy actions fail across the board for a day, check whether another integration is using the same API token, and give YeshID a token of its own.
Which Addigy role should created accounts get?
admin covers day-to-day device administration and is the default. user is the least-privileged built-in role. owner should be rare — it’s the only role that can manage other Addigy users and billing, so grant it deliberately. If you’ve built a custom role in Addigy, type its name exactly as it appears there.
Does updating a user change their role?
No. Update User only syncs the person’s name and phone number. Their Addigy role is read from the existing account and preserved exactly as it is.
Can YeshID rename an Addigy console user’s email?
No. Addigy identifies console users by email address and provides no way to change it. If someone’s email changes, remove their Addigy account and create a new one.
How does YeshID know which devices belong to a person?
It checks the strongest signal available, in order:
Agent IDs you entered on the action, if any.
The identity email on the device, which Addigy Identity stamps on devices it authenticates.
The end-user device assignment, if you use Addigy’s End User Management.
The user currently logged into the device.
Why does the Lock Device action require a six-digit PIN?
macOS requires a six-digit PIN with every remote lock command, and the same PIN is what unlocks the machine afterward. Set a PIN your IT team controls and keep it somewhere safe — without it, a locked Mac needs Apple support to recover.
How does Erase Device work, and how is it kept safe?
Erase Device sends Addigy’s MDM erase command to the user’s devices — typically at offboarding, to clear a device before it’s returned or reassigned. Because an erase is irreversible, the action is disarmed by default: YeshID will not send the command unless Confirm Erase is set to ERASE. YeshID also checks every one of the person’s devices before sending anything, so a device Addigy can’t erase never leaves you with some machines wiped and some not.
What is Obliteration Behavior?
It’s Apple’s setting for what a Mac should do when it can’t complete Erase All Content and Settings — for example on hardware older than the Apple T2 chip. Default attempts a full erase after a failed check, Do Not Obliterate reports an error instead of erasing, and Always Obliterate skips the check entirely. Leave it on Default unless you have a reason to change it.
What shows up in Resources?
Your Addigy organization, every device (with serial number, model, OS version, FileVault status, and last check-in), your Addigy policies, and the end users who hold the devices — connected by assignment and policy membership. Device holders appear here even if they’ve never had an Addigy login.