To provide better security and more granular control, we are officially transitioning to API v3. As part of this evolution, support for API v2 will be sunset on May 15th, 2026.
Why the change? While v2 used organization-level access, v3 shifts to User-based scoping. This change introduces two critical improvements:
Granular Access Control: API capabilities are now strictly tied to a user’s specific role. If a user can’t do it in the UI, they can’t do it via the API.
Enhanced Audit Transparency: Every programmatic action is now linked to a specific user email in the Audit Log, providing full visibility into "who did what and when."
Key Deadlines & Resources
March 16th, 2026: You will no longer be able to generate new v2 API tokens after this date. While existing tokens will remain active until the final sunset, we will simultaneously release a new CLI version powered by API v3 to facilitate your migration.
May 15th, 2026: API v2 will be sunset and stop functioning.
Please begin your migration to v3 as soon as possible to ensure an uninterrupted workflow. If you have any questions, our team is here to help at support@arborxr.com.
Overview
The ArborXR Public API v2 provides access to your organization’s data via a RESTful interface.
The root of v2 of the API is located at https://api.xrdm.app/api/v2 . From the documentation page, you can download the OpenAPI spec documentation as JSON or YAML, for use with your API development client of choice.
Generate an Access Token
Navigate to organization Settings.
Select Access Token.
Click Create Access Token in the top right.
Select MDM API v2 (Legacy) from the dropdown.
Enter a title then click Create.
Copy the token value before closing.
Authentication
Once you’ve generated an access token, you can use that token to make HTTP requests to the API, by adding it as a bearer token to your request’s Authorization header. You should also be sure to include the Accept and specify that you expect a JSON response.
Authorization: Bearer <access_token>
Accept: application/json