Datto RMM Devices — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Datto RMM Devices (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Devices are the core managed entities in Datto RMM. Each device represents an endpoint with the Datto agent installed - workstations, servers, ESXi hosts, or network devices. This skill covers device identification, status monitoring, user-defined fields, and common device operations.
autotask-configuration-items.
itglue-configurations.
periodic audit, not the device record; use datto-rmm-audit.
commonly runs both; use rocketcyber-agents.
managed endpoint in most of them, so the wording never disambiguates; confirm which agent is enrolled, then use ncentral-devices, ninjaone-devices, or atera-agents (Atera reserves "device" for agentless monitors).
Every device has multiple identifiers:
| Identifier | Type | Description | Example |
|---|---|---|---|
deviceUid | string | Globally unique identifier | d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a |
deviceId | integer | Legacy numeric ID | 123456 |
hostname | string | Computer name | ACME-DC01 |
intIpAddress | string | Internal IP address | 192.168.1.100 |
extIpAddress | string | External/public IP | 203.0.113.50 |
macAddresses | array | Network interface MACs | ["00:1A:2B:3C:4D:5E"] |
| Type | Description | Typical Use |
|---|---|---|
Desktop | Workstation/PC | End-user computers |
Laptop | Portable workstation | Mobile workers |
Server | Windows/Linux server | Infrastructure |
ESXi Host | VMware hypervisor | Virtualization |
Network Device | Router/switch/firewall | SNMP-monitored |
Printer | Network printer | Print infrastructure |
| Status | Description | Business Impact |
|---|---|---|
online | Agent checking in | Normal operation |
offline | No agent communication | May require attention |
rebooting | Restart in progress | Temporary state |
unknown | Status undetermined | Check connectivity |
Devices carry identifier, site, type/status, network, OS, hardware, agent, and timestamp fields, plus 30 user-defined fields (udf1-udf30, 255 char max, commonly used for asset tag, department, primary user, location, purchase date, lease expiration). See references/fields.md for the complete Device interface and UDF table.
async function findDeviceByHostname(client, hostname) {
// Fetch all devices (with pagination)
const allDevices = [];
let url = '/api/v2/devices?max=250';
while (url) {
const response = await client.request(url);
allDevices.push(...response.devices);
url = response.pageDetails?.nextPageUrl;
}
// Search case-insensitive
const matches = allDevices.filter(d =>
d.hostname.toLowerCase().includes(hostname.toLowerCase())
);
if (matches.length === 0) {
return { found: false, suggestions: [] };
}
if (matches.length === 1) {
return { found: true, device: matches[0] };
}
return {
found: false,
ambiguous: true,
suggestions: matches.map(d => ({
hostname: d.hostname,
uid: d.uid,
site: d.siteName
}))
};
}Equivalent lookups by IP and MAC address, an offline-device report, and a bulk UDF update helper follow the same pagination pattern - see references/examples.md for the full implementations, including UDF/description length validation.
GET /api/v2/devices?max=250 - list all devices (paginated via pageDetails.nextPageUrl)GET /api/v2/device/{deviceUid} - get a single deviceGET /api/v2/site/{siteUid}/devices?max=250 - devices scoped to a sitePOST /api/v2/device/{deviceUid} - update device fields (description, UDFs)DELETE /api/v2/device/{deviceUid} - remove device from Datto RMM (does not uninstall the agent)See references/api.md for full request/response examples.
description is capped at 1000. Both fail with 400 Invalid field value when exceeded.lastSeen to determine effective status - see getDeviceEffectiveStatus in references/examples.md.See references/errors.md for the full device API error table.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.