We have an active Citrix DaaS account with valid cloud licenses, and I am looking to fetch the License expiry dates via Citrix API calls.

Tests done so far:

I used the article (Getting started with Citrix cloud licensing APIs | Citrix Cloud Licensing), and get license details, result is shown below:

{

    "customerId": "xxxxxxxxxxxxx",

    "totalUsageCount": 0,

    "userLicenseUsage": {

        "totalUsageCount": 0,

        "releasedCount": 0

    },

    "deviceLicenseUsage": {

        "totalUsageCount": 0,

        "releasedCount": 0

    },

    "totalAvailableLicenseCount": 0,

    "remainingLicenseCount": 0,

    "timeStamp": "2025-03-25T11:06:20.7740709Z",

    "productName": "XenDesktop",

    "nextExpiredLicenses": null,

    "nextActivatingLicense": null,

    "productEdition": "XAXDFull",

    "isDomainTruncated": false

}

Issue 1: The API call is showing zero "totalAvailableLicenseCount", whereas in the Citrix Cloud GUI we have available licenses.

Query: I need the License expiry dates via API calls, which is showing as Null. Infact the whole result is showing null and full or zeros.

Note: The URL (https://citrix.cloud.com/cloud-license/cloud-services/xendesktop?products=xendesktopccu) - Shows me valid licenses, but it does not show in API call result.

I am looking forwards for some tips from the community members for about requirements, please share any reference / query for it.

Thank you, 

M Chaudhary

We are currently migrating our on-prem Citrix environment to Citrix DaaS Cloud and are exploring options to automate profile-related user management tasks using APIs.

As part of this initiative, we are working on building an API connector to integrate Citrix DaaS with our ITSM/ticketing automation platform. Our initial use cases include:

• Resetting user profiles

• Forcing log-off of users from active Citrix sessions

We have reviewed the available Citrix DaaS Cloud API documentation, but we could not find any APIs that explicitly support:

• User profile reset operations

• Session logoff in the context of profile management

We would appreciate your help with the following API-specific details:

1. API Availability

• Are there any official Citrix DaaS Cloud APIs available to:

  • Reset or clean a user profile?

  • Log off a user session programmatically?

2. API Technical Details (if available)

If such APIs exist, could you please share:

• API endpoint URLs

• Required authentication method (OAuth2, API client, tokens, etc.)

• Required roles or permissions

• Sample request/response or reference documentation

Any guidance, documentation links, or best-practice recommendations would be greatly appreciated.

Thank you in advance for your support.

Regards,

Selva L

When using Get-XDAuthentication or using Set-XDcredentials i'm getting error Key Not valid for use in specified state. It seems that the commands rely on Windows DPAPI which is expecting encryption and decryption on the same system or account causing this issue. This works perfectly on our Windows Master and slave setup. I have tried rest api, bearer token but nothing works as the command itself seems to be relying on dpapi.. any way to bypass this or any workaround is appreciated.

working using rest apis is not possible for me as there are some functionality for which the api endpoints are not public. For eg- adding a machine into mcs catalog.

I'm trying to create a MCS AAD joined catalog using terraform but unable to do so. upon executing the terraform plan, i get the below error. I have validated the documentation but was not able to fix this yet. Is this a bug because it is showing I'm not using PVS so not sure why azure_pvs_config is requried

Error Message

Error: Invalid Attribute Combination
│
│ with citrix_machine_catalog.example-catalog,
│ on machine_catalog.tf line 2, in resource "citrix_machine_catalog" "example-catalog":
│ 2: resource "citrix_machine_catalog" "example-catalog" {
│
│ No attribute specified when one (and only one) of
│ [provisioning_scheme.azure_machine_config.azure_pvs_config.<.azure_pvs_config,provisioning_scheme.azure_machine_config.azure_pvs_config.<.azure_master_image] is
│ required

Below is my code snippet

resource "citrix_machine_catalog" "example-catalog" {
    name                        = "Terraform-Catalog"
    description                 = "Automated Azure AD Catalog"
    allocation_type             = "Random"
    session_support             = "MultiSession"
	provisioning_type 			= "MCS"
    zone                        = data.citrix_zone.zone.id
    provisioning_scheme         = {
        hypervisor               = data.citrix_hypervisor.azure-hypervisor.id
        hypervisor_resource_pool = data.citrix_hypervisor_resource_pool.azure-resource-pool.id
        identity_type            = "AzureAD"
        enroll_in_intune         = true
        network_mapping = [ {
          network_device = "VNetName"
          network = "SubnetName"
        } ]
        azure_machine_config     = {
            service_offering     = "Standard_B4ms"
            machine_profile = {


                machine_profile_resource_group = "Demo-RG"
                # machine_profile_vm_name = "Demo-Win11"
                machine_profile_template_spec_name = "Win11AVD"
                machine_profile_template_spec_version = "1.0.0"


            }
            storage_type         = "StandardSSD_LRS"
            use_managed_disks    = true
        }
        number_of_total_machines = 1
        machine_account_creation_rules = {
            naming_scheme = "AAD-AVD#"
            naming_scheme_type = "Numeric"
        }
    }
}

trying to output the username (e.g) from a connection with odata and powershell:

(Invoke-RestMethod "https://api-us.cloud.com/monitorodata/Connections?`$expand=Session&`$top=1" -Headers $headers -Method Get).value

works well, but instead or in addition to the userId I want the username only possible through expanding another level, so:

(Invoke-RestMethod "https://api-us.cloud.com/monitorodata/Connections?`$expand=Session(`$expand=User)&`$top=1" -Headers $headers -Method Get).value # -> no error but empty output for 'User='

other tests like this are not working:

(Invoke-RestMethod "https://api-us.cloud.com/monitorodata/Connections?`$expand=Session(`$expand=Session/User)&`$top=1" -Headers $headers -Method Get).value ### -> error with URI

(Invoke-RestMethod "https://api-us.cloud.com/monitorodata/Connections?`$expand=Session(`$expand=Users)&`$top=1" -Headers $headers -Method Get).value # -> Users won't work

MS has different examples but I found nothing with Citrix. connections are only one example, I can reproduce it with other tables.

Someone successfully did a multi-expand in powershell and could post his code here? thanks

hope your fine?! I am looking into a API Query to deliver following Output:

DeliveryGroupsName and all existing TAGS associated to the DeliveryGroup.

Does anyone have a API Query done similar to that?

Thanks

While fetching machine details from citrix cloud on azure using API URLs, we are unable to retrieve the IP of the machines in the retrieved data.

Below are the certified API URLs we are using to fetch data, 

Example Queries

Our filter is slightly more detailed and we select more columns, but these simplified examples that retrieve just a few rows illustrate the error.

Not Working - November time period:

This runs for a while before timing out.  It works occasionally.

https://api-us.cloud.com/monitorodata/Connections?$filter=IsReconnect eq false and ModifiedDate ge 2024-11-03T18:40:00.000Z and ModifiedDate lt 2024-11-03T22:40:00.000Z&$top=20&$select=Id,SessionKey

Working - Earlier time period"

This works, response time is a few seconds.  I have moved the dates to different months and widened the time interval.

https://api-us.cloud.com/monitorodata/Connections?$top=20&$filter=IsReconnect eq false and ModifiedDate ge 2024-09-03T18:40:00.000Z and ModifiedDate lt 2024-09-03T22:40:00.000Z&$select=Id,SessionKey

Citrix DaaS REST APIs

Example JSON Body (true values redacted)

Updating image and machine creation rules

{
    "StoreOldImage": true,
    "MinimumFunctionalLevel": "L7_20",
    "RebootOptions": {
        "RebootDuration": -1,
        "SendMessage": false
    },
    "MasterImagePath": "<image path>",
    "MasterImageNote": "<Image notes>",
    "MachineAccountCreationRules": {
        "NamingScheme": "CTX-VM-###",
        "NamingSchemeType": "Numeric",
        "Domain": "DOMAIN.NET",
        "OU": "OU=Level3,OU=Level2,OU=Level1,DC=DOMAIN,DC=NET"
        }
}

Updating machine creation rules only

{
    "MachineAccountCreationRules": {
        "NamingScheme": "CTX-VM-###",
        "NamingSchemeType": "Numeric",
        "Domain": "DOMAIN.NET",
        "OU": "OU=Level3,OU=Level2,OU=Level1,DC=DOMAIN,DC=NET"
        }
}

Error output

{
  "ErrorMessage": "Invalid arguments specified.\r\nParameter name: nameOrId request.MachineAccountCreationRules.OU async",
  "SdkErrorId": "UnknownError",
  "ErrorType": "ArgumentException",
  "ErrorDetails": "Transaction ID: ea6450aa-0027-4ac9-ba55-4f75998a793e\r\nAction Name: UpdateMachineCatalogProvisioningSchemeAsync\r\n\r\n\r\nException:\r\n    Error Source : CitrixOrchestration\r\n",
  "SupportLink": null,
  "ErrorReportXml": null,
  "ErrorReport": null
 

The nameOrId value is correct (catalog Id) even though it is reference in the error output.

Calling the API using the same json but with OU to "" (double quotes, nothing) returns success.

I am wondering if the Citrix Cloud authorization token is supported using the SecureString class in PowerShell.

Thanks!

Baljit-

Thanks

Please find the API links that we are using.

Session API we used with pagination filter applied : https://api-ap-s.cloud.com/monitorodata/Sessions

Machine API we used with pagination filter applied  : https://api-ap-s.cloud.com/monitorodata/Machines

Please find the attachment of the screen shot of the error.

I am guessing there is some session issue, being the problem. 

The script is run with domain admin credentials, on the VM. 

and its pretty simple:
 

    Add-PSSnapin Citrix*
    Import-module 'C:\Program Files\CITRIX\Telemetry Service\TelemetryModule\Citrix.GroupPolicy.Commands.psm1'
    New-psdrive -name LocalFarmGpo -psprovider CitrixGroupPolicy -Controller localhost \
    Import-CtxGroupPolicy C:\temp\CitrixCVAD\Files\Policies\CTXPOL_ClientDrive_2012R2_Prod\
    Import-CtxGroupPolicy C:\temp\CitrixCVAD\Files\Policies\CTXPOL_2012R2_Prod\

The invoke script, run from the agent vm, has the credentials. 

#connect
Set-PowerCLIConfiguration -Scope User -InvalidCertificateAction Ignore -ParticipateInCeip $false -Confirm:$false
Connect-VIServer -Server $VMwareConfig.VMwareServer -Credential $VMcredentials
#getvmname
$VMName =Get-VM -Name $VMwareConfig.GuestMachine
try{
    $VMName | Invoke-VMScript -ScriptText 'C:\temp\citrixCVAD\12_CitrixPolicies_Config.ps1' -ScriptType Powershell -GuestCredential $SomethingSomehingCredentials
} 
catch
{

    if ($_.Exception.Message -like '*The guest operations agent could not be contacted*') {
        Write-Host "OK"
    } else {
        Write-Host "Something went wrong"
    }
    
}

The output i am getting is:
 

Quote

2023-12-13T09:34:13.5055116Z ScriptOutput : 
2023-12-13T09:34:13.5119640Z                Name           Used (GB)     Free (GB) Provider      Root                                               
2023-12-13T09:34:13.5121096Z                CurrentLocation
2023-12-13T09:34:13.5147491Z                ----           ---------     --------- --------      ----                                               
2023-12-13T09:34:13.5148773Z                ---------------
2023-12-13T09:34:13.5182934Z                LocalFa...                             CitrixGrou... LocalFarmGpo:\                                     
2023-12-13T09:34:13.5184297Z                               
2023-12-13T09:34:13.5185443Z                New-Item : Cannot find drive. A drive with the name 'LocalFarmGpo' does not exist.
2023-12-13T09:34:13.5187703Z                At C:\Program Files\CITRIX\Telemetry Service\TelemetryModule\Citrix.GroupPolicy.Commands.psm1:503 
2023-12-13T09:34:13.5189592Z                char:21
2023-12-13T09:34:13.5190280Z                +             $item = New-Item "$($DriveName):\$Type\$PolicyName"
2023-12-13T09:34:13.5191556Z                +                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-12-13T09:34:13.5193186Z                    + CategoryInfo          : ObjectNotFound: (LocalFarmGpo:String) [New-Item], DriveNotFoundException
2023-12-13T09:34:13.5195211Z                    + FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.NewItemCommand
2023-12-13T09:34:13.5196552Z                 
2023-12-13T09:34:13.5197652Z                Set-ItemProperty : Cannot find drive. A drive with the name 'LocalFarmGpo' does not exist.
2023-12-13T09:34:13.5199951Z                At C:\Program Files\CITRIX\Telemetry Service\TelemetryModule\Citrix.GroupPolicy.Commands.psm1:506 
2023-12-13T09:34:13.5201578Z                char:51
2023-12-13T09:34:13.5202512Z                + ... y($prop)) { Set-ItemProperty "$($DriveName):\$Type\$PolicyName" $prop ...
2023-12-13T09:34:13.5204003Z                +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-12-13T09:34:13.5210886Z                    + CategoryInfo          : ObjectNotFound: (LocalFarmGpo:String) [Set-ItemProperty], 
2023-12-13T09:34:13.5212278Z                DriveNotFoundException
2023-12-13T09:34:13.5213886Z                    + FullyQualifiedErrorId : DriveNotFound,Microsoft.PowerShell.Commands.SetItemPropertyCommand

{
    "ShareType":    "Send",
    "Title":    "Sample Send Share",
    "Items":    
[
        {
            "Id":    "FILE ID"
        }
    ],
    "ExpirationDate":    "2023-12-18",
    "RequireLogin":    false,
    "RequireUserInfo":    false,
    "MaxDownloads":    -1,
    "UsesStreamIDs":    false
}

I get a server 400 (BAD REQUEST) .... or {"code":"BadRequest","message":{"lang":"en-US","value":"Invalid Share: provide either a type, parent, or item list"},"reason":"BadRequest"}

when I send that data.

What's up?

I am creating a hardening script to evaluate my infrastructure with each hardening rules provided by citrix (IIS Rules for Directory & Storefront, HTTPS Information etc...)

I would like to check the SecureICA Level for Each Machine Catalog or Delivery Group and make a result like this

Description - Defined - Expected -  Harden

Catalog 1 - Basic - Bits128 - nok

Catalog 2 - Bits128 - Bits128 - Ok

Has anyone ever made this kind of script ?

Thx

RPE