An unofficial Go client for Nexthink Infinity, supporting the public integration APIs and the APIs used by the Nexthink web UI. Both API families share one entry point, nexthink.NewClient, with typed resources, request validation, response metadata, and a shared HTTP transport.
The SDK is alpha. Public and undocumented web contracts have different stability guarantees. The coverage inventory and lab validation report distinguish live-tested operations from contracts established through frontend source and unit tests.
The current systematic acceptance report records 418 passed methods and 274 outstanding validation gaps across 692 exported methods in both API families. Implemented coverage does not imply complete live validation.
The latest product-area expansion adds AI Tools/governance, Amplify configuration, Workspace, and product/device/user administration resources. Collaboration dashboards and call views reuse the existing dashboard and data-exploration services. See the role-to-resource reconciliation for inspected source coverage and remaining validation work; this is not an exhaustive inventory of every Nexthink endpoint.
Nexthink's public integration APIs primarily execute saved queries, read available actions and workflows, trigger operations, enrich data, and schedule device deletion. Managing the content behind those operations requires additional APIs: for example, creating or editing a workflow or remote action, configuring dashboards and integrations, or retrieving analytics used by the UI.
The SDK exposes those observed browser contracts through client.WebAPI, alongside client.PublicAPI. Management resources provide list, create, read, update, and delete operations where those operations exist, plus their observed auxiliary calls. The web API guide explains REST and GraphQL coverage and discovery limits; the SDK does not assume every resource supports every operation.
| API family | Typical use | Authentication |
|---|---|---|
client.PublicAPI |
Saved NQL execution/export, action and workflow triggers, enrichment | API client ID and secret; OAuth tokens acquired and refreshed by the SDK |
client.WebAPI |
Content management, configuration, analytics, browser administration | Local username/password through headless Chromium, a user access token, or a token provider |
The credential types are not interchangeable. An API client's permissions do not establish a signed-in browser identity. Web access also depends on the user's permissions, tenant features, and available fixtures. Undocumented endpoints can change without notice.
go get github.com/deploymenttheory/go-sdk-nexthink/nexthinkFollow the Quick Start Guide for installation, complete read-only programs for both API families, environment configuration, headless CI authentication, browser session setup, and error handling. Use the Go version required by go.mod.
The examples directory contains runnable programs using the same SDK entry point:
- Public APIs: NQL, remote actions, workflows, campaigns, enrichment, data management, and Spark.
- Web APIs: resource guides and examples for management, analytics, integrations, identity, and support operations.
- Headless password authentication: local-account login, explicit browser installation, a Linux container, and a GitHub Actions example.
From a checkout with the appropriate credentials configured:
NEXTHINK_API=public go run ./examples/nexthink/public_api/remote_actions/ListRemoteActions
NEXTHINK_API=web NEXTHINK_WEB_AUTH=chrome go run ./examples/nexthink/web_api/applications/ListMutation examples require explicit targets or request files. Each resource guide describes its inputs and effects; examples that execute actions, send messages, or change configuration perform those operations when run. Output can contain tenant data.
Both families use the same transport implementation with separate authentication and destinations. Pass common client options to NewClient or NewClientFromEnv:
| Option | Purpose |
|---|---|
WithTimeout |
Set the HTTP request timeout; request contexts can impose a shorter deadline |
WithRetryCount |
Configure retry attempts; use zero when explicitly handling retries yourself |
WithLogger |
Supply a zap logger |
WithProxy |
Configure a proxy |
WithTLSClientConfig |
Supply TLS configuration |
WithTransport |
Supply an HTTP round tripper |
WithDebug |
Log request method/status without headers or bodies |
WithPublicAPIOptions / WithWebAPIOptions |
Apply advanced client.ClientOption settings to one family |
Authenticated requests are restricted to the configured origin and do not follow redirects. Signed export downloads use a separate unauthenticated HTTP client. See configuration and response handling for examples and important response distinctions.
nexthink.NewClientFromEnv selects the enabled families with NEXTHINK_API=public, web, or both (default: public). Set NEXTHINK_INSTANCE to the tenant name and NEXTHINK_REGION to us, eu, pac, or meta.
- Public authentication uses
NEXTHINK_CLIENT_IDandNEXTHINK_CLIENT_SECRET. - Web authentication uses
NEXTHINK_WEB_AUTH=passwordwithNEXTHINK_USERNAMEandNEXTHINK_PASSWORDfor a local password-only account;tokenwithNEXTHINK_ACCESS_TOKEN; orchromefor an existing signed-in Chrome tab on macOS. - For application-owned configuration, pass
nexthink.AuthConfigtoNewClient; enable one or both credential fields. A disabled family is nil. Each enabled family's required fields are validated before its transport is constructed.
The quick-start authentication section explains token lifetimes, provider responsibilities, and browser setup. Password mode launches isolated headless Chromium and manages token acquisition without desktop Chrome. Install its pinned driver and browser during runner preparation; no browser is downloaded during API calls. SSO and MFA are not supported by this mode. Chrome mode continues to use an existing user session. Call defer c.Close() to release SDK-owned authentication resources.
- Quick Start Guide
- Web API guide, coverage inventory, and operation catalog
- NQL guides and NQL reference
- Live validation evidence and migration notes
- Go package reference
- Nexthink API documentation
See CONTRIBUTING.md and GitHub Issues. New endpoints should include evidenced request/response contracts, resource tests and JSON fixtures, and runnable examples. See the quick-start verification commands for local checks.
Licensed under the MIT License. This community SDK is not affiliated with or endorsed by Nexthink.