Fleet management

Once machines report in, each client's workspace in the portal becomes a fleet console. All of this is scoped to the open client and reads the data the agent sends on every run.

Analytics dashboard

An Overview panel shows run success rate, average CIS compliance (with a good/warn/poor bar), drift posture, and a runs-per-day activity sparkline over the last 500 runs. Endpoint: GET /v1/analytics.

Hardware inventory

Search the fleet by make / model / OS version / CPU / serial, with distribution rollups (by OS version, manufacturer, model, RAM bucket). Export the fleet to CSV. Endpoint: GET /v1/inventory?q=.

Software inventory

The agent reports installed apps (from the registry uninstall keys). Search which machines have an app and the version spread, or view a top-apps catalog. Endpoint: GET /v1/software?q=.

Patch status

Per-machine last-patched date + hotfix count (via Get-HotFix), flagging machines not patched in 35+ days. Endpoint: GET /v1/patches.

Machine tags

Tag machines (e.g. front-desk, vip) from the machines table. Tags let you target remote commands and scheduled maintenance at a group instead of every machine. Endpoint: POST /v1/machines/:id/tags.

Remote commands

Push an action to a machine that the agent runs on its next signed check-in, reporting status + output back:

• reprovision — re-run provisioning (full, or a single phase)
• remediate-drift — run desired-state remediation
• collect-logs — return the tail of the machine's logs
• run-script — arbitrary PowerShell (off by default; see below)

Queue one (by serial) or bulk to all active machines (optionally filtered by tag). Endpoints: POST /v1/commands, POST /v1/commands/bulk, agent poll POST /v1/commands/pending.

run-script is remote code execution

It's disabled per client until you enable it — Client settings → Allow remote script execution (or UPDATE tenants SET allow_scripts = 1 WHERE id = '<clientId>'). Every command is audited.

Scheduled maintenance

Recurring commands on a daily/weekly cadence at a chosen UTC hour, optionally scoped to a tag — e.g. nightly remediate-drift, weekly collect-logs. An hourly Worker cron fires anything due. Endpoint: POST /v1/schedules.

Offboarding

Retire a machine to keep its history while removing it from seat counts and revoking its signing credential. Endpoint: POST /v1/machines/:id/retire.

Cloud config pull

Mark a build profile as a client's default config; the agent fetches it from GET /v1/config on check-in (Get-TotlCloudConfig), so you can change a client's desired configuration centrally.

Data export

Export a client's full data bundle (machines, runs, profiles, webhooks, schedules, SSO mappings, audit) as JSON from Client settings → Export client data. Endpoint: GET /v1/clients/:id/export.

Audit

Every client has a tamper-evident audit log (hash-chained), viewable with a CSV export and an integrity check. Endpoints: GET /v1/audit, GET /v1/audit/verify.