API connections
Credentials are created in Nexthink under Administration › API credentials. Client secrets are stored encrypted and never shown again.
Data sources
How this works
Pull data from Entra ID, Intune, Azure, any REST API, a SQL database, or a CSV/Excel file in a folder or network share (one of your File destinations, Data library). Then map it to Nexthink fields in Import & Enrich, and save the mapping as a sync profile that runs on a schedule (Scheduled imports).
Export data with an NQL query
How this works
Create the query in Nexthink under Administration › NQL API queries, then enter its ID here. Preview returns up to 1,000 rows straight away. Full export runs as a background job and returns every row.
Schedule this export to the export database, a folder or a network share
Runs the query above (its ID and parameters) with the connection selected at the top, on a schedule or whenever you click Run now in the Scheduled exports tab, and saves each result in the export database (where Power BI can read it) and/or as a new CSV file.
1 Source data
…or pull from a data source (Entra ID, Intune, Azure, REST, SQL)
Schedule this pull to the export database, a folder or a network share
Pulls all records of the source and data selected above on a schedule and saves each result in the export database and/or as a new CSV file. Nothing is sent to Nexthink. To also enrich Nexthink, map the columns below and save a sync profile instead.
Scheduled imports (sync profiles)
How this works
A scheduled import pulls data from a source and enriches Nexthink with it, manually or on a schedule. Sources are Entra ID / Intune / Azure, a REST API, a SQL database, or a CSV or Excel file in a folder or network share (the newest file whose name matches, e.g. the one another system drops there every day; a file already imported is skipped, or it can be moved to an imported folder). To create one: add the source in Sources (for a file, its folder or share is one of your File destinations in the Data library), then in Import & Enrich pull from it, map the columns and click Save as sync profile.
Exports
How this works
Each export has a name. Its data is kept in the export database, in one table per name (in your own schema: other accounts do not see it),
which you can download as CSV, Excel or JSON, or read straight from Power BI (below). An export can have a schedule: it then runs by
itself (or when you click Run now) and saves each result in its table, and optionally also as a CSV file in a file destination.
Create one with Schedule this export in the Export tab, or Schedule this pull in Import & Enrich.
An export you run by hand is kept when you click Save to database on its result: give it a new name, or the name of an export
below to save into its table. Each save either adds every row (cumulative), adds only new rows (rows not already in the table,
comparing every column), or replaces the data. The column _exported_at says when each row was saved; the view
…_latest has only the rows of the newest save. Schedules run inside the container, so Docker must be running at the
scheduled time.
Working copies
Temporary tables inside the app: uploaded files, export previews and results, pulls from sources, and run results. They are what you enrich Nexthink from and choose remote action and campaign targets from. To keep one, or to read it in Power BI, click Save to database.
File destinations
How this works
Where scheduled exports and sync profiles save CSV copies, when they are set to (files are named
name_20261002T020000Z.csv, UTC time, and never overwritten; Keep the last N files deletes older files of the same
name, and only those). A destination is a place files can be written to. A folder is a folder the app can see: installed on Windows,
a folder inside the export folder chosen at installation; with Docker, a folder of this PC or a mounted network share, made available
by mounting it under /exports in docker-compose.yml (then run docker compose up -d). A network share (SMB) is reached directly with the user name and password
you enter here, stored encrypted, so nothing needs mounting.
Reports
How this works
A report is a list of sections. Each section reads one NQL API query (run when the report is made, at most 1,000 rows) or one of your saved exports (its newest data, or its last saves for a trend), and shows it as a key number, a bar or pie chart, a trend line or a table. The email has a summary in its body (the key numbers, the top of each chart, the first rows of each table) and the whole report as a PDF attachment, optionally with the data as Excel. Send it with Send now, try it with Send me a test (to your own address only), or give it a schedule. Each key number also shows the change since the previous report. Make a report with Design it for me (the portal looks at the data and lays it out), from a template (DEX, software, hardware, performance), or section by section; then change anything. Reports belong to the connection selected at the top. Emails go through the mail server set in Configuration › Email.
Run a remote action
How this works
Triggers a Nexthink remote action on devices through the Act API, using the connection selected at the top. This runs a real script on real devices. The API credential must be allowed to run remote actions, and the remote action needs its API option ticked in Nexthink. Work through the steps, then Validate (a dry run that sends nothing). Run only becomes available after a successful validation, and asks you to confirm.
Recent runs
Every attempt from this app is recorded here. Submitted only means Nexthink accepted the request: use Get results to see what happened on each device, or the request ID to find the executions in Nexthink.
Trigger a campaign
How this works
Sends a Nexthink campaign to users through the Campaigns API, using the connection selected at the top. This notifies real users. The API credential must be allowed to trigger campaigns, and the campaign needs its API option ticked under General in Nexthink. The campaign list comes from a saved NQL query (set up once, see List query…); a campaign that is not listed can still be sent by choosing Other and entering its NQL ID. Work through the steps, then Validate (a dry run that sends nothing). Send only becomes available after a successful validation, and asks you to confirm.
Recent runs
Every attempt from this app is recorded here. A run can be accepted for some users and rejected for others: the rejected ones are listed with Nexthink's reason. Use Responses to see who answered and to follow up with the users who did not.
Jobs
Your account
HTTPS certificate
Download certificateStop the browser's certificate warning
The portal's certificate is self-signed (made by the app), so browsers warn about it until it is trusted. On each Windows PC
that uses the portal: download the certificate, open it, click Install Certificate…, choose Local Machine, then
Place all certificates in the following store › Trusted Root Certification Authorities, and finish (this needs
administrator rights). Restart the browser. The app makes a new certificate about a month before this one expires, or when the
server's address changes (TLS_HOSTS); install the new one then. To use a company certificate instead, put its
cert.pem and key.pem in data/tls on the server and restart the app.
Export the configuration
Saves your setup as one file, to load it into another deployment (for example from test to production): your connections (with their guardrails, saved query IDs, protected lists and saved audiences), sources, destinations, mapping templates, sync profiles, scheduled exports and reports. Connections shared with you are not in it (only their names, where your schedules use them). Datasets, jobs, run history, sent report PDFs and saved export data are not in it.
Import a configuration
Loads a configuration file into your account. Nothing changes until you click Import: first see what each item would do. Items are matched by name with your own items: a new name is added, an existing name is updated, and nothing here is deleted. What you import is yours.