device_group: Platform device-groups API does not support Jamf Pro sites (upstream limitation)

[neilmartin83]

Summary

The jamfplatform_device_group resource is backed by the Jamf Platform unified device-groups API (/api/device-groups/v1/...). That API does not model or expose Jamf Pro sites at any layer, so a smart/static group created through it is always Full JSS (siteless). There is no way, at the provider level, to assign a jamfplatform_device_group to a site.

This is an upstream limitation in the Platform API — not fixable in the provider.

Wire evidence (live tenant, raw curl, HTTP 200)

Platform device-groups API has no site/siteId field in GET (single), LIST, or CREATE:

• GET /api/device-groups/v1/tenant/{tenant}/device-groups/{id} →
  { id, name, description, deviceType, groupType, memberCount, criteria } — no site.
• CREATE request body (scaffold) →
  { criteria, description, deviceType, groupType, members, name } — no site.

By contrast, the Pro computer-groups API does expose it: Pro v3
/computer-groups/smart-groups/{id} returns "siteId" (e.g. "-1" = Full JSS),
matching the SDK's SmartComputerGroupV3.SiteID field.

Impact

• A jamfplatform_device_group-created smart group can only scope a deployment/object that is not itself site-scoped. Combining it with a site-scoped object (e.g. an App Installer with site_id set) fails server-side with INVALID_FIELD: not existing smart group, because a site-scoped object only accepts groups belonging to that site.
• Surfaced while building jamfplatform_pro_app_installer (feat(pro/apps): App Installers — deployment resource + catalog data sources #177): enabled=true requires a real smart_group_id, but a site-scoped App Installer cannot use a Full-JSS device_group. site_id on the App Installer is therefore plumbed but not acceptance-tested via a device_group fixture.

Options / ask

1. Document the limitation on the jamfplatform_device_group resource (site is not supported via the Platform API).
2. If site-scoped group management is needed, it would require the Pro computer-groups API (CreateSmartComputerGroupV3 carries SiteID) — a separate resource, not device_group.
3. Track upstream: request the Platform device-groups API expose/accept siteId.

No provider-level fix is possible today.