# Grants time-limited JIT access or privilege elevation on a computer

Creates a Just-In-Time temporary access policy. Set `jitType=1` to allow blocked applications or `jitType=2` to elevate privileges for a specified duration. Prefetch `computerID`, `platformID`, `computerName`, and `friendlyComputerName` from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html). To target specific applications, also prefetch `appRuleType` and `verifiedAppRepoIDs` from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-rule-types.html).

## Endpoint

`POST /dcapi/appctrl/temporaryaccess`

## Request URL

`https://`[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)`/dcapi/appctrl/temporaryaccess`

## Scope

`DesktopCentralCloud.AppControl.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** (`string`, Mandatory): `application/addTemporaryAccessPolicy.v2+json`
- **Accept** (`string`, Mandatory): `application/addTemporaryAccessPolicy.v2+json`

### Request Body

`application/json`

- **computerID** (`string`, Mandatory): Target computer resource ID — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html).
- **durationMinutes** (`string`, Mandatory): Access window length in minutes (for example, `'60'`). Applicable when `durationType=1`.
- **jitType** (`integer`, Mandatory): JIT type (`1=Allow blocked applications`, `2=Elevate privileges`).
- **policyID** (`string`, Optional): Policy ID (`null` when creating a new policy).
- **friendlyComputerName** (`string`, Mandatory): Display name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html).
- **policyName** (`string`, Mandatory): Display name for the temporary access policy.
- **computerName** (`string`, Mandatory): System name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html).
- **jitSettings** (`JSON Object`, Mandatory): Nested object controlling which applications are allowed or elevated.
- **description** (`string`, Optional): Optional description of the policy.
- **accessCode** (`string`, Optional): Access code (`null` to let the server auto-generate one).
- **platformID** (`integer`, Mandatory): Platform ID (`1=Windows`, `2=Mac`).
- **durationType** (`integer`, Mandatory): How the duration is specified (`1=Fixed minutes`, `2=Date range`).
- **userID** (`string`, Optional): Restrict policy to a specific user (`null` for all users on the computer).
- **durationFrom** (`string`, Optional): Start time in epoch ms (`null` when `durationType=1`).
- **durationTo** (`string`, Optional): End time in epoch ms (`null` when `durationType=1`).
- **createdTime** (`string`, Optional): Creation timestamp (leave empty — server-generated).
- **createdUser** (`string`, Optional): Creator user name (leave empty — server-generated).
- **createdUserID** (`string`, Optional): Creator user ID (leave empty — server-generated).

## Sample Request

```curl
curl --request POST \
  --url https://appdomains/dcapi/appctrl/temporaryaccess \
  --header 'Accept: application/addTemporaryAccessPolicy.v2+json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/addTemporaryAccessPolicy.v2+json' \
  --data '{"computerID":"605","durationMinutes":"60","jitType":1,"friendlyComputerName":"AndrewLasch","policyName":"JIT Allow All","computerName":"AndrewLasch","jitSettings":{"isAllowBlocklist":false,"jitAccessType":2},"platformID":1,"durationType":1}'
```

## Sample Request Body

### Application Allowing (`jitType=1`) — All applications, 60-minute duration

```json
{
  "computerID": "605",
  "durationMinutes": "60",
  "jitType": 1,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Allow All",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": null,
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "durationType": 1
}
```

### Application Allowing (`jitType=1`) — Specific applications with `addedRules`

```json
{
  "durationFrom": null,
  "jitType": 1,
  "createdUserID": "",
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT 2",
  "durationTo": null,
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "userID": null,
  "durationType": 1,
  "computerID": "605",
  "durationMinutes": "60",
  "policyID": null,
  "computerName": "AndrewLasch",
  "accessCode": null,
  "createdTime": "",
  "createdUser": ""
}
```

### Application Elevation (`jitType=2`) — Elevate privileges for specific applications

```json
{
  "computerID": "605",
  "durationMinutes": "120",
  "jitType": 2,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Elevate Policy",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "Elevate privileges for specific app",
  "platformID": 1,
  "durationType": 1
}
```

## Response Parameters

### HTTP Code 200

Response body: `application/json`

- **policyID** (`long`): Unique identifier for the created temporary access policy.
- **status** (`boolean`): Whether the policy was created successfully.

### HTTP Code 401

Response body: `application/json`

- **errorCode** (`long`): Unauthorized error code returned when authentication credentials are missing, expired, or invalid (`authentication=required`).
- **errorMsg** (`string`): Authentication failure reason.

### HTTP Code 500

Response body: `application/json`

- **errorCode** (`string`): Internal error code: `INTERNAL_ERROR` when an exception occurs creating a JIT policy.
- **errorMessage** (`string`): Detailed message: `Exception while adding temporary access policy`.

## Sample Responses

### HTTP 200

Temporary access policy created successfully.

```json
{
  "policyID": 1001,
  "status": true
}
```

### HTTP 401

Authentication credentials missing or invalid.

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

### HTTP 500

Internal error while creating temporary access policy.

```json
{
  "errorMessage": "Exception while adding temporary access policy",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration — Time window for the threshold.  
Threshold — Number of API calls allowed within the specified duration.  
Lock Period — Wait time before consecutive API requests.