# Add a new SSO payload configuration to an existing profile

To create Ios SSO policy

## Endpoint

`POST /api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy`

## Request URL

```
https://{serverurl}/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy
```

## Scope

```
MDMOnDemand.MDMDeviceMgmt.CREATE
```

## Header

```
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
```

## Request Parameters

### Path Parameters

- **profile_id** `string` (Mandatory)  
  Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/mobile-device-management/help/api/cloud/profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/mobile-device-management/help/api/cloud/profiles-get-profile.html) response.

### Query Parameters

- **t** `long` (Optional)
- **ignoreHeader** `boolean` (Optional)
- **qlt** `long` (Optional)
- **previousTab** `string` (Optional)
- **service** `string` (Optional)
- **search** `string` (Optional)  
  Free-text search string applied to the default searchable fields of the resource
- **all** `boolean` (Optional)
- **dc_customerid** `long` (Optional)
- **mdm_instance** `string` (Optional)
- **signupsrc** `string` (Optional)
- **zaaid** `string` (Optional)
- **command** `string` (Optional)
- **orderby** `string` (Optional)
- **sortorder** `string` (Optional)
- **select_all** `boolean` (Optional)  
  When true, applies the operation to every record matching the current filter rather than to specific IDs. Default: false
- **zoho-internal** `boolean` (Optional)
- **dc_instance** `string` (Optional)
- **SUBREQUEST** `string` (Optional)
- **source** `string` (Optional)
- **nocache** `long` (Optional)  
  param to avoid being served from cache
- **wms_csrparam** `string` (Optional)  
  CSRF Token

### Request Body

`application/json`

#### JSON Object

- **account_display_name** `string` (Mandatory)  
  Account Display Name
- **account_type** `integer` (Optional)  
  SSO account type. Allowed values: 0=Kerberos
- **auth_type** `integer` (Optional)  
  SSO authentication type. Allowed values: 0=Password/Username, 1=Certificate
- **kerberos_prinicpal_name** `string` (Optional)  
  Kerberos Prinicpal Name
- **kerberos_realm** `string` (Mandatory)  
  Kerberos Realm
- **client_cert_id** `long` (Optional)  
  Client identity certificate ID obtained from the [Certificates API](https://www.manageengine.com/mobile-device-management/help/api/cloud/certificates-get-certificates.html). Must be an identity certificate (`is_identity` = true)
- **allowed_apps** `array` (Optional)  
  List of apps allowed for Single Sign-On
  - `group_display_name` `string` (Optional)  
    Display name of the app group
  - `identifier` `string` (Optional)  
    Bundle identifier of the app
- **url_details** `array` (Optional)  
  List of URL prefixes that must be matched for SSO to work
  - `url` `string` (Optional)  
    URL or domain string

## Sample Request

### Curl

```bash
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: application/json' \
  --data '{"account_display_name":"Zylker User","kerberos_realm":"value"}'
```

### Java

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy"))
        .header("content-type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"account_display_name\":\"Zylker User\",\"kerberos_realm\":\"value\"}"))
        .build();
    HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}
```

### Python

```python
import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"account_display_name\":\"Zylker User\",\"kerberos_realm\":\"value\"}"

headers = {
    'content-type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))
```

### Deluge

```javascript
headersMap = Map();
headersMap.put("Content-Type", "application/json");
headersMap.put("Accept", "application/json");

data=Map();
data.put("account_display_name","value");
data.put("kerberos_realm","value");

response = invokeUrl
[
    url: "https://appDomain/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy"
    type: POST
    headers: headersMap
    body: data
    connection: connection_name
]

info response;
```

### PowerShell

```powershell
$headers=@{}
$headers.Add("content-type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/iosssopolicy' -Method POST -Headers $headers -ContentType 'application/json' -Body '{"account_display_name":"Zylker User","kerberos_realm":"value"}'
```

## Sample Request Body

Add SSO payload to the profile

```json
{
  "client_cert_id": -1,
  "account_type": 1,
  "auth_type": 1,
  "url_details": [
    "https://zylker.com/auth"
  ],
  "account_display_name": "Zylker User",
  "allowed_apps": [
    {
      "group_display_name": "Zylker App",
      "identifier": "com.zylker.app"
    }
  ],
  "kerberos_realm": "value",
  "kerberos_prinicpal_name": "Zylker User"
}
```

## Response Parameters

### HTTP 200

Response Body - `application/json`

#### JSON Object

- **payload_id** `long`  
  Unique identifier for the created payload item
- **account_display_name** `string`  
  Account Display Name
- **account_type** `integer`  
  SSO account type. Allowed values: 0=Kerberos
- **auth_type** `integer`  
  SSO authentication type. Allowed values: 0=Password/Username, 1=Certificate
- **kerberos_prinicpal_name** `string`  
  Kerberos Prinicpal Name
- **kerberos_realm** `string`  
  Kerberos Realm
- **client_cert_id** `long`  
  Client identity certificate ID obtained from the [Certificates API](https://www.manageengine.com/mobile-device-management/help/api/cloud/certificates-get-certificates.html). Must be an identity certificate (`is_identity` = true)
- **allowed_apps** `array`  
  List of apps allowed for Single Sign-On
  - `group_display_name` `string`  
    Display name of the app group
  - `identifier` `string`  
    Bundle identifier of the app
- **url_details** `array`  
  List of URL prefixes that must be matched for SSO to work
  - `url` `string`  
    URL or domain string

## Possible Response Codes

- **200** HTTP code

## Sample Response: HTTP 200

SSO payload successfully added

```json
{
  "client_cert_id": -1,
  "payload_id": 9007199254741000,
  "account_type": 1,
  "auth_type": 1,
  "url_details": [
    "https://zylker.com/auth"
  ],
  "account_display_name": "Zylker User",
  "allowed_apps": [
    {
      "group_display_name": "Zylker App",
      "identifier": "com.zylker.app"
    }
  ],
  "kerberos_realm": "value",
  "kerberos_prinicpal_name": "Zylker User"
}
```

## Rate Limit

**Duration:** 1 minute  
**Threshold:** 30  
**Lock period:** 5 minutes  

- Duration - Time window for the threshold.  
- Threshold - Number of API calls allowed within the specified duration.  
- Lock Period - Wait time before consecutive API requests.