Save the Filevault Server settings
post /api/v1/mdm/profiles/filevaults
https://{serverurl}/api/v1/mdm/profiles/filevaults
MDMOnDemand.MDMDeviceMgmt.CREATECopied!
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Core encryption settings including name and type
Name for the encryption settings configuration
Type of recovery key. Allowed values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Personal and Institutional Recovery Key
FileVault-specific settings including recovery key options and user messages
Recovery key type. Allowed values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Both
Message shown to the user about the recovery key escrow location
Restrict users from turning off FileVault in System Settings. Default: false
Copy recovery key to MDM server. Default: true
Force encryption at the next logout. Default: false
Prompt user to enable FileVault during logout. Default: false
Maximum number of login bypass attempts before FileVault is enforced. -1=disabled, 0=enforce at next login
Personal recovery key configuration (used when encryption_settings_type is 1 or 3)
Display personal recovery key to user after FileVault is enabled. Default: false
Enable automatic personal recovery key rotation via the agent. Default: false
Institutional recovery key configuration (used when encryption_settings_type is 2 or 3)
Certificate ID for institutional recovery key encryption. Upload a .p12/.pfx certificate via the Upload Certificate API to obtain this ID
curl --request POST \
--url https://appdomain/api/v1/mdm/profiles/filevaults \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'content-type: application/json' \
--data '{"mdmencryptionsettings":{"encryption_settings_type":1,"settings_name":"Corporate FileVault Settings"}}'Create FileVault encryption settings with Personal Recovery Key
{
"mdmfilevaultsettings": {
"copy_recovery_key_to_mdm": true,
"dont_allow_filevault_disable": false,
"recovery_key_type": 1,
"maximum_attempts_to_force": -1,
"force_encryption_until_logout": false,
"ask_enable_during_logout": false,
"message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
},
"mdmfilevaultpersonalkeyconfiguration": {
"show_recovery_key": false,
"enable_ec_agent_prk_rotation": false
},
"mdmencryptionsettings": {
"encryption_settings_type": 1,
"settings_name": "Corporate FileVault Settings"
}
}
Create FileVault encryption settings with Institutional Recovery Key
{
"mdmfilevaultsettings": {
"dont_allow_filevault_disable": false,
"recovery_key_type": 2
},
"mdmfilevaultinstitutionconfiguration": {
"institution_encryption_cert": 6967000001030029
},
"mdmencryptionsettings": {
"encryption_settings_type": 2,
"settings_name": "Institutional FileVault Settings"
}
}
Create FileVault encryption settings with both Personal and Institutional Recovery Keys
{
"mdmfilevaultsettings": {
"copy_recovery_key_to_mdm": true,
"dont_allow_filevault_disable": false,
"recovery_key_type": 3,
"maximum_attempts_to_force": -1,
"force_encryption_until_logout": false,
"ask_enable_during_logout": false,
"message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
},
"mdmfilevaultinstitutionconfiguration": {
"institution_encryption_cert": 6967000001030029
},
"mdmfilevaultpersonalkeyconfiguration": {
"show_recovery_key": false,
"enable_ec_agent_prk_rotation": false
},
"mdmencryptionsettings": {
"encryption_settings_type": 3,
"settings_name": "Combined FileVault Settings"
}
}
Core encryption settings with assigned encryption_settings_id
Unique identifier for the encryption settings
Name of the encryption settings configuration
Type of recovery key. Values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Personal and Institutional Recovery Key
Description of the encryption settings
Customer ID associated with the settings
User ID who created the settings
User ID who last modified the settings
Epoch timestamp (milliseconds) when settings were created
Epoch timestamp (milliseconds) when settings were last modified
FileVault-specific settings
Recovery key type. Values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Both
Message shown to the user about the recovery key escrow location
Whether users are restricted from turning off FileVault
Whether recovery key is copied to MDM server
Whether encryption is forced at the next logout
Whether user is prompted to enable FileVault during logout
Maximum login bypass attempts before enforcement. -1=disabled, 0=enforce at next login
Personal recovery key configuration with assigned certificate IDs (present when encryption_settings_type is 1 or 3)
Whether personal recovery key is displayed to user
Whether automatic personal recovery key rotation is enabled
Identifier for the recovery key certificate
Certificate ID used to encrypt the personal recovery key
Institutional recovery key configuration (present when encryption_settings_type is 2 or 3)
Certificate ID used for institutional recovery key encryption
FileVault encryption settings successfully created (Personal and Institutional)
{
"mdmfilevaultsettings": {
"copy_recovery_key_to_mdm": true,
"dont_allow_filevault_disable": false,
"recovery_key_type": "3",
"maximum_attempts_to_force": "-1",
"force_encryption_until_logout": false,
"ask_enable_during_logout": false,
"message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
},
"mdmfilevaultinstitutionconfiguration": {
"institution_encryption_cert": "6967000001030029"
},
"mdmfilevaultpersonalkeyconfiguration": {
"show_recovery_key": false,
"recovery_key_identifier": "6967000001030023",
"enable_ec_agent_prk_rotation": false,
"recovery_encrypt_cert_id": "6967000001030023"
},
"mdmencryptionsettings": {
"modified_user": "6967000000047005",
"added_time": "1777444564220",
"modified_time": "1777444564220",
"encryption_settings_type": "3",
"added_user": "6967000000047005",
"settings_desc": "",
"customer_id": "6967000000047017",
"encryption_settings_id": "6967000001030020",
"settings_name": "Combined FileVault Settings"
}
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.