Create FileVault encryption settings with recovery key configuration. Returns an encryption_settings_id for use in FileVault profile payloads

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Save the Filevault Server settings

Request URL

https://{serverurl}/api/v1/mdm/profiles/filevaults

Scope

MDMOnDemand.MDMDeviceMgmt.CREATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

- Request Body

application/json
JSON object
Hide Sub-Attributes
mdmencryptionsettingsJSON objectMandatory

Core encryption settings including name and type

Show Sub-Attributes
settings_namestringMandatory

Name for the encryption settings configuration

encryption_settings_typeintegerMandatory

Type of recovery key. Allowed values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Personal and Institutional Recovery Key

mdmfilevaultsettingsJSON objectOptional

FileVault-specific settings including recovery key options and user messages

Show Sub-Attributes
recovery_key_typeintegerMandatory

Recovery key type. Allowed values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Both

message_to_userstringOptional

Message shown to the user about the recovery key escrow location

dont_allow_filevault_disablebooleanOptional

Restrict users from turning off FileVault in System Settings. Default: false

copy_recovery_key_to_mdmbooleanOptional

Copy recovery key to MDM server. Default: true

force_encryption_until_logoutbooleanOptional

Force encryption at the next logout. Default: false

ask_enable_during_logoutbooleanOptional

Prompt user to enable FileVault during logout. Default: false

maximum_attempts_to_forceintegerOptional

Maximum number of login bypass attempts before FileVault is enforced. -1=disabled, 0=enforce at next login

mdmfilevaultpersonalkeyconfigurationJSON objectOptional

Personal recovery key configuration (used when encryption_settings_type is 1 or 3)

Show Sub-Attributes
show_recovery_keybooleanOptional

Display personal recovery key to user after FileVault is enabled. Default: false

enable_ec_agent_prk_rotationbooleanOptional

Enable automatic personal recovery key rotation via the agent. Default: false

mdmfilevaultinstitutionconfigurationJSON objectOptional

Institutional recovery key configuration (used when encryption_settings_type is 2 or 3)

Show Sub-Attributes
institution_encryption_certlongOptional

Certificate ID for institutional recovery key encryption. Upload a .p12/.pfx certificate via the Upload Certificate API to obtain this ID

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/filevaults \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: application/json' \
  --data '{"mdmencryptionsettings":{"encryption_settings_type":1,"settings_name":"Corporate FileVault Settings"}}'
Show full

Sample Request Body

Create FileVault encryption settings with Personal Recovery Key

Copied!
  {
    "mdmfilevaultsettings": {
      "copy_recovery_key_to_mdm": true,
      "dont_allow_filevault_disable": false,
      "recovery_key_type": 1,
      "maximum_attempts_to_force": -1,
      "force_encryption_until_logout": false,
      "ask_enable_during_logout": false,
      "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
    },
    "mdmfilevaultpersonalkeyconfiguration": {
      "show_recovery_key": false,
      "enable_ec_agent_prk_rotation": false
    },
    "mdmencryptionsettings": {
      "encryption_settings_type": 1,
      "settings_name": "Corporate FileVault Settings"
    }
  }
                
Show full

Create FileVault encryption settings with Institutional Recovery Key

Copied!
  {
    "mdmfilevaultsettings": {
      "dont_allow_filevault_disable": false,
      "recovery_key_type": 2
    },
    "mdmfilevaultinstitutionconfiguration": {
      "institution_encryption_cert": 6967000001030029
    },
    "mdmencryptionsettings": {
      "encryption_settings_type": 2,
      "settings_name": "Institutional FileVault Settings"
    }
  }
                
Show full

Create FileVault encryption settings with both Personal and Institutional Recovery Keys

Copied!
  {
    "mdmfilevaultsettings": {
      "copy_recovery_key_to_mdm": true,
      "dont_allow_filevault_disable": false,
      "recovery_key_type": 3,
      "maximum_attempts_to_force": -1,
      "force_encryption_until_logout": false,
      "ask_enable_during_logout": false,
      "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
    },
    "mdmfilevaultinstitutionconfiguration": {
      "institution_encryption_cert": 6967000001030029
    },
    "mdmfilevaultpersonalkeyconfiguration": {
      "show_recovery_key": false,
      "enable_ec_agent_prk_rotation": false
    },
    "mdmencryptionsettings": {
      "encryption_settings_type": 3,
      "settings_name": "Combined FileVault Settings"
    }
  }
                
Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON object
Hide Sub-Attributes
mdmencryptionsettingsJSON object

Core encryption settings with assigned encryption_settings_id

Show Sub-Attributes
encryption_settings_idlong

Unique identifier for the encryption settings

settings_namestring

Name of the encryption settings configuration

encryption_settings_typestring

Type of recovery key. Values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Personal and Institutional Recovery Key

settings_descstring

Description of the encryption settings

customer_idlong

Customer ID associated with the settings

added_userlong

User ID who created the settings

modified_userlong

User ID who last modified the settings

added_timestring

Epoch timestamp (milliseconds) when settings were created

modified_timestring

Epoch timestamp (milliseconds) when settings were last modified

mdmfilevaultsettingsJSON object

FileVault-specific settings

Show Sub-Attributes
recovery_key_typestring

Recovery key type. Values: 1=Personal Recovery Key, 2=Institutional Recovery Key, 3=Both

message_to_userstring

Message shown to the user about the recovery key escrow location

dont_allow_filevault_disableboolean

Whether users are restricted from turning off FileVault

copy_recovery_key_to_mdmboolean

Whether recovery key is copied to MDM server

force_encryption_until_logoutboolean

Whether encryption is forced at the next logout

ask_enable_during_logoutboolean

Whether user is prompted to enable FileVault during logout

maximum_attempts_to_forcestring

Maximum login bypass attempts before enforcement. -1=disabled, 0=enforce at next login

mdmfilevaultpersonalkeyconfigurationJSON object

Personal recovery key configuration with assigned certificate IDs (present when encryption_settings_type is 1 or 3)

Show Sub-Attributes
show_recovery_keyboolean

Whether personal recovery key is displayed to user

enable_ec_agent_prk_rotationboolean

Whether automatic personal recovery key rotation is enabled

recovery_key_identifierstring

Identifier for the recovery key certificate

recovery_encrypt_cert_idstring

Certificate ID used to encrypt the personal recovery key

mdmfilevaultinstitutionconfigurationJSON object

Institutional recovery key configuration (present when encryption_settings_type is 2 or 3)

Show Sub-Attributes
institution_encryption_certstring

Certificate ID used for institutional recovery key encryption

Possible HTTP Status Codes

200HTTP code

Sample Response: HTTP 200

FileVault encryption settings successfully created (Personal and Institutional)

Copied!
  {
    "mdmfilevaultsettings": {
      "copy_recovery_key_to_mdm": true,
      "dont_allow_filevault_disable": false,
      "recovery_key_type": "3",
      "maximum_attempts_to_force": "-1",
      "force_encryption_until_logout": false,
      "ask_enable_during_logout": false,
      "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
    },
    "mdmfilevaultinstitutionconfiguration": {
      "institution_encryption_cert": "6967000001030029"
    },
    "mdmfilevaultpersonalkeyconfiguration": {
      "show_recovery_key": false,
      "recovery_key_identifier": "6967000001030023",
      "enable_ec_agent_prk_rotation": false,
      "recovery_encrypt_cert_id": "6967000001030023"
    },
    "mdmencryptionsettings": {
      "modified_user": "6967000000047005",
      "added_time": "1777444564220",
      "modified_time": "1777444564220",
      "encryption_settings_type": "3",
      "added_user": "6967000000047005",
      "settings_desc": "",
      "customer_id": "6967000000047017",
      "encryption_settings_id": "6967000001030020",
      "settings_name": "Combined FileVault Settings"
    }
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.