# Create FileVault encryption settings with recovery key configuration. Returns an encryption_settings_id for use in FileVault profile payloads

Save the Filevault Server settings

## Endpoints

**POST** `/api/v1/mdm/profiles/filevaults`

## Request URL

`https://{serverurl}/api/v1/mdm/profiles/filevaults`

## Scope

`MDMOnDemand.MDMDeviceMgmt.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Body

**Content-Type:** `application/json`

### Root Object

- JSON object

#### mdmencryptionsettings (JSON object) — **Mandatory**
Core encryption settings including name and type.

- **settings_name** (string) — **Mandatory**  
  Name for the encryption settings configuration.

- **encryption_settings_type** (integer) — **Mandatory**  
  Type of recovery key. Allowed values:  
  - `1` = Personal Recovery Key  
  - `2` = Institutional Recovery Key  
  - `3` = Personal and Institutional Recovery Key  

#### mdmfilevaultsettings (JSON object) — Optional
FileVault-specific settings including recovery key options and user messages.

- **recovery_key_type** (integer) — **Mandatory**  
  Recovery key type. Allowed values:  
  - `1` = Personal Recovery Key  
  - `2` = Institutional Recovery Key  
  - `3` = Both  

- **message_to_user** (string) — Optional  
  Message shown to the user about the recovery key escrow location.

- **dont_allow_filevault_disable** (boolean) — Optional  
  Restrict users from turning off FileVault in System Settings. Default: `false`.

- **copy_recovery_key_to_mdm** (boolean) — Optional  
  Copy recovery key to MDM server. Default: `true`.

- **force_encryption_until_logout** (boolean) — Optional  
  Force encryption at the next logout. Default: `false`.

- **ask_enable_during_logout** (boolean) — Optional  
  Prompt user to enable FileVault during logout. Default: `false`.

- **maximum_attempts_to_force** (integer) — Optional  
  Maximum number of login bypass attempts before FileVault is enforced.  
  - `-1` = disabled  
  - `0` = enforce at next login  

#### mdmfilevaultpersonalkeyconfiguration (JSON object) — Optional
Personal recovery key configuration (used when `encryption_settings_type` is `1` or `3`).

- **show_recovery_key** (boolean) — Optional  
  Display personal recovery key to user after FileVault is enabled. Default: `false`.

- **enable_ec_agent_prk_rotation** (boolean) — Optional  
  Enable automatic personal recovery key rotation via the agent. Default: `false`.

#### mdmfilevaultinstitutionconfiguration (JSON object) — Optional
Institutional recovery key configuration (used when `encryption_settings_type` is `2` or `3`).

- **institution_encryption_cert** (long) — Optional  
  Certificate ID for institutional recovery key encryption. Upload a `.p12`/`.pfx` certificate via the [Upload Certificate API](https://www.manageengine.com/mobile-device-management/certificates-upload-certificate.html) to obtain this ID.

## Sample Request

### Curl

```bash
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/filevaults \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: application/json' \
  --data '{"mdmencryptionsettings":{"encryption_settings_type":1,"settings_name":"Corporate FileVault Settings"}}'
```

### Java

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/filevaults"))
        .header("content-type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"mdmencryptionsettings\":{\"encryption_settings_type\":1,\"settings_name\":\"Corporate FileVault Settings\"}}"))
        .build();
    HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());

  }
}
```

### Python

```python
import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"mdmencryptionsettings\":{\"encryption_settings_type\":1,\"settings_name\":\"Corporate FileVault Settings\"}}"

headers = {
    'content-type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/api/v1/mdm/profiles/filevaults", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))
```

### Deluge

```javascript
headersMap = Map();
headersMap.put("Content-Type", "application/json");
headersMap.put("Accept", "application/json");

data=Map();
data_mdmencryptionsettings=Map();
data_mdmencryptionsettings.put("encryption_settings_type","1");
data_mdmencryptionsettings.put("settings_name","value");
data.put("mdmencryptionsettings",data_mdmencryptionsettings);

response = invokeUrl
[
    url: "https://appDomain/api/v1/mdm/profiles/filevaults"
    type: POST
    headers: headersMap
    body: data
    connection: connection_name
]

info response;
```

### PowerShell

```powershell
$headers=@{}
$headers.Add("content-type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/filevaults' -Method POST -Headers $headers -ContentType 'application/json' -Body '{"mdmencryptionsettings":{"encryption_settings_type":1,"settings_name":"Corporate FileVault Settings"}}'
```

## Sample Request Body

### Create FileVault encryption settings with Personal Recovery Key

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 1,
    "maximum_attempts_to_force": -1,
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "enable_ec_agent_prk_rotation": false
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 1,
    "settings_name": "Corporate FileVault Settings"
  }
}
```

### Create FileVault encryption settings with Institutional Recovery Key

```json
{
  "mdmfilevaultsettings": {
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 2
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": 6967000001030029
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 2,
    "settings_name": "Institutional FileVault Settings"
  }
}
```

### Create FileVault encryption settings with both Personal and Institutional Recovery Keys

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 3,
    "maximum_attempts_to_force": -1,
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": 6967000001030029
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "enable_ec_agent_prk_rotation": false
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 3,
    "settings_name": "Combined FileVault Settings"
  }
}
```

## Response Parameters

### HTTP 200

**Response Body — application/json**

#### mdmencryptionsettings (JSON object)
Core encryption settings with assigned `encryption_settings_id`.

- **encryption_settings_id** (long)  
  Unique identifier for the encryption settings.

- **settings_name** (string)  
  Name of the encryption settings configuration.

- **encryption_settings_type** (string)  
  Type of recovery key. Values:  
  - `1` = Personal Recovery Key  
  - `2` = Institutional Recovery Key  
  - `3` = Personal and Institutional Recovery Key  

- **settings_desc** (string)  
  Description of the encryption settings.

- **customer_id** (long)  
  Customer ID associated with the settings.

- **added_user** (long)  
  User ID who created the settings.

- **modified_user** (long)  
  User ID who last modified the settings.

- **added_time** (string)  
  Epoch timestamp (milliseconds) when settings were created.

- **modified_time** (string)  
  Epoch timestamp (milliseconds) when settings were last modified.

#### mdmfilevaultsettings (JSON object)
FileVault-specific settings.

- **recovery_key_type** (string)  
  Values: `1`, `2`, `3`.

- **message_to_user** (string)  
  Message shown to the user about the recovery key escrow location.

- **dont_allow_filevault_disable** (boolean)  
  Whether users are restricted from turning off FileVault.

- **copy_recovery_key_to_mdm** (boolean)  
  Whether recovery key is copied to MDM server.

- **force_encryption_until_logout** (boolean)  
  Whether encryption is forced at the next logout.

- **ask_enable_during_logout** (boolean)  
  Whether user is prompted to enable FileVault during logout.

- **maximum_attempts_to_force** (string)  
  Maximum login bypass attempts before enforcement.  
  - `-1` = disabled  
  - `0` = enforce at next login  

#### mdmfilevaultpersonalkeyconfiguration (JSON object)
Personal recovery key configuration (present when `encryption_settings_type` is `1` or `3`).

- **show_recovery_key** (boolean)  
  Whether personal recovery key is displayed to user.

- **enable_ec_agent_prk_rotation** (boolean)  
  Whether automatic personal recovery key rotation is enabled.

- **recovery_key_identifier** (string)  
  Identifier for the recovery key certificate.

- **recovery_encrypt_cert_id** (string)  
  Certificate ID used to encrypt the personal recovery key.

#### mdmfilevaultinstitutionconfiguration (JSON object)
Institutional recovery key configuration (present when `encryption_settings_type` is `2` or `3`).

- **institution_encryption_cert** (string)  
  Certificate ID used for institutional recovery key encryption.

## Sample Response: HTTP 200

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": "3",
    "maximum_attempts_to_force": "-1",
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": "6967000001030029"
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "recovery_key_identifier": "6967000001030023",
    "enable_ec_agent_prk_rotation": false,
    "recovery_encrypt_cert_id": "6967000001030023"
  },
  "mdmencryptionsettings": {
    "modified_user": "6967000000047005",
    "added_time": "1777444564220",
    "modified_time": "1777444564220",
    "encryption_settings_type": "3",
    "added_user": "6967000000047005",
    "settings_desc": "",
    "customer_id": "6967000000047017",
    "encryption_settings_id": "6967000001030020",
    "settings_name": "Combined FileVault Settings"
  }
}
```

## Possible HTTP Status Codes

- **200** — HTTP code

## Rate Limiting

**Duration:** 1 minute  
**Threshold:** 30  
**Lock period:** 5 minutes  

- **Duration** — Time window for the threshold.  
- **Threshold** — Number of API calls allowed within the specified duration.  
- **Lock Period** — Wait time before consecutive API requests.