# Grants time-limited JIT access or privilege elevation on a computer

Creates a Just-In-Time temporary access policy. Set `jitType=1` to allow blocked applications or `jitType=2` to elevate privileges for a specified duration. Prefetch `computerID`, `platformID`, `computerName`, and `friendlyComputerName` from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html). To target specific applications, also prefetch `appRuleType` and `verifiedAppRepoIDs` from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-rule-types.html).

## Endpoint

`POST /dcapi/appctrl/temporaryaccess`

## Request

### Request URL

`https://`[*{serverurl}*](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)`/dcapi/appctrl/temporaryaccess`

### Scope

`DesktopCentralCloud.AppControl.CREATE`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** (`string`, Mandatory): `application/addTemporaryAccessPolicy.v2+json`
- **Accept** (`string`, Mandatory): `application/addTemporaryAccessPolicy.v2+json`

#### Request Body

`application/json`

- **computerID** (`string`, Mandatory): Target computer resource ID — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html)
- **durationMinutes** (`string`, Mandatory): Access window length in minutes (e.g. `'60'`). Applicable when `durationType=1`
- **jitType** (`integer`, Mandatory): JIT type (`1=Allow blocked applications`, `2=Elevate privileges`)
- **policyID** (`string`, Optional): Policy ID (null when creating a new policy)
- **friendlyComputerName** (`string`, Mandatory): Display name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html)
- **policyName** (`string`, Mandatory): Display name for the temporary access policy
- **computerName** (`string`, Mandatory): System name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-ctrl-computer-resources.html)
- **jitSettings** (`JSON Object`, Mandatory): Nested object controlling which applications are allowed or elevated
- **description** (`string`, Optional): Optional description of the policy
- **accessCode** (`string`, Optional): Access code (null to let the server auto-generate one)
- **platformID** (`integer`, Mandatory): Platform ID (`1=Windows`, `2=Mac`)
- **durationType** (`integer`, Mandatory): How the duration is specified (`1=Fixed minutes`, `2=Date range`)
- **userID** (`string`, Optional): Restrict policy to a specific user (null for all users on the computer)
- **durationFrom** (`string`, Optional): Start time in epoch ms (null when `durationType=1`)
- **durationTo** (`string`, Optional): End time in epoch ms (null when `durationType=1`)
- **createdTime** (`string`, Optional): Creation timestamp (leave empty — server-generated)
- **createdUser** (`string`, Optional): Creator user name (leave empty — server-generated)
- **createdUserID** (`string`, Optional): Creator user ID (leave empty — server-generated)

### Sample Request

#### Curl

```curl
curl --request POST \
  --url https://appdomains/dcapi/appctrl/temporaryaccess \
  --header 'Accept: application/addTemporaryAccessPolicy.v2+json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/addTemporaryAccessPolicy.v2+json' \
  --data '{"computerID":"605","durationMinutes":"60","jitType":1,"friendlyComputerName":"AndrewLasch","policyName":"JIT Allow All","computerName":"AndrewLasch","jitSettings":{"isAllowBlocklist":false,"jitAccessType":2},"platformID":1,"durationType":1}'
```

### Sample Request Body

#### Application Allowing (jitType=1) — All applications, 60-minute duration

```json
{
  "computerID": "605",
  "durationMinutes": "60",
  "jitType": 1,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Allow All",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": null,
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "durationType": 1
}
```

#### Application Allowing (jitType=1) — Specific applications with addedRules

```json
{
  "durationFrom": null,
  "jitType": 1,
  "createdUserID": "",
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT 2",
  "durationTo": null,
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "userID": null,
  "durationType": 1,
  "computerID": "605",
  "durationMinutes": "60",
  "policyID": null,
  "computerName": "AndrewLasch",
  "accessCode": null,
  "createdTime": "",
  "createdUser": ""
}
```

#### Application Elevation (jitType=2) — Elevate privileges for specific applications

```json
{
  "computerID": "605",
  "durationMinutes": "120",
  "jitType": 2,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Elevate Policy",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "Elevate privileges for specific app",
  "platformID": 1,
  "durationType": 1
}
```

## Response Parameters

### HTTP Code 200

#### Response Body

`application/json`

- **policyID** (`long`): Unique identifier for the created temporary access policy
- **status** (`boolean`): Whether the policy was created successfully

### HTTP Code 401

#### Response Body

`application/json`

- **errorCode** (`long`): Unauthorized error code: credentials missing, expired, or invalid
- **errorMsg** (`string`): Authentication failure reason

### HTTP Code 500

#### Response Body

`application/json`

- **errorCode** (`string`): Internal error code: `INTERNAL_ERROR` when exception occurs creating JIT policy
- **errorMessage** (`string`): Detailed message: Exception while adding temporary access policy

### Possible Response Codes

- **200**: HTTP code
- **401**: HTTP code
- **500**: HTTP code

### Sample Response: HTTP 200

Temporary access policy created successfully

```json
{
  "policyID": 1001,
  "status": true
}
```

### Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

### Sample Response: HTTP 500

Internal error while creating temporary access policy

```json
{
  "errorMessage": "Exception while adding temporary access policy",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.