# Modifies the privilege elevation application group by adding or removing rules

Updates the privilege application group by adding new rules or removing existing ones. Prefetch vendorID or productVendorID from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-rule-types.html) for new rules, and prefetch appRuleID from [Get Privilege Application Group](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-privilege-app-group.html) for rules to remove.

## Endpoint

**POST** `/dcapi/appctrl/privilegeAppGroup`

## Request

### Request URL

`https://[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)/dcapi/appctrl/privilegeAppGroup`

### Scope

`DesktopCentralCloud.AppControl.CREATE`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** `string` — **Mandatory**
  - `application/addUpdatePrivilegeAppGroup.v1+json`
- **Accept** `string` — **Mandatory**
  - `application/addUpdatePrivilegeAppGroup.v1+json`

#### Request Body

`application/json`

- `JSON Object`
  - **jitRequestMode** `string` — **Mandatory**
    - JIT request mode (0=Disabled, 1=Enabled, 2=Approval Required)
  - **configSpecificAppEnabled** `boolean` — **Mandatory**
    - Whether config-specific app elevation is enabled
  - **appGroupType** `integer` — **Mandatory**
    - Type of application group (3=Privilege)
  - **addedRules** `JSON Array` — **Mandatory**
    - Rules to add
  - **removedRules** `JSON Array` — **Mandatory**
    - Rules to remove

### Sample Request

```curl
curl --request POST \
  --url https://appdomains/dcapi/appctrl/privilegeAppGroup \
  --header 'Accept: application/addUpdatePrivilegeAppGroup.v1+json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/addUpdatePrivilegeAppGroup.v1+json' \
  --data '{"removedRules":[{"appRuleType":1,"appRuleIDs":[610]}],"appGroupType":3,"configSpecificAppEnabled":true,"jitRequestMode":"2","addedRules":[{"appRuleType":2}]}'
```

### Sample Request Body

Update privilege group — add product rules and remove existing vendor rules

```json
{
  "removedRules": [
    {
      "appRuleType": 1,
      "appRuleIDs": [
        610
      ]
    }
  ],
  "appGroupType": 3,
  "configSpecificAppEnabled": true,
  "jitRequestMode": "2",
  "addedRules": [
    {
      "appRuleType": 2,
      "verifiedAppRepoIDs": [
        700
      ]
    }
  ]
}
```

## Response Parameters

### HTTP Code 200

Response Body — `application/json`

- `JSON Object`
  - **status** `boolean`
    - Whether the operation completed successfully (true=success, false=failure)

### HTTP Code 401

Response Body — `application/json`

- `JSON Object`
  - **errorCode** `long`
    - Unauthorized error code: credentials missing, expired, or invalid
  - **errorMsg** `string`
    - Authentication failure reason

### HTTP Code 500

Response Body — `application/json`

- `JSON Object`
  - **errorCode** `string`
    - Internal error code: INTERNAL_ERROR when exception occurs updating privilege app group
  - **errorMessage** `string`
    - Detailed message: Error Occurred while add or update privilege app group

### Possible Response Codes

- `200` — HTTP code
- `401` — HTTP code
- `500` — HTTP code

### Sample Response: HTTP 200

Privilege application group updated successfully

```json
{
  "status": true
}
```

### Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

### Sample Response: HTTP 500

Internal error while updating privilege app group

```json
{
  "errorMessage": "Error Occurred while add or update privilege app group",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limit

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.