# Add a browser-specific payload configuration

Adds a browser-specific add-on payload to an add-on management profile. Payloads cannot be added to a published profile.

## Endpoint

`POST /bsp/api/v1/bmp/manage_addons/{addon_id}/addon_payloads`

## Request URL

`https://[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)/bsp/api/v1/bmp/manage_addons/{addon_id}/addon_payloads`

## Scope

`DesktopCentralCloud.BrowserManager.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** `string` — Mandatory: `application/json`
- **Accept** `string` — Mandatory: `application/json`

### Path Parameters

- **addon_id** `string` — Mandatory

  Add-On Management Profile ID from [List Add-On Management Profiles](https://www.manageengine.com/products/desktop-central/help/api/cloud/add-on-management-list-addon-profiles.html) response (`manage_addon_id` field)

### Request Body

JSON body with payload configuration. Uses flat format: `addon_payloads` contains `payload_type` and `browser_type` directly. Each browser type has different supported keys; refer to the examples below.

`application/json`

**JSON Object**

Add-on payload. Pick a browser from the dropdown.

- **addon_payloads** — Optional

  Browser-specific payload

## Examples

### Google Chrome

Add-on payload for Google Chrome (`browser_type=1`, `payload_type=64125`).

#### Sample Request

```curl
curl --request POST \
  --url https://appdomains/bsp/api/v1/bmp/manage_addons/{addon_id}/addon_payloads \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{}'
```

#### Sample Request Body - Google Chrome

Chrome payload (`browser_type=1`).

```json
{
  "addon_payloads": {
    "restrict_permissions": 1,
    "payload_type": 64125,
    "runtime_addons": [],
    "restrict_domains": -1,
    "pinned_addons": [
      "30"
    ],
    "permissions": [
      "10"
    ],
    "browser_type": 1,
    "policies": {
      "disable_user_extensions": "1"
    },
    "add_ons": [
      {
        "binary_id": "30"
      }
    ],
    "restrict_addons": "1",
    "native_hosts": {
      "native_permission": "-1",
      "native_ids": []
    },
    "install_addons": [
      "30"
    ]
  }
}
```

## Response Parameters

### HTTP Code 200

Response Body: `application/json`

**JSON Object**

- **addon_payloads**

  Newly added payload configurations. Schema branches by target browser.

### HTTP Code 401

Response Body: `application/json`

**JSON Object**

- **errorCode** `long`

  Unauthorized error code: credentials missing, expired, or invalid

- **errorMsg** `string`

  Authentication failure reason

### HTTP Code 403

Response Body: `application/json`

**JSON Object**

- **errorCode** `long`

  Error code indicating insufficient permissions

- **errorMsg** `string`

  Message indicating insufficient privileges to access this resource

### HTTP Code 404

Response Body: `application/json`

**JSON Object**

- **errormsg** `string`

  Message indicating the requested resource was not found

### HTTP Code 409

Response Body: `application/json`

**JSON Object**

- **errormsg** `string`

  Message indicating a published profile cannot be modified

### HTTP Code 429

Response Body: `application/json`

**JSON Object**

- **errorCode** `long`

  Rate limit error code returned when the API call reached threshold

- **errorMsg** `string`

  Rate limit exceeded message with retry guidance

### HTTP Code 500

Response Body: `application/json`

**JSON Object**

- **errormsg** `string`

  Message describing the internal server error

## Possible Response Codes

- `200` — HTTP code
- `401` — HTTP code
- `403` — HTTP code
- `404` — HTTP code
- `409` — HTTP code
- `429` — HTTP code
- `500` — HTTP code

## Response Examples

### Sample Response: HTTP 200 - Google Chrome

Chrome payload added.

```json
{
  "addon_payloads": [
    {
      "restrict_permissions": "1",
      "payload_type": "64125",
      "restrict_domains": "-1",
      "binaries_details": [
        {
          "browser_type": "1",
          "name": "Google Translate",
          "binary_id": "30",
          "id": "aapbdbdomjkkjkaonfhkkikfgjllcleb"
        }
      ],
      "payload_id": "1170",
      "permissions": [
        {
          "name": "Context menu",
          "id": "10"
        }
      ],
      "pinned_binaries_details": [
        {
          "browser_type": "1",
          "name": "Google Translate",
          "binary_id": "30",
          "id": "aapbdbdomjkkjkaonfhkkikfgjllcleb"
        }
      ],
      "browser_type": "1",
      "policies": {
        "disable_user_extensions": "1",
        "allow_flash": "-1"
      },
      "restrict_addons": "1",
      "native_hosts": {
        "native_permission": "-1",
        "native_details": []
      },
      "config_label": "MANAGE_CHROME_ADDONS"
    }
  ]
}
```

### Sample Response: HTTP 401

Unauthorized.

```json
{
  "errorCode": "UNAUTHORIZED",
  "errorMsg": "You are not authorized to perform this action"
}
```

### Sample Response: HTTP 403

Insufficient permissions.

```json
{
  "errorCode": "FORBIDDEN",
  "errorMsg": "User does not have permission to perform this operation"
}
```

### Sample Response: HTTP 404

Profile not found.

```json
{
  "errormsg": "Profile not found"
}
```

### Sample Response: HTTP 409

Cannot modify published profile.

```json
{
  "errormsg": "Cannot modify published policy. Clone the policy and retry"
}
```

### Sample Response: HTTP 429

Rate limit exceeded.

```json
{
  "errorCode": "RATE_LIMIT_EXCEEDED",
  "errorMsg": "Too many requests. Please try again after 5 minutes"
}
```

### Sample Response: HTTP 500

Server error.

```json
{
  "errormsg": "Internal Server error, Please try again in a moment."
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.