Adds URL-based and group-based Java rules to a Draft JRM profile.
https://{serverurl}/bsp/api/v1/bmp/jrm/{jrm_profile_id}/jrm_payloads
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
JRM Profile ID from List JRM Profiles response (jrm_profile_id field)
Send Java rules inside the 'jrm_payloads' object. Use 'urls' for website-specific rules (provide webdomain_ids from Web Domain Management) OR 'groups' for group-based rules (provide group ids). Do not mix both in the same payload. Actions: 0=Block Java, 1=Run (allow with optional java_version), 2=Default (browser setting). The 'block_message' field is only available when action=0 (Block) to show a custom message to users.
curl --request POST \
--url https://appdomains/bsp/api/v1/bmp/jrm/{jrm_profile_id}/jrm_payloads \
--header 'Accept: application/json' \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{}'Block Java on URLs with message
{
"jrm_payloads": {
"urls": [
{
"action": 0,
"webdomain_ids": [
"3",
"1"
]
}
],
"block_message": "Java applet execution is blocked by security policy"
}
}
Allow Java on URLs
{
"jrm_payloads": {
"urls": [
{
"java_version": "1.7.0_04",
"action": 1,
"webdomain_ids": [
"3",
"1"
]
}
]
}
}
curl --request POST \
--url https://appdomains/bsp/api/v1/bmp/jrm/{jrm_profile_id}/jrm_payloads \
--header 'Accept: application/json' \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{}'Block Java for group with message
{
"jrm_payloads": {
"groups": [
{
"ids": [
"26"
],
"action": 0
}
],
"block_message": "Java applet execution is blocked by security policy"
}
}
Default action for group
{
"jrm_payloads": {
"groups": [
{
"ids": [
"28"
],
"action": 2
}
]
}
}
Response after adding a new payload
The newly created payload with its rules. The 'config_data_item_id' inside 'jrm_details' is needed for future Modify/Delete operations
Payload details returned after create or modify
Always '64101' identifies this as a Java Rules Manager payload
Custom message shown to users when Java is blocked (only applies when action=0). Empty string if not set
The rule sets with URL/group rules. Use 'config_data_item_id' from here as {jrm_payload_id} for future Modify/Delete calls
Individual rule set with URL and group rules
Unique ID for this rule set use as {jrm_payload_id} in Modify Payload (PUT) API
URL-based rules each entry controls Java behavior for a specific website
Java rule for a specific website URL
Webdomain ID (references a site configured in Browser Security > Web Domain Management)
The website URL/domain name (read-only, set when the webdomain was created)
What to do with Java on this site: '0' = Block Java entirely, '1' = Allow Java to run, '2' = Use browser's default Java setting
When action is '1' (Allow), specifies the required Java version (e.g., '1.7.0_04'). Leave empty to allow any installed version
Group-based rules each entry controls Java behavior for a group of websites
Java rule for a webdomain group
Webdomain group ID (references a group configured in Browser Security > Web Domain Management)
Name of the webdomain group (read-only, set when the group was created)
What to do with Java for all sites in this group: '0' = Block Java, '1' = Allow Java, '2' = Use browser default
When action is '1' (Allow), specifies the required Java version. Leave empty to allow any installed version
Whether default Rich Internet Application settings are applied
Configuration label (always 'JAVA_RULES_MANAGER')
Error identifier (e.g., 'IAM0006' for invalid field value)
Describes which field or value is invalid
Unauthorized error code: credentials missing, expired, or invalid
Authentication failure reason
Error code indicating insufficient permissions
Message indicating insufficient privileges to access this resource
Message indicating the requested resource was not found
Rate limit error code returned when the API call reached threshold
Rate limit exceeded message with retry guidance
Description of the server-side error
Created payload
{
"jrm_payloads": [
{
"payload_type": "64101",
"block_message": "",
"jrm_details": [
{
"config_data_item_id": "971",
"urls": [
{
"java_version": "1.7.0_04",
"action": "1",
"id": "3",
"url": "localhost"
}
],
"groups": []
}
],
"default_rias": false,
"config_label": "JAVA_RULES_MANAGER"
}
]
}
Webdomain not found
{
"errorcode": "IAM0006",
"errormsg": "Field value of {0} is invalid."
}
Group not found
{
"errorcode": "IAM0006",
"errormsg": "Field value of {0} is invalid."
}
Unauthorized
{
"errorCode": "IAM0001",
"errorMsg": "Authentication key is invalid. Please regenerate the key and try again."
}
Forbidden
{
"errorCode": "FORBIDDEN",
"errorMsg": "You do not have permission to access this resource"
}
Profile not found
{
"errormsg": "Profile not found"
}
Rate limit exceeded
{
"errorCode": "RATE_LIMIT_EXCEEDED",
"errorMsg": "You have exceeded the maximum number of API calls. Please try again later."
}
Server error
{
"errormsg": "Internal Server error, Please try again in a moment."
}
![]()
Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.