# Configures a New Privilege Elevation Application Group

Creates the privilege application group and populates it with applications that standard users may elevate. Prefetch vendorID or productVendorID from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-rule-types.html) and supply them as verifiedAppRepoIDs in addedRules.

## Endpoint

**POST** `/dcapi/appctrl/privilegeAppGroup`

## Request URL

`https://{server-hostname}:8383/dcapi/appctrl/privilegeAppGroup`

## Scope

`AppControl.CREATE`

## Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

| Parameter | Type | Required | Description |
|---|---|---|---|
| content-type | string | Optional |  |

### Request Body

`application/json`

| Parameter | Type | Required | Description |
|---|---|---|---|
| jitRequestMode | string | Mandatory | JIT request mode (0=Disabled, 1=Enabled, 2=Approval Required) |
| configSpecificAppEnabled | boolean | Mandatory | Whether config-specific app elevation is enabled |
| appGroupType | integer | Mandatory | Type of application group (3=Privilege) |
| addedRules | JSON array | Mandatory | Rules to add |
| removedRules | array | Mandatory | Empty Array For Creation |

## Sample Request

```curl
curl --request POST \
  --url https://appdomain/dcapi/appctrl/privilegeAppGroup \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: SOME_STRING_VALUE' \
  --data '{"removedRules":[],"appGroupType":3,"configSpecificAppEnabled":true,"jitRequestMode":"1","addedRules":[{"appRuleType":1,"verifiedAppRepoIDs":[610,611]}]}'
```

## Sample Request Body

Create a privilege group with specific vendor-based apps for elevation

```json
{
  "removedRules": [],
  "appGroupType": 3,
  "configSpecificAppEnabled": true,
  "jitRequestMode": "1",
  "addedRules": [
    {
      "appRuleType": 1,
      "verifiedAppRepoIDs": [
        610,
        611
      ]
    }
  ]
}
```

## Response Parameters

### HTTP Code 200

Response Body: `application/json`

| Parameter | Type | Description |
|---|---|---|
| status | boolean | Whether the operation completed successfully (true=success, false=failure) |

### HTTP Code 401

Response Body: `application/json`

| Parameter | Type | Description |
|---|---|---|
| errorCode | long | Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required) |
| errorMsg | string | Authentication failure reason |

### HTTP Code 500

Response Body: `application/json`

| Parameter | Type | Description |
|---|---|---|
| errorCode | string | Internal error code: INTERNAL_ERROR when exception occurs creating privilege app group |
| errorMessage | string | Detailed message: Error Occurred while add or update privilege app group |

## Possible Response Codes

| HTTP Code |
|---|
| 200 |
| 401 |
| 500 |

## Sample Response: HTTP 200

Privilege application group created successfully

```json
{
  "status": true
}
```

## Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

## Sample Response: HTTP 500

Internal error while creating privilege app group

```json
{
  "errorMessage": "Error Occurred while add or update privilege app group",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limits

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.