Grants time-limited JIT access or privilege elevation on a computer

Creates a Just-In-Time temporary access policy. Set jitType=1 to allow blocked applications or jitType=2 to elevate privileges for a specified duration. Prefetch computerID, platformID, computerName, and friendlyComputerName from Get Computer Resources. To target specific applications, also prefetch appRuleType and verifiedAppRepoIDs from Get App Rule Types.

Endpoints

post /dcapi/appctrl/temporaryaccess

Copy full URL

Request URL

https://{server-hostname}:8383/dcapi/appctrl/temporaryaccess

Scope

AppControl.CREATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

content-typestringOptional

- Request Body

application/json

JSON object

Hide Sub-Attributes

computerIDstringMandatory

Target computer resource ID — prefetch from Get Computer Resources

durationMinutesstringMandatory

Access window length in minutes (e.g. '60'). Applicable when durationType=1

jitTypeintegerMandatory

JIT type (1=Allow blocked applications, 2=Elevate privileges)

policyIDstringOptional

Policy ID (null when creating a new policy)

friendlyComputerNamestringMandatory

Display name of the target computer — prefetch from Get Computer Resources

policyNamestringMandatory

Display name for the temporary access policy

computerNamestringMandatory

System name of the target computer — prefetch from Get Computer Resources

jitSettingsJSON objectMandatory

Nested object controlling which applications are allowed or elevated

Show Sub-Attributes

jitAccessTypeintegerMandatory

JIT access type (1=All Applications, 2=Specific Applications)

isAllowBlocklistbooleanMandatory

Whether this uses allow/blocklist mode (false for standard JIT)

specificAppGroupJSON objectOptional

Specific application group config (null when jitAccessType=1 for all apps)

Show Sub-Attributes

applicationRulesarrayMandatory

Existing rules already in the group (empty array for a new policy)

addedRulesJSON arrayMandatory

Rules to add — prefetch appRuleType and verifiedAppRepoIDs from Get App Rule Types

Show Sub-Attributes

JSON object

Show Sub-Attributes

appRuleTypeintegerMandatory

Rule type (1=Vendor, 2=Product, 3=Executable, 4=FileHash) — prefetch from Get App Rule Types

verifiedAppRepoIDsarrayOptional

Verified repository IDs (vendorID or productVendorID) — prefetch from Get App Rule Types

unVerifiedAppRepoIDsarrayOptional

Unverified repository IDs (empty array if not applicable)

removedRulesarrayMandatory

Rules to remove (empty array for a new policy)

descriptionstringOptional

Optional description of the policy

accessCodestringOptional

Access code (null to let the server auto-generate one)

platformIDintegerMandatory

Platform ID (1=Windows, 2=Mac)

durationTypeintegerMandatory

How the duration is specified (1=Fixed minutes, 2=Date range)

userIDstringOptional

Restrict policy to a specific user (null for all users on the computer)

durationFromstringOptional

Start time in epoch ms (null when durationType=1)

durationTostringOptional

End time in epoch ms (null when durationType=1)

createdTimestringOptional

Creation timestamp (leave empty — server-generated)

createdUserstringOptional

Creator user name (leave empty — server-generated)

createdUserIDstringOptional

Creator user ID (leave empty — server-generated)

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request POST \
  --url https://appdomain/dcapi/appctrl/temporaryaccess \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: SOME_STRING_VALUE' \
  --data '{"computerID":"605","durationMinutes":"60","jitType":1,"policyID":null,"friendlyComputerName":"AndrewLasch","policyName":"JIT Allow All","computerName":"AndrewLasch","jitSettings":{"isAllowBlocklist":false,"specificAppGroup":null,"jitAccessType":2},"description":"","platformID":1,"durationType":1}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/dcapi/appctrl/temporaryaccess"))
        .header("content-type", "SOME_STRING_VALUE")
        .header("Authorization", " d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"computerID\":\"605\",\"durationMinutes\":\"60\",\"jitType\":1,\"policyID\":null,\"friendlyComputerName\":\"AndrewLasch\",\"policyName\":\"JIT Allow All\",\"computerName\":\"AndrewLasch\",\"jitSettings\":{\"isAllowBlocklist\":false,\"specificAppGroup\":null,\"jitAccessType\":2},\"description\":\"\",\"platformID\":1,\"durationType\":1}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"computerID\":\"605\",\"durationMinutes\":\"60\",\"jitType\":1,\"policyID\":null,\"friendlyComputerName\":\"AndrewLasch\",\"policyName\":\"JIT Allow All\",\"computerName\":\"AndrewLasch\",\"jitSettings\":{\"isAllowBlocklist\":false,\"specificAppGroup\":null,\"jitAccessType\":2},\"description\":\"\",\"platformID\":1,\"durationType\":1}"

headers = {
    'content-type': "SOME_STRING_VALUE",
    'Authorization': " d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/dcapi/appctrl/temporaryaccess", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("content-type", "value");
    headersMap.put("Accept", "application/json");

    data=Map();
    data.put("computerID","value");
    data.put("durationMinutes","value");
    data.put("jitType","1");
    data.put("policyID","value");
    data.put("friendlyComputerName","value");
    data.put("policyName","value");
    data.put("computerName","value");
    data_jitSettings=Map();
    data_jitSettings.put("jitAccessType","1");
    data_jitSettings.put("isAllowBlocklist",true);
    data_jitSettings_specificAppGroup=Map();
    data_jitSettings_specificAppGroup_applicationRules=List();
    data_jitSettings_specificAppGroup.put("applicationRules",data_jitSettings_specificAppGroup_applicationRules);
    data_jitSettings_specificAppGroup_addedRules=List();
    data_jitSettings_specificAppGroup_addedRules_item1=Map();
    data_jitSettings_specificAppGroup_addedRules_item1.put("appRuleType","1");
    data_jitSettings_specificAppGroup_addedRules_item1_verifiedAppRepoIDs=List();
    data_jitSettings_specificAppGroup_addedRules_item1.put("verifiedAppRepoIDs",data_jitSettings_specificAppGroup_addedRules_item1_verifiedAppRepoIDs);
    data_jitSettings_specificAppGroup_addedRules_item1_unVerifiedAppRepoIDs=List();
    data_jitSettings_specificAppGroup_addedRules_item1.put("unVerifiedAppRepoIDs",data_jitSettings_specificAppGroup_addedRules_item1_unVerifiedAppRepoIDs);
    data_jitSettings_specificAppGroup_addedRules.add(data_jitSettings_specificAppGroup_addedRules_item1);
    data_jitSettings_specificAppGroup.put("addedRules",data_jitSettings_specificAppGroup_addedRules);
    data_jitSettings_specificAppGroup_removedRules=List();
    data_jitSettings_specificAppGroup.put("removedRules",data_jitSettings_specificAppGroup_removedRules);
    data_jitSettings.put("specificAppGroup",data_jitSettings_specificAppGroup);
    data.put("jitSettings",data_jitSettings);
    data.put("description","value");
    data.put("accessCode","value");
    data.put("platformID","1");
    data.put("durationType","1");
    data.put("userID","value");
    data.put("durationFrom","value");
    data.put("durationTo","value");
    data.put("createdTime","value");
    data.put("createdUser","value");
    data.put("createdUserID","value");

    response = invokeUrl
    [
        url: "https://appDomain/dcapi/appctrl/temporaryaccess"
        type: POST
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("content-type", "SOME_STRING_VALUE")
$headers.Add("Authorization", " d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/dcapi/appctrl/temporaryaccess' -Method POST -Headers $headers -ContentType 'SOME_STRING_VALUE' -Body '{"computerID":"605","durationMinutes":"60","jitType":1,"policyID":null,"friendlyComputerName":"AndrewLasch","policyName":"JIT Allow All","computerName":"AndrewLasch","jitSettings":{"isAllowBlocklist":false,"specificAppGroup":null,"jitAccessType":2},"description":"","platformID":1,"durationType":1}'

▼ Show full

Sample Request Body

Application Allowing (jitType=1) — All applications, 60-minute duration

Copied!

  {
    "computerID": "605",
    "durationMinutes": "60",
    "jitType": 1,
    "policyID": null,
    "friendlyComputerName": "AndrewLasch",
    "policyName": "JIT Allow All",
    "computerName": "AndrewLasch",
    "jitSettings": {
      "isAllowBlocklist": false,
      "specificAppGroup": null,
      "jitAccessType": 2
    },
    "description": "",
    "platformID": 1,
    "durationType": 1
  }

▼ Show full

Application Allowing (jitType=1) — Specific applications with addedRules

Copied!

  {
    "durationFrom": null,
    "jitType": 1,
    "createdUserID": "",
    "friendlyComputerName": "AndrewLasch",
    "policyName": "JIT 2",
    "durationTo": null,
    "jitSettings": {
      "isAllowBlocklist": false,
      "specificAppGroup": {
        "removedRules": [],
        "applicationRules": [],
        "addedRules": [
          {
            "appRuleType": 1,
            "verifiedAppRepoIDs": [
              "610"
            ]
          }
        ]
      },
      "jitAccessType": 2
    },
    "description": "",
    "platformID": 1,
    "userID": null,
    "durationType": 1,
    "computerID": "605",
    "durationMinutes": "60",
    "policyID": null,
    "computerName": "AndrewLasch",
    "accessCode": null,
    "createdTime": "",
    "createdUser": ""
  }

▼ Show full

Application Elevation (jitType=2) — Elevate privileges for specific applications

Copied!

  {
    "computerID": "605",
    "durationMinutes": "120",
    "jitType": 2,
    "policyID": null,
    "friendlyComputerName": "AndrewLasch",
    "policyName": "JIT Elevate Policy",
    "computerName": "AndrewLasch",
    "jitSettings": {
      "isAllowBlocklist": false,
      "specificAppGroup": {
        "removedRules": [],
        "applicationRules": [],
        "addedRules": [
          {
            "appRuleType": 1,
            "verifiedAppRepoIDs": [
              "610"
            ]
          }
        ]
      },
      "jitAccessType": 2
    },
    "description": "Elevate privileges for specific app",
    "platformID": 1,
    "durationType": 1
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON object

Hide Sub-Attributes

policyIDlong

Unique identifier for the created temporary access policy

statusboolean

Whether the policy was created successfully

- HTTP code 401

Response Body - application/json

JSON object

Hide Sub-Attributes

errorCodelong

Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)

errorMsgstring

Authentication failure reason

- HTTP code 500

Response Body - application/json

JSON object

Hide Sub-Attributes

errorCodestring

Internal error code: INTERNAL_ERROR when exception occurs creating JIT policy

errorMessagestring

Detailed message: Exception while adding temporary access policy

Possible Response Codes

200HTTP code

401HTTP code

500HTTP code

Sample Response: HTTP 200

Temporary access policy created successfully

Copied!

  {
    "policyID": 1001,
    "status": true
  }

▼ Show full

Sample Response: HTTP 401

Authentication credentials missing or invalid

Copied!

  {
    "errorMessage": "Authentication credentials are missing or invalid",
    "errorCode": "UNAUTHORIZED"
  }

▼ Show full

Sample Response: HTTP 500

Internal error while creating temporary access policy

Copied!

  {
    "errorMessage": "Exception while adding temporary access policy",
    "errorCode": "INTERNAL_ERROR"
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.