# Grants time-limited JIT access or privilege elevation on a computer

Creates a Just-In-Time temporary access policy. Set jitType=1 to allow blocked applications or jitType=2 to elevate privileges for a specified duration. Prefetch computerID, platformID, computerName, and friendlyComputerName from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-ctrl-computer-resources.html). To target specific applications, also prefetch appRuleType and verifiedAppRepoIDs from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-rule-types.html).

## Endpoints

`POST /dcapi/appctrl/temporaryaccess`

## Request URL

`https://{server-hostname}:8383/dcapi/appctrl/temporaryaccess`

## Scope

`AppControl.CREATE`

## Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **content-type** — `string` *(Optional)*

### Request Body

`application/json`

- JSON object
  - **computerID** — `string` *(Mandatory)*: Target computer resource ID — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-ctrl-computer-resources.html)
  - **durationMinutes** — `string` *(Mandatory)*: Access window length in minutes (e.g. '60'). Applicable when durationType=1
  - **jitType** — `integer` *(Mandatory)*: JIT type (1=Allow blocked applications, 2=Elevate privileges)
  - **policyID** — `string` *(Optional)*: Policy ID (null when creating a new policy)
  - **friendlyComputerName** — `string` *(Mandatory)*: Display name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-ctrl-computer-resources.html)
  - **policyName** — `string` *(Mandatory)*: Display name for the temporary access policy
  - **computerName** — `string` *(Mandatory)*: System name of the target computer — prefetch from [Get Computer Resources](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-ctrl-computer-resources.html)
  - **jitSettings** — JSON object *(Mandatory)*: Nested object controlling which applications are allowed or elevated
  - **description** — `string` *(Optional)*: Optional description of the policy
  - **accessCode** — `string` *(Optional)*: Access code (null to let the server auto-generate one)
  - **platformID** — `integer` *(Mandatory)*: Platform ID (1=Windows, 2=Mac)
  - **durationType** — `integer` *(Mandatory)*: How the duration is specified (1=Fixed minutes, 2=Date range)
  - **userID** — `string` *(Optional)*: Restrict policy to a specific user (null for all users on the computer)
  - **durationFrom** — `string` *(Optional)*: Start time in epoch ms (null when durationType=1)
  - **durationTo** — `string` *(Optional)*: End time in epoch ms (null when durationType=1)
  - **createdTime** — `string` *(Optional)*: Creation timestamp (leave empty — server-generated)
  - **createdUser** — `string` *(Optional)*: Creator user name (leave empty — server-generated)
  - **createdUserID** — `string` *(Optional)*: Creator user ID (leave empty — server-generated)

## Sample Request

```curl
curl --request POST \
  --url https://appdomain/dcapi/appctrl/temporaryaccess \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: SOME_STRING_VALUE' \
  --data '{"computerID":"605","durationMinutes":"60","jitType":1,"policyID":null,"friendlyComputerName":"AndrewLasch","policyName":"JIT Allow All","computerName":"AndrewLasch","jitSettings":{"isAllowBlocklist":false,"specificAppGroup":null,"jitAccessType":2},"description":"","platformID":1,"durationType":1}'
```

## Sample Request Body

### Application Allowing (jitType=1) — All applications, 60-minute duration

```json
{
  "computerID": "605",
  "durationMinutes": "60",
  "jitType": 1,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Allow All",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": null,
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "durationType": 1
}
```

### Application Allowing (jitType=1) — Specific applications with addedRules

```json
{
  "durationFrom": null,
  "jitType": 1,
  "createdUserID": "",
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT 2",
  "durationTo": null,
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "",
  "platformID": 1,
  "userID": null,
  "durationType": 1,
  "computerID": "605",
  "durationMinutes": "60",
  "policyID": null,
  "computerName": "AndrewLasch",
  "accessCode": null,
  "createdTime": "",
  "createdUser": ""
}
```

### Application Elevation (jitType=2) — Elevate privileges for specific applications

```json
{
  "computerID": "605",
  "durationMinutes": "120",
  "jitType": 2,
  "policyID": null,
  "friendlyComputerName": "AndrewLasch",
  "policyName": "JIT Elevate Policy",
  "computerName": "AndrewLasch",
  "jitSettings": {
    "isAllowBlocklist": false,
    "specificAppGroup": {
      "removedRules": [],
      "applicationRules": [],
      "addedRules": [
        {
          "appRuleType": 1,
          "verifiedAppRepoIDs": [
            "610"
          ]
        }
      ]
    },
    "jitAccessType": 2
  },
  "description": "Elevate privileges for specific app",
  "platformID": 1,
  "durationType": 1
}
```

## Response Parameters

### HTTP code 200

Response Body — `application/json`

- JSON object
  - **policyID** — `long`: Unique identifier for the created temporary access policy
  - **status** — `boolean`: Whether the policy was created successfully

### HTTP code 401

Response Body — `application/json`

- JSON object
  - **errorCode** — `long`: Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)
  - **errorMsg** — `string`: Authentication failure reason

### HTTP code 500

Response Body — `application/json`

- JSON object
  - **errorCode** — `string`: Internal error code: INTERNAL_ERROR when exception occurs creating JIT policy
  - **errorMessage** — `string`: Detailed message: Exception while adding temporary access policy

## Possible Response Codes

- `200` — HTTP code
- `401` — HTTP code
- `500` — HTTP code

## Sample Response: HTTP 200

Temporary access policy created successfully

```json
{
  "policyID": 1001,
  "status": true
}
```

## Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

## Sample Response: HTTP 500

Internal error while creating temporary access policy

```json
{
  "errorMessage": "Exception while adding temporary access policy",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.