# Modifies the privilege elevation application group by adding or removing rules

Updates the privilege application group by adding new rules or removing existing ones. Prefetch vendorID or productVendorID from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-app-rule-types.html) for new rules, and prefetch appRuleID from [Get Privilege Application Group](https://www.manageengine.com/products/desktop-central/help/api/onpremise/acp-get-privilege-app-group.html) for rules to remove.

## Endpoints

**POST** `/dcapi/appctrl/privilegeAppGroup`

## Request Details

### Request URL

```text
https://{server-hostname}:8383/dcapi/appctrl/privilegeAppGroup
```

### Scope

```text
AppControl.CREATE
```

### Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

### Request Parameters

#### Request Headers

- **content-type** `string` — Optional

#### Request Body

`application/json`

- `JSON object`
  - **jitRequestMode** `string` — Mandatory  
    JIT request mode (0=Disabled, 1=Enabled, 2=Approval Required)
  - **configSpecificAppEnabled** `boolean` — Mandatory  
    Whether config-specific app elevation is enabled
  - **appGroupType** `integer` — Mandatory  
    Type of application group (3=Privilege)
  - **addedRules** `JSON array` — Mandatory  
    Rules to add
  - **removedRules** `JSON array` — Mandatory  
    Rules to remove

### Sample Request

```curl
curl --request POST \
  --url https://appdomain/dcapi/appctrl/privilegeAppGroup \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: SOME_STRING_VALUE' \
  --data '{"removedRules":[{"appRuleType":1,"appRuleIDs":[610]}],"appGroupType":3,"configSpecificAppEnabled":true,"jitRequestMode":"2","addedRules":[{"appRuleType":2,"verifiedAppRepoIDs":[700]}]}'
```

### Sample Request Body

Update privilege group — add product rules and remove existing vendor rules

```json
{
  "removedRules": [
    {
      "appRuleType": 1,
      "appRuleIDs": [
        610
      ]
    }
  ],
  "appGroupType": 3,
  "configSpecificAppEnabled": true,
  "jitRequestMode": "2",
  "addedRules": [
    {
      "appRuleType": 2,
      "verifiedAppRepoIDs": [
        700
      ]
    }
  ]
}
```

## Response Parameters

### HTTP Code 200

Response Body — `application/json`

- `JSON object`
  - **status** `boolean`  
    Whether the operation completed successfully (true=success, false=failure)

### HTTP Code 401

Response Body — `application/json`

- `JSON object`
  - **errorCode** `long`  
    Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)
  - **errorMsg** `string`  
    Authentication failure reason

### HTTP Code 500

Response Body — `application/json`

- `JSON object`
  - **errorCode** `string`  
    Internal error code: INTERNAL_ERROR when exception occurs updating privilege app group
  - **errorMessage** `string`  
    Detailed message: Error Occurred while add or update privilege app group

### Possible Response Codes

- **200** — HTTP code
- **401** — HTTP code
- **500** — HTTP code

### Sample Response: HTTP 200

Privilege application group updated successfully

```json
{
  "status": true
}
```

### Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

### Sample Response: HTTP 500

Internal error while updating privilege app group

```json
{
  "errorMessage": "Error Occurred while add or update privilege app group",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.