# Create a new SCEP template under a SCEP server. Returns a scep_config_id for use in SCEP profile payloads

Save the SCEP Server template details

## Endpoint

**POST** `/api/v1/mdm/scep/servers/{server_id}/templates`

## Request

### Request URL

```text
https://{server-hostname}:8383/api/v1/mdm/scep/servers/{server_id}/templates
```

### Scope

```text
MDMDeviceMgmt.CREATE
```

### Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

### Request Parameters

#### Request Headers

- **Content-Type** `string` **Mandatory**: `application/json`
- **Accept** `string` **Mandatory**: `application/json`

#### Path Parameters

- **server_id** `string` **Mandatory**: Unique identifier of the SCEP server. Obtain from [Add SCEP Server](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-add-scep-server.html) response.

#### Request Body

`application/json`

- `JSON Object`
  - **scep_configuration_name** `string` **Mandatory**: Display name for the SCEP template configuration (required)
  - **challenge_type** `integer` **Mandatory**: Challenge type for SCEP enrollment. 0=None, 1=Static, 2=Dynamic (required)
  - **key_usage** `integer` **Mandatory**: Key usage for the certificate. 0=None, 1=Signing, 2=Encryption, 3=Both, 4=Digital Signature, 5=Key Encipherment (required)
  - **subject_altname_type** `integer` **Mandatory**: Subject Alternative Name type. 0=None, 1=RFC 822 Name, 2=DNS Name, 3=URI, 4=NT Principal Name, 5=Uniform Resource Identifier (required)
  - **key_size** `integer` **Mandatory**: Key size for the certificate in bits (required). Common values: 1=1024, 2=2048, 4=4096
  - **subject** `string` Optional: Certificate subject DN. Supports variables like %serialnumber%, %email%, %udid%
  - **name** `string` Optional: Friendly name for the SCEP template
  - **nt_principal** `string` Optional: NT Principal name for the certificate
  - **challenge** `string` Optional: Static challenge password (required when challenge_type=1)
  - **subject_altname_value** `string` Optional: Subject Alternative Name value. Supports variables like %email%, %serialnumber%
  - **retries** `integer` Optional: Number of retries for SCEP enrollment. Default: 0
  - **retry_delay** `string` Optional: Delay between retries in seconds. Default: 0
  - **seat_id** `string` Optional: Seat ID variable for the certificate. Supports variables like %email%
  - **domain** `string` Optional: Domain name for the SCEP server authentication
  - **scep_admin_challenge_endpoint_url** `string` Optional: URL for the dynamic challenge endpoint (required when challenge_type=2)
  - **scep_admin_challenge_username** `string` Optional: Username for the dynamic challenge endpoint
  - **scep_admin_challenge_password** `string` Optional: Password for the dynamic challenge endpoint
  - **redistribute_profiles** `boolean` Optional: Whether to redistribute profiles when this template is updated. Default: false
  - **renewal_settings** `JSON Object` Optional: Auto-renewal configuration for certificates issued by this template

### Sample Request

```curl
curl --request POST \
  --url https://appdomain/api/v1/mdm/scep/servers/%7Bserver_id%7D/templates \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"retries":0,"challenge_type":0,"scep_configuration_name":"Sample","key_usage":0,"retry_delay":"0","subject":"CN=%serialnumber%","seat_id":"%email%","name":"Sample","subject_altname_type":0,"subject_altname_value":"","key_size":1}'
```

### Sample Request Body

Add a new SCEP template with basic configuration

```json
{
  "retries": 0,
  "challenge_type": 0,
  "scep_configuration_name": "Sample",
  "key_usage": 0,
  "retry_delay": "0",
  "subject": "CN=%serialnumber%",
  "seat_id": "%email%",
  "name": "Sample",
  "subject_altname_type": 0,
  "subject_altname_value": "",
  "key_size": 1
}
```

## Response

### Response Parameters

#### HTTP Code 200

Response Body - `application/json`

- `JSON Object`
  - **scep_config_id** `string`: Unique identifier of the created SCEP template. Use this ID in SCEP payload requests (scep_config_id field)
  - **scep_configuration_name** `string`: Display name of the SCEP template configuration
  - **name** `string`: Friendly name of the SCEP template
  - **challenge_type** `string`: Challenge type. 0=None, 1=Static, 2=Dynamic
  - **is_challenge_pwd_configured** `boolean`: Whether a challenge password is configured for this template
  - **key_usage** `string`: Key usage value
  - **subject** `string`: Certificate subject DN
  - **subject_altname_type** `string`: Subject Alternative Name type
  - **subject_altname_value** `string`: Subject Alternative Name value
  - **key_size** `string`: Key size for the certificate
  - **retries** `string`: Number of retries for SCEP enrollment
  - **retry_delay** `string`: Delay between retries in seconds
  - **nt_principal** `string`: NT Principal name
  - **seat_id** `string`: Seat ID variable
  - **url** `string`: SCEP server URL (inherited from the parent SCEP server)
  - **ca_finger_print** `string`: CA certificate fingerprint (inherited from the parent SCEP server)
  - **renewal_settings** `JSON Object`: Auto-renewal configuration

### Possible Response Codes

- **200** HTTP code

### Sample Response: HTTP 200

SCEP template successfully created

```json
{
  "nt_principal": "",
  "challenge_type": "0",
  "is_challenge_pwd_configured": false,
  "key_usage": "0",
  "subject": "CN=%serialnumber%",
  "seat_id": "%email%",
  "renewal_settings": {
    "auto_renew_enabled": false,
    "num_days": "-1"
  },
  "scep_config_id": "6967000000599729",
  "url": "http://10.51.79.112/certSrv/mscep/mscep.dll",
  "ca_finger_print": "bf54330f3132d590d3d7c3e86ebc8563b5ea976e",
  "retries": "0",
  "scep_configuration_name": "Sample",
  "retry_delay": "0",
  "name": "Sample",
  "subject_altname_type": "0",
  "subject_altname_value": "",
  "key_size": "1"
}
```

## Rate Limit

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.