To modify Ios Per App Vpn payload item
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/iosperappvpn/payloaditems/{payload_id}
MDMDeviceMgmt.UPDATECopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Unique identifier of the payload item. Obtain from the Get Payload Item IDs response
Sub Config. Default: L2TP
Connection Name. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Send All Nw Traffic. Default: false
Certificate Uuid
Enable Vpn On Demand. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Proxy Server
Proxy Server Port. Default: 0
Proxy User Name
Proxy Password (sensitive - write-only)
Proxy Password Id
Proxy Pac Url
Ondemand User Override Disabled. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Vpnuuid
List of Safari domain strings that trigger Per-App VPN
List of domain strings excluded from Per-App VPN
List of SMB domain strings that trigger Per-App VPN
List of apps allowed to use this Per-App VPN
App ID of the VPN app. Use the app_group_id from the Apps API response
Whether this is a system app. Default: false
Display name of the app group
List of autonomous single app mode apps
App ID of the kiosk app. Use the app_group_id from the Apps API response
Display name of the app group
Ondemand Match App Enabled. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
curl --request PUT \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/iosperappvpn/payloaditems/{payload_id} \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"connection_name":"VPN Configuration","send_all_nw_traffic":false,"connection_type":0,"pulsesecure":{},"sub_config":"L2TP","juniperssl":{},"enable_vpn_on_demand":false,"certificate_uuid":"value","disconnect_on_idle_timeout":0,"cisco":{},"vpn_type":1}'Modify Per-App VPN payload item
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"connection_type": 0,
"pulsesecure": {},
"sub_config": "L2TP",
"juniperssl": {},
"enable_vpn_on_demand": false,
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"cisco": {},
"vpn_type": 1
}
Unique identifier of the payload item
Sub Config. Default: L2TP
Connection Name. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Send All Nw Traffic. Default: false
Certificate Uuid
Enable Vpn On Demand. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Proxy Server
Proxy Server Port. Default: 0
Proxy User Name
Proxy Password (sensitive - write-only)
Proxy Password Id
Proxy Pac Url
Ondemand User Override Disabled. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Vpnuuid
List of Safari domain strings that trigger Per-App VPN
List of domain strings excluded from Per-App VPN
List of SMB domain strings that trigger Per-App VPN
List of apps allowed to use this Per-App VPN
App ID of the VPN app. Use the app_group_id from the Apps API response
Whether this is a system app. Default: false
Display name of the app group
List of autonomous single app mode apps
App ID of the kiosk app. Use the app_group_id from the Apps API response
Display name of the app group
Ondemand Match App Enabled. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
Per-App VPN payload item successfully modified
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"payload_id": 9007199254741000,
"connection_type": 0,
"pulsesecure": {},
"sub_config": "L2TP",
"juniperssl": {},
"enable_vpn_on_demand": false,
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"cisco": {},
"vpn_type": 1
}
![]()
Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.