# Create a new JRM profile

Creates a new Java Rules Manager profile.

## Endpoint

**POST** `/bsp/api/v1/bmp/jrm`

## Request URL

```text
https://{server-hostname}:8383/bsp/api/v1/bmp/jrm
```

## Scope

```text
BrowserManager.CREATE
```

## Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

## Request Parameters

### Request Headers

- **Content-Type** (`string`, Mandatory): `application/json`
- **Accept** (`string`, Mandatory): `application/json`

### Request Body

Send profile metadata in the request body. All four fields are required when creating: `profile_name`, `profile_description`, `profile_type` (must be `64012`), and `platform_type` (`'1'` = Windows, `'2'` = Mac, `'-1'` = All).

`application/json`

**JSON Object**

Fields for creating or updating a JRM profile.

- **profile_name** (`string`, Optional): Required. A descriptive name for the profile (e.g., `'Corporate Java Rules'`)
- **profile_type** (`string`, Optional): Required when creating. Must always be `64012` (Java Rules Manager type). Not needed when modifying.
- **profile_description** (`string`, Optional): Required. A brief description of the profile's purpose. Send an empty string to clear, but cannot be `null`.
- **platform_type** (`string`, Optional): Required when creating. Target platform: `'1'` = Windows only, `'2'` = Mac only, `'-1'` = All platforms. Not needed when modifying.

## Sample Request

### Curl

```curl
curl --request POST \
  --url https://appdomain/bsp/api/v1/bmp/jrm \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"profile_name":"Corporate Java Rules","profile_type":64012,"platform_type":"1","profile_description":"Java applet rules for corporate sites"}'
```

### Sample Request Body

Create a new JRM profile for Windows.

```json
{
  "profile_name": "Corporate Java Rules",
  "profile_type": 64012,
  "platform_type": "1",
  "profile_description": "Java applet rules for corporate sites"
}
```

## Response Parameters

### HTTP Code 200

Response Body: `application/json`

**JSON Object**

- **collection_id** (`string`): Internal collection ID used by the system to group profile versions.
- **jrm_profile_name** (`string`): The name you gave the profile.
- **jrm_profile_description** (`string`): The description you provided for this profile.
- **profile_type** (`string`): Always `'64012'` identifies this as a Java Rules Manager profile.
- **platform_type** (`string`): Target platform: `'1'` = Windows only, `'2'` = Mac only, `'-1'` = All platforms.
- **latest_version** (`string`): Current version number of the profile (starts at `'1'`).
- **is_moved_to_trash** (`boolean`): Whether this profile has been moved to trash (`false` for new profiles).
- **scope** (`string`): Profile scope `'0'` means default scope.
- **latest_published_version** (`string`): Version number that is currently published, or `'--'` if the profile has never been published.
- **jrm_profile_id** (`string`): Unique ID of this profile; use this as `{jrm_profile_id}` in all other JRM APIs.
- **jrm_payloads** (`JSON Array`): List of payload rules attached to this profile (empty for newly created profiles).

### HTTP Code 400

Response Body: `application/json`

**JSON Object**

- **errorcode** (`string`): Error identifier (e.g., `'IAM0006'` for an invalid field value).
- **errormsg** (`string`): Describes which field or value is invalid.

### HTTP Code 401

Response Body: `application/json`

**JSON Object**

- **errorCode** (`long`): Unauthorized error code returned when authentication credentials are missing, expired, or invalid (`authentication=required`).
- **errorMsg** (`string`): Authentication failure reason.

### HTTP Code 403

Response Body: `application/json`

**JSON Object**

- **errorCode** (`long`): Forbidden error code returned when the authenticated user does not have the required uem-roles (e.g., `DataEncryption_Admin` or `DataEncryptionRecoveryKey_Admin`).
- **errorMsg** (`string`): Message indicating insufficient privileges to access this resource.

### HTTP Code 429

Response Body: `application/json`

**JSON Object**

- **errorCode** (`long`): Rate limit error code returned when the API call threshold (configured via threshold/duration in security XML) is exceeded; the client is locked out for lock-period minutes.
- **errorMsg** (`string`): Rate limit exceeded message with retry guidance.

### HTTP Code 500

Response Body: `application/json`

**JSON Object**

- **errormsg** (`string`): Description of the server-side error.

## Possible Response Codes

- **200** — HTTP code
- **400** — HTTP code
- **401** — HTTP code
- **403** — HTTP code
- **429** — HTTP code
- **500** — HTTP code

## Sample Responses

### HTTP 200

Created profile.

```json
{
  "collection_id": "222",
  "jrm_profile_name": "Corporate Java Rules",
  "jrm_profile_description": "Java applet rules for corporate sites",
  "profile_type": "64012",
  "platform_type": "1",
  "latest_version": "1",
  "is_moved_to_trash": false,
  "scope": "0",
  "latest_published_version": "--",
  "jrm_profile_id": "333",
  "jrm_payloads": []
}
```

### HTTP 400

Bad request.

```json
{
  "errorcode": "IAM0006",
  "errormsg": "Field value of {0} is invalid."
}
```

### HTTP 401

Unauthorized.

```json
{
  "errorCode": "IAM0001",
  "errorMsg": "Authentication key is invalid. Please regenerate the key and try again."
}
```

### HTTP 403

Forbidden.

```json
{
  "errorCode": "FORBIDDEN",
  "errorMsg": "You do not have permission to access this resource"
}
```

### HTTP 429

Rate limit exceeded.

```json
{
  "errorCode": "RATE_LIMIT_EXCEEDED",
  "errorMsg": "You have exceeded the maximum number of API calls. Please try again later."
}
```

### HTTP 500

Server error.

```json
{
  "errormsg": "Internal Server error, Please try again in a moment."
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration — Time window for the threshold.  
Threshold — Number of API calls allowed within the specified duration.  
Lock Period — Wait time before consecutive API requests.