# Create FileVault encryption settings with recovery key configuration. Returns an encryption_settings_id for use in FileVault profile payloads

Save the Filevault Server settings

## Endpoints

**POST** `/api/v1/mdm/profiles/filevaults`

## Request

### Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/filevaults`

### Scope

`MDMDeviceMgmt.CREATE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

| Name | Type | Required | Value |
|---|---|---|---|
| Content-Type | string | Mandatory | application/json |
| Accept | string | Mandatory | application/json |

#### Request Body

`application/json`

| Name | Type | Required | Description |
|---|---|---|---|
| mdmencryptionsettings | JSON Object | Mandatory | Core encryption settings including name and type |
| mdmfilevaultsettings | JSON Object | Optional | FileVault-specific settings including recovery key options and user messages |
| mdmfilevaultpersonalkeyconfiguration | JSON Object | Optional | Personal recovery key configuration (used when encryption_settings_type is 1 or 3) |
| mdmfilevaultinstitutionconfiguration | JSON Object | Optional | Institutional recovery key configuration (used when encryption_settings_type is 2 or 3) |

### Sample Request

```curl
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/filevaults \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"mdmfilevaultsettings":{"copy_recovery_key_to_mdm":true,"dont_allow_filevault_disable":false,"recovery_key_type":1,"maximum_attempts_to_force":-1,"force_encryption_until_logout":false,"ask_enable_during_logout":false,"message_to_user":"The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."},"mdmfilevaultpersonalkeyconfiguration":{"show_recovery_key":false,"enable_ec_agent_prk_rotation":false},"mdmencryptionsettings":{"encryption_settings_type":1,"settings_name":"Corporate FileVault Settings"}}'
```

### Sample Request Body

#### Create FileVault encryption settings with Personal Recovery Key

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 1,
    "maximum_attempts_to_force": -1,
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "enable_ec_agent_prk_rotation": false
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 1,
    "settings_name": "Corporate FileVault Settings"
  }
}
```

#### Create FileVault encryption settings with Institutional Recovery Key

```json
{
  "mdmfilevaultsettings": {
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 2
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": 6967000001030029
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 2,
    "settings_name": "Institutional FileVault Settings"
  }
}
```

#### Create FileVault encryption settings with both Personal and Institutional Recovery Keys

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": 3,
    "maximum_attempts_to_force": -1,
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": 6967000001030029
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "enable_ec_agent_prk_rotation": false
  },
  "mdmencryptionsettings": {
    "encryption_settings_type": 3,
    "settings_name": "Combined FileVault Settings"
  }
}
```

## Response

### Response Parameters

#### HTTP Code 200

Response Body — `application/json`

| Name | Type | Description |
|---|---|---|
| mdmencryptionsettings | JSON Object | Core encryption settings with assigned encryption_settings_id |
| mdmfilevaultsettings | JSON Object | FileVault-specific settings |
| mdmfilevaultpersonalkeyconfiguration | JSON Object | Personal recovery key configuration with assigned certificate IDs (present when encryption_settings_type is 1 or 3) |
| mdmfilevaultinstitutionconfiguration | JSON Object | Institutional recovery key configuration (present when encryption_settings_type is 2 or 3) |

### Possible Response Codes

| Code | Type |
|---|---|
| 200 | HTTP code |

### Sample Response: HTTP 200

#### FileVault encryption settings successfully created (Personal and Institutional)

```json
{
  "mdmfilevaultsettings": {
    "copy_recovery_key_to_mdm": true,
    "dont_allow_filevault_disable": false,
    "recovery_key_type": "3",
    "maximum_attempts_to_force": "-1",
    "force_encryption_until_logout": false,
    "ask_enable_during_logout": false,
    "message_to_user": "The personal recovery key is stored in the MDM server. Contact your administrator to retrieve it."
  },
  "mdmfilevaultinstitutionconfiguration": {
    "institution_encryption_cert": "6967000001030029"
  },
  "mdmfilevaultpersonalkeyconfiguration": {
    "show_recovery_key": false,
    "recovery_key_identifier": "6967000001030023",
    "enable_ec_agent_prk_rotation": false,
    "recovery_encrypt_cert_id": "6967000001030023"
  },
  "mdmencryptionsettings": {
    "modified_user": "6967000000047005",
    "added_time": "1777444564220",
    "modified_time": "1777444564220",
    "encryption_settings_type": "3",
    "added_user": "6967000000047005",
    "settings_desc": "",
    "customer_id": "6967000000047017",
    "encryption_settings_id": "6967000001030020",
    "settings_name": "Combined FileVault Settings"
  }
}
```

## API Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.