To create Mac per app Vpn policy
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macperappvpn
MDMDeviceMgmt.CREATECopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP
Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false
UUID of the identity certificate payload used for VPN authentication. Obtain from the Upload Certificate API
Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)
Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0
Username for proxy server authentication
Password for proxy server authentication (sensitive - write-only, not returned in responses)
Internal identifier for the stored proxy password credential
URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)
Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
List of domain strings that trigger the Per-App VPN when accessed in Safari (e.g., internal.zylker.com, *.corp.zylker.com)
List of domain strings whose traffic bypasses the Per-App VPN tunnel even when the VPN is active
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments
List of apps allowed to use this Per-App VPN. Each app is identified by app_group_id from the Apps API
App ID of the VPN app. Use the app_group_id from the Apps API response
Whether this is a system app. Default: false
Display name of the app group
List of autonomous single app mode apps
App ID of the kiosk app. Use the app_group_id from the Apps API response
Display name of the app group
Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
curl --request POST \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macperappvpn \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"connection_name":"VPN Configuration","send_all_nw_traffic":false,"sonicwall":{},"connection_type":0,"customssl":{},"sub_config":"L2TP","enable_vpn_on_demand":false,"f5ssl":{},"certificate_uuid":"value","disconnect_on_idle_timeout":0,"vpn_type":1}'Add Per-App VPN payload to the profile
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"sonicwall": {},
"connection_type": 0,
"customssl": {},
"sub_config": "L2TP",
"enable_vpn_on_demand": false,
"f5ssl": {},
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"vpn_type": 1
}
Unique identifier for the created payload item
VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP
Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false
UUID of the identity certificate payload used for VPN authentication. Obtain from the Upload Certificate API
Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)
Proxy server port number. Valid range: 0-65535. Default: 0
Username for proxy server authentication
Password for proxy server authentication (sensitive - write-only, not returned in responses)
Internal identifier for the stored proxy password credential
URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)
Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
List of domain strings that trigger the Per-App VPN when accessed in Safari (e.g., internal.zylker.com, *.corp.zylker.com)
List of domain strings whose traffic bypasses the Per-App VPN tunnel even when the VPN is active
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments
List of apps allowed to use this Per-App VPN. Each app is identified by app_group_id from the Apps API
App ID of the VPN app. Use the app_group_id from the Apps API response
Whether this is a system app. Default: false
Display name of the app group
List of autonomous single app mode apps
App ID of the kiosk app. Use the app_group_id from the Apps API response
Display name of the app group
Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
Per-App VPN payload successfully added
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"payload_id": 9007199254741000,
"sonicwall": {},
"connection_type": 0,
"customssl": {},
"sub_config": "L2TP",
"enable_vpn_on_demand": false,
"f5ssl": {},
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"vpn_type": 1
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.