# Add a new VPN payload configuration to an existing profile

To create Mac Vpn policy

## Endpoint

**POST** `/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy`

## Request URL

```text
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy
```

## Scope

```text
MDMDeviceMgmt.CREATE
```

## Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

## Request Parameters

### Request Headers

- **Content-Type** `string` — **Mandatory**: `application/json`
- **Accept** `string` — **Mandatory**: `application/json`

### Path Parameters

- **profile_id** `string` — **Mandatory**

  Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response.

### Request Body

`application/json`

- **sub_config** `string` — Optional

  VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP

- **connection_name** `string` — **Mandatory**

  Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration

- **connection_type** `integer` — **Mandatory**

  VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile

- **send_all_nw_traffic** `boolean` — Optional

  Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false

- **certificate_uuid** `string` — Optional

  UUID of the identity certificate payload used for VPN authentication. Obtain from the [Upload Certificate API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-upload-certificate.html)

- **enable_vpn_on_demand** `boolean` — Optional

  Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false

- **disconnect_on_idle_timeout** `integer` — Optional

  Disconnect on idle timeout in seconds. 0 means disabled. Default: 0

- **l2tp** `JSON Object` — Optional

  L2Tp

- **pptp** `JSON Object` — Optional

  Pptp

- **ipsec** `JSON Object` — Optional

  Ipsec

- **cisco** `JSON Object` — Optional

  Cisco

- **juniperssl** `JSON Object` — Optional

  Juniperssl

- **pulsesecure** `JSON Object` — Optional

  Pulsesecure

- **f5ssl** `JSON Object` — Optional

  F5Ssl

- **customssl** `JSON Object` — Optional

  Customssl

- **ikev2** `JSON Object` — Optional

  Ikev2

- **ciscoanyconnect** `JSON Object` — Optional

  Ciscoanyconnect

- **sonicwall** `JSON Object` — Optional

  Sonicwall

- **arubavia** `JSON Object` — Optional

  Arubavia

- **checkpoint** `JSON Object` — Optional

  Checkpoint

- **proxy_type** `integer` — Optional

  Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)

- **proxy_server** `string` — Optional

  Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)

- **proxy_server_port** `integer` — Optional

  Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0

- **proxy_user_name** `string` — Optional

  Username for proxy server authentication

- **proxy_password** `string` — Optional

  Password for proxy server authentication (sensitive - write-only, not returned in responses)

- **proxy_password_id** `long` — Optional

  Internal identifier for the stored proxy password credential

- **proxy_pac_url** `string` — Optional

  URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)

- **ondemand_user_override_disabled** `boolean` — Optional

  Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false

- **ondemandrules** `JSON Array` — Optional

  List of VPN On Demand rules controlling when the VPN connects/disconnects

- **vpn_type** `integer` — **Mandatory**

  VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN

- **provider_type** `integer` — Optional

  VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy

- **vpnuuid** `string` — Optional

  Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments

- **ondemand_match_app_enabled** `boolean` — Optional

  Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true

- **custom_data** `JSON Array` — Optional

  List of custom key-value pairs for vendor-specific VPN configuration

## Sample Request

### Curl

```curl
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"connection_name":"VPN Configuration","send_all_nw_traffic":false,"l2tp":{},"connection_type":0,"sub_config":"L2TP","ipsec":{},"pptp":{},"enable_vpn_on_demand":false,"certificate_uuid":"value","disconnect_on_idle_timeout":0,"vpn_type":1}'
```

### Sample Request Body

Add VPN payload to the profile

```json
{
  "connection_name": "VPN Configuration",
  "send_all_nw_traffic": false,
  "l2tp": {},
  "connection_type": 0,
  "sub_config": "L2TP",
  "ipsec": {},
  "pptp": {},
  "enable_vpn_on_demand": false,
  "certificate_uuid": "value",
  "disconnect_on_idle_timeout": 0,
  "vpn_type": 1
}
```

## Response Parameters

### HTTP Code 200

Response Body — `application/json`

- **payload_id** `long`

  Unique identifier for the created payload item

- **sub_config** `string`

  VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP

- **connection_name** `string`

  Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration

- **connection_type** `string`

  VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile

- **send_all_nw_traffic** `boolean`

  Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false

- **certificate_uuid** `string`

  UUID of the identity certificate payload used for VPN authentication. Obtain from the [Upload Certificate API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-upload-certificate.html)

- **enable_vpn_on_demand** `boolean`

  Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false

- **disconnect_on_idle_timeout** `string`

  Disconnect on idle timeout in seconds. 0 means disabled. Default: 0

- **l2tp** `JSON Object`

  L2Tp

- **pptp** `JSON Object`

  Pptp

- **ipsec** `JSON Object`

  Ipsec

- **cisco** `JSON Object`

  Cisco

- **juniperssl** `JSON Object`

  Juniperssl

- **pulsesecure** `JSON Object`

  Pulsesecure

- **f5ssl** `JSON Object`

  F5Ssl

- **customssl** `JSON Object`

  Customssl

- **ikev2** `JSON Object`

  Ikev2

- **ciscoanyconnect** `JSON Object`

  Ciscoanyconnect

- **sonicwall** `JSON Object`

  Sonicwall

- **arubavia** `JSON Object`

  Arubavia

- **checkpoint** `JSON Object`

  Checkpoint

- **proxy_type** `string`

  Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)

- **proxy_server** `string`

  Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)

- **proxy_server_port** `string`

  Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0

- **proxy_user_name** `string`

  Username for proxy server authentication

- **proxy_password** `string`

  Password for proxy server authentication (sensitive - write-only, not returned in responses)

- **proxy_password_id** `long`

  Internal identifier for the stored proxy password credential

- **proxy_pac_url** `string`

  URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)

- **ondemand_user_override_disabled** `boolean`

  Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false

- **ondemandrules** `JSON Array`

  List of VPN On Demand rules controlling when the VPN connects/disconnects

- **vpn_type** `string`

  VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN

- **provider_type** `string`

  VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy

- **vpnuuid** `string`

  Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments

- **ondemand_match_app_enabled** `boolean`

  Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true

- **custom_data** `JSON Array`

  List of custom key-value pairs for vendor-specific VPN configuration

### Sample Response: HTTP 200

VPN payload successfully added

```json
{
  "connection_name": "VPN Configuration",
  "send_all_nw_traffic": false,
  "payload_id": 9007199254741000,
  "l2tp": {},
  "connection_type": 0,
  "sub_config": "L2TP",
  "ipsec": {},
  "pptp": {},
  "enable_vpn_on_demand": false,
  "certificate_uuid": "value",
  "disconnect_on_idle_timeout": 0,
  "vpn_type": 1
}
```

## Possible Response Codes

- **200** `HTTP code`

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.