To get Mac Extensible SSO policy payload item
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}
MDMDeviceMgmt.READCopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Unique identifier of the payload item. Obtain from the Get Payload Item IDs response
curl --request GET \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id} \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52'Unique identifier of the payload item
Bundle identifier of the app extension that provides Single Sign-On
Apple Developer Team identifier of the app extension
SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect
Kerberos realm name. Empty when type is 1 (Redirect)
Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key
Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle
Custom configuration data for the SSO extension in Apple property list XML format
Token used for Platform SSO registration
List of identity provider URL prefixes that the SSO extension handles
List of apps excluded from using this SSO extension, with resolved app details
App group ID of the denied app
Bundle identifier of the denied app
Display name of the denied app
Full configuration details of Extensible SSO payload item
{
"authentication_method": -1,
"hosts_and_urls": [
"https://login.zylker.com"
],
"extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
"payload_id": 9007199254741000,
"screen_locked_behavior": -1,
"extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
"team_identifier": "apple",
"realm": "ZYLKER.COM",
"registration_token": "",
"type": 0,
"denied_apps_details": [
{
"identifier": "com.zylker.deniedapp",
"group_display_name": "Denied App",
"app_group_id": 9007199254741072
}
]
}
![]()
Duration: 1 minute | Threshold: 120 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.