# Retrieve the full configuration details of a Per-App VPN payload item

To get Mac Per App Vpn Policy payload item

## Endpoint

**GET** `/api/v1/mdm/profiles/{profile_id}/payloads/macperappvpn/payloaditems/{payload_id}`

## Request

### Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macperappvpn/payloaditems/{payload_id}`

### Scope

`MDMDeviceMgmt.READ`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Accept** `string` — **Mandatory**
  - `application/json`

#### Path Parameters

- **profile_id** `string` — **Mandatory`
  - Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response.

- **payload_id** `string` — **Mandatory**
  - Unique identifier of the payload item. Obtain from the [Get Payload Item IDs](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mac-get-per-app-vpn-payload-mac.html) response.

#### Query Parameters

- **include** `string` — Optional
  - Comma-separated list of related fields to include in the response (e.g., assigned_to, payload_details). When omitted, only top-level fields are returned.

### Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macperappvpn/payloaditems/{payload_id}?include=payloaditems' \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52'
```

## Response

### Response Parameters

#### HTTP Code 200

Response Body — `application/json`

- `JSON Object`
  - **payload_id** `long`
    - Unique identifier of the payload item
  - **sub_config** `string`
    - VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP
  - **connection_name** `string`
    - Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration
  - **connection_type** `string`
    - VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
  - **send_all_nw_traffic** `boolean`
    - Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false
  - **certificate_uuid** `string`
    - UUID of the identity certificate payload used for VPN authentication. Obtain from the [Upload Certificate API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-upload-certificate.html)
  - **enable_vpn_on_demand** `boolean`
    - Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false
  - **disconnect_on_idle_timeout** `string`
    - Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
  - **f5ssl** `JSON Object`
    - F5Ssl
  - **customssl** `JSON Object`
    - Customssl
  - **sonicwall** `JSON Object`
    - Sonicwall
  - **proxy_type** `string`
    - Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
  - **proxy_server** `string`
    - Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)
  - **proxy_server_port** `string`
    - Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0
  - **proxy_user_name** `string`
    - Username for proxy server authentication
  - **proxy_password** `string`
    - Password for proxy server authentication (sensitive - write-only, not returned in responses)
  - **proxy_password_id** `long`
    - Internal identifier for the stored proxy password credential
  - **proxy_pac_url** `string`
    - URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)
  - **ondemand_user_override_disabled** `boolean`
    - Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false
  - **ondemandrules** `JSON Array`
    - List of VPN On Demand rules controlling when the VPN connects/disconnects
  - **safari_domains** `array`
    - List of domain strings that trigger the Per-App VPN when accessed in Safari (e.g., internal.zylker.com, *.corp.zylker.com)
  - **excluded_domains** `array`
    - List of domain strings whose traffic bypasses the Per-App VPN tunnel even when the VPN is active
  - **vpn_type** `string`
    - VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
  - **provider_type** `string`
    - VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
  - **vpnuuid** `string`
    - Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments
  - **allowed_apps** `JSON Array`
    - List of apps allowed to use this Per-App VPN. Each app is identified by app_group_id from the [Apps API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/app-management-get-an-app.html)
  - **autonomous_kiosk_apps** `JSON Array`
    - List of autonomous single app mode apps
  - **ondemand_match_app_enabled** `boolean`
    - Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true
  - **custom_data** `JSON Array`
    - List of custom key-value pairs for vendor-specific VPN configuration
  - **ikev2** `JSON Object`
    - Ikev2

### Possible Response Codes

- **200** `HTTP code`

### Sample Response: HTTP 200

Full configuration details of Per-App VPN payload item

```json
{
  "connection_name": "VPN Configuration",
  "send_all_nw_traffic": false,
  "payload_id": 9007199254741000,
  "sonicwall": {},
  "connection_type": 0,
  "customssl": {},
  "sub_config": "L2TP",
  "enable_vpn_on_demand": false,
  "f5ssl": {},
  "certificate_uuid": "value",
  "disconnect_on_idle_timeout": 0,
  "vpn_type": 1
}
```

## Rate Limit

![Help icon](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 120 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.