# Modify the configuration of a Extensible SSO payload item within a profile

To modify Mac Extensible SSO policy payload item

## Endpoints

**PUT** `/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}`

## Request

### Request URL

```text
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}
```

### Scope

```text
MDMDeviceMgmt.UPDATE
```

### Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

### Request Parameters

#### Request Headers

- **Content-Type** (string, Mandatory): `application/json`
- **Accept** (string, Mandatory): `application/json`

#### Path Parameters

- **profile_id** (string, Mandatory): Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response.
- **payload_id** (string, Mandatory): Unique identifier of the payload item. Obtain from the [Get Payload Item IDs](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mac-get-extensible-sso-payload-mac.html) response.

#### Request Body

`application/json`

- **extension_identifier** (string, Mandatory): Bundle identifier of the app extension that provides Single Sign-On (e.g., com.apple.AppSSOKerberos.KerberosExtension)
- **team_identifier** (string, Mandatory): Apple Developer Team identifier of the app extension
- **type** (integer, Mandatory): SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect
- **realm** (string, Mandatory): Kerberos realm name (e.g., ZYLKER.COM). Required when type is 0 (Credential), must be empty when type is 1 (Redirect)
- **authentication_method** (integer, Mandatory): Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key
- **screen_locked_behavior** (integer, Mandatory): Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle
- **extension_data** (string, Mandatory): Custom configuration data for the SSO extension in Apple property list XML format
- **registration_token** (string, Mandatory): Token used for Platform SSO registration. When provided, authentication_method must also be configured
- **hosts_and_urls** (array, Mandatory): List of identity provider URL prefixes that the SSO extension handles (at least one required)
- **denied_apps_details** (JSON Array, Mandatory): List of apps excluded from using this SSO extension. Each item requires an app_group_id

### Sample Request

```curl
curl --request PUT \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"authentication_method":-1,"hosts_and_urls":["https://login.zylker.com"],"extension_identifier":"com.apple.AppSSOKerberos.KerberosExtension","screen_locked_behavior":-1,"extension_data":"<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>","team_identifier":"apple","realm":"ZYLKER.COM","registration_token":"","type":0,"denied_apps_details":[{"app_group_id":9007199254741072}]}'
```

### Sample Request Body

Modify Extensible SSO payload item

```json
{
  "authentication_method": -1,
  "hosts_and_urls": [
    "https://login.zylker.com"
  ],
  "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
  "screen_locked_behavior": -1,
  "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
  "team_identifier": "apple",
  "realm": "ZYLKER.COM",
  "registration_token": "",
  "type": 0,
  "denied_apps_details": [
    {
      "app_group_id": 9007199254741072
    }
  ]
}
```

## Response Parameters

### HTTP Code 200

#### Response Body

`application/json`

- **payload_id** (long): Unique identifier of the payload item
- **extension_identifier** (string): Bundle identifier of the app extension that provides Single Sign-On
- **team_identifier** (string): Apple Developer Team identifier of the app extension
- **type** (integer): SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect
- **realm** (string): Kerberos realm name. Empty when type is 1 (Redirect)
- **authentication_method** (integer): Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key
- **screen_locked_behavior** (integer): Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle
- **extension_data** (string): Custom configuration data for the SSO extension in Apple property list XML format
- **registration_token** (string): Token used for Platform SSO registration
- **hosts_and_urls** (array): List of identity provider URL prefixes that the SSO extension handles
- **denied_apps_details** (JSON Array): List of apps excluded from using this SSO extension, with resolved app details

### Possible Response Codes

- **200** (HTTP code)

### Sample Response: HTTP 200

Extensible SSO payload item successfully modified

```json
{
  "authentication_method": -1,
  "hosts_and_urls": [
    "https://login.zylker.com"
  ],
  "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
  "payload_id": 9007199254741000,
  "screen_locked_behavior": -1,
  "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
  "team_identifier": "apple",
  "realm": "ZYLKER.COM",
  "registration_token": "",
  "type": 0,
  "denied_apps_details": [
    {
      "identifier": "com.zylker.deniedapp",
      "group_display_name": "Denied App",
      "app_group_id": 9007199254741072
    }
  ]
}
```

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.