To modify Mac Vpn policy payload item
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy/payloaditems/{payload_id}
MDMDeviceMgmt.UPDATECopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Unique identifier of the payload item. Obtain from the Get Payload Item IDs response
VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP
Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false
UUID of the identity certificate payload used for VPN authentication. Obtain from the Upload Certificate API
Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)
Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0
Username for proxy server authentication
Password for proxy server authentication (sensitive - write-only, not returned in responses)
Internal identifier for the stored proxy password credential
URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)
Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments
Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
curl --request PUT \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy/payloaditems/{payload_id} \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"connection_name":"VPN Configuration","send_all_nw_traffic":false,"l2tp":{},"connection_type":0,"sub_config":"L2TP","ipsec":{},"pptp":{},"enable_vpn_on_demand":false,"certificate_uuid":"value","disconnect_on_idle_timeout":0,"vpn_type":1}'Modify VPN payload item
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"l2tp": {},
"connection_type": 0,
"sub_config": "L2TP",
"ipsec": {},
"pptp": {},
"enable_vpn_on_demand": false,
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"vpn_type": 1
}
Unique identifier of the payload item
VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP
Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration
VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile
Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false
UUID of the identity certificate payload used for VPN authentication. Obtain from the Upload Certificate API
Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false
Disconnect on idle timeout in seconds. 0 means disabled. Default: 0
Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL)
Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual)
Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0
Username for proxy server authentication
Password for proxy server authentication (sensitive - write-only, not returned in responses)
Internal identifier for the stored proxy password credential
URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic)
Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false
List of VPN On Demand rules controlling when the VPN connects/disconnects
Order in which the rule is evaluated
Action to take. Allowed values: 0=Disconnect, 1=Connect, 2=Ignore, 3=Evaluate Connection
Match type. Allowed values: 0=Always, 1=DNS Domain Match, 2=DNS Server Address Match, 3=Interface Type Match, 4=SSID Match, 5=URL String Probe
List of match values (domains, addresses, SSIDs, etc.) based on the match type
VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN
VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy
Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments
Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true
List of custom key-value pairs for vendor-specific VPN configuration
Custom configuration key name
Custom configuration key value
VPN payload item successfully modified
{
"connection_name": "VPN Configuration",
"send_all_nw_traffic": false,
"payload_id": 9007199254741000,
"l2tp": {},
"connection_type": 0,
"sub_config": "L2TP",
"ipsec": {},
"pptp": {},
"enable_vpn_on_demand": false,
"certificate_uuid": "value",
"disconnect_on_idle_timeout": 0,
"vpn_type": 1
}
![]()
Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.