# Modify the configuration of a VPN payload item within a profile

To modify Mac Vpn policy payload item

## Endpoint

`PUT /api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy/payloaditems/{payload_id}`

## Request

### Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy/payloaditems/{payload_id}`

### Scope

`MDMDeviceMgmt.UPDATE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

| Parameter | Type | Required | Value |
|---|---|---|---|
| Content-Type | string | Mandatory | application/json |
| Accept | string | Mandatory | application/json |

#### Path Parameters

| Parameter | Type | Required | Description |
|---|---|---|---|
| profile_id | string | Mandatory | Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response |
| payload_id | string | Mandatory | Unique identifier of the payload item. Obtain from the [Get Payload Item IDs](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mac-get-vpn-payload-mac.html) response |

#### Request Body

`application/json`

| Parameter | Type | Required | Description |
|---|---|---|---|
| sub_config | string | Optional | VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP |
| connection_name | string | Mandatory | Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration |
| connection_type | integer | Mandatory | VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile |
| send_all_nw_traffic | boolean | Optional | Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false |
| certificate_uuid | string | Optional | UUID of the identity certificate payload used for VPN authentication. Obtain from the [Upload Certificate API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-upload-certificate.html) |
| enable_vpn_on_demand | boolean | Optional | Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false |
| disconnect_on_idle_timeout | integer | Optional | Disconnect on idle timeout in seconds. 0 means disabled. Default: 0 |
| l2tp | JSON Object | Optional | L2Tp |
| pptp | JSON Object | Optional | Pptp |
| ipsec | JSON Object | Optional | Ipsec |
| cisco | JSON Object | Optional | Cisco |
| juniperssl | JSON Object | Optional | Juniperssl |
| pulsesecure | JSON Object | Optional | Pulsesecure |
| f5ssl | JSON Object | Optional | F5Ssl |
| customssl | JSON Object | Optional | Customssl |
| ikev2 | JSON Object | Optional | Ikev2 |
| ciscoanyconnect | JSON Object | Optional | Ciscoanyconnect |
| sonicwall | JSON Object | Optional | Sonicwall |
| arubavia | JSON Object | Optional | Arubavia |
| checkpoint | JSON Object | Optional | Checkpoint |
| proxy_type | integer | Optional | Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL) |
| proxy_server | string | Optional | Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual) |
| proxy_server_port | integer | Optional | Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0 |
| proxy_user_name | string | Optional | Username for proxy server authentication |
| proxy_password | string | Optional | Password for proxy server authentication (sensitive - write-only, not returned in responses) |
| proxy_password_id | long | Optional | Internal identifier for the stored proxy password credential |
| proxy_pac_url | string | Optional | URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic) |
| ondemand_user_override_disabled | boolean | Optional | Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false |
| ondemandrules | JSON Array | Optional | List of VPN On Demand rules controlling when the VPN connects/disconnects |
| vpn_type | integer | Mandatory | VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN |
| provider_type | integer | Optional | VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy |
| vpnuuid | string | Optional | Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments |
| ondemand_match_app_enabled | boolean | Optional | Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true |
| custom_data | JSON Array | Optional | List of custom key-value pairs for vendor-specific VPN configuration |

### Sample Request

```bash
curl --request PUT \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macvpnpolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"connection_name":"VPN Configuration","send_all_nw_traffic":false,"l2tp":{},"connection_type":0,"sub_config":"L2TP","ipsec":{},"pptp":{},"enable_vpn_on_demand":false,"certificate_uuid":"value","disconnect_on_idle_timeout":0,"vpn_type":1}'
```

### Sample Request Body

Modify VPN payload item

```json
{
  "connection_name": "VPN Configuration",
  "send_all_nw_traffic": false,
  "l2tp": {},
  "connection_type": 0,
  "sub_config": "L2TP",
  "ipsec": {},
  "pptp": {},
  "enable_vpn_on_demand": false,
  "certificate_uuid": "value",
  "disconnect_on_idle_timeout": 0,
  "vpn_type": 1
}
```

## Response

### HTTP Code 200

#### Response Body

`application/json`

| Parameter | Type | Description |
|---|---|---|
| payload_id | long | Unique identifier of the payload item |
| sub_config | string | VPN sub-configuration type indicating the active VPN protocol. Corresponds to the connection_type value (e.g., L2TP, PPTP, IPSEC, IKEV2, CUSTOMSSL). Default: L2TP |
| connection_name | string | Display name for the VPN connection shown to the user in System Preferences. Default: VPN Configuration |
| connection_type | string | VPN connection type. Allowed values: 0=L2TP, 1=PPTP, 2=IPSec, 3=Cisco Legacy AnyConnect, 4=Juniper SSL, 5=F5 SSL, 6=Custom SSL, 7=Pulse Secure, 8=IKEv2, 9=Cisco AnyConnect, 10=SonicWall, 11=Aruba VIA, 12=CheckPoint Mobile |
| send_all_nw_traffic | boolean | Whether all network traffic is routed through the VPN tunnel (full tunnel mode). When false, split tunneling is used. Default: false |
| certificate_uuid | string | UUID of the identity certificate payload used for VPN authentication. Obtain from the [Upload Certificate API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-upload-certificate.html) |
| enable_vpn_on_demand | boolean | Whether VPN On Demand is enabled, allowing the system to automatically establish the VPN connection based on configured rules. Default: false |
| disconnect_on_idle_timeout | string | Disconnect on idle timeout in seconds. 0 means disabled. Default: 0 |
| l2tp | JSON Object | L2Tp |
| pptp | JSON Object | Pptp |
| ipsec | JSON Object | Ipsec |
| cisco | JSON Object | Cisco |
| juniperssl | JSON Object | Juniperssl |
| pulsesecure | JSON Object | Pulsesecure |
| f5ssl | JSON Object | F5Ssl |
| customssl | JSON Object | Customssl |
| ikev2 | JSON Object | Ikev2 |
| ciscoanyconnect | JSON Object | Ciscoanyconnect |
| sonicwall | JSON Object | Sonicwall |
| arubavia | JSON Object | Arubavia |
| checkpoint | JSON Object | Checkpoint |
| proxy_type | string | Proxy configuration type. Allowed values: 0=None, 1=Manual, 2=Automatic (PAC URL) |
| proxy_server | string | Hostname or IP address of the HTTP proxy server. Required when proxy_type is 1 (Manual) |
| proxy_server_port | string | Port number of the HTTP proxy server. Valid range: 0-65535. Default: 0 |
| proxy_user_name | string | Username for proxy server authentication |
| proxy_password | string | Password for proxy server authentication (sensitive - write-only, not returned in responses) |
| proxy_password_id | long | Internal identifier for the stored proxy password credential |
| proxy_pac_url | string | URL of the Proxy Auto-Configuration (PAC) file. Required when proxy_type is 2 (Automatic) |
| ondemand_user_override_disabled | boolean | Whether the user is prevented from overriding VPN On Demand settings. When true, the user cannot manually disconnect an on-demand VPN. Default: false |
| ondemandrules | JSON Array | List of VPN On Demand rules controlling when the VPN connects/disconnects |
| vpn_type | string | VPN scope type. Allowed values: 1=Device-level VPN, 2=Per-App VPN |
| provider_type | string | VPN provider type. Allowed values: 0=Packet Tunnel (default), 1=App Proxy |
| vpnuuid | string | Unique identifier (UUID) for this VPN configuration, used to reference this VPN from Per-App VPN app assignments |
| ondemand_match_app_enabled | boolean | Whether Per-App VPN automatically connects when associated apps launch. When enabled, the VPN triggers on app launch matching. Default: true |
| custom_data | JSON Array | List of custom key-value pairs for vendor-specific VPN configuration |

### Possible Response Codes

| Code | Type |
|---|---|
| 200 | HTTP code |

### Sample Response: HTTP 200

VPN payload item successfully modified

```json
{
  "connection_name": "VPN Configuration",
  "send_all_nw_traffic": false,
  "payload_id": 9007199254741000,
  "l2tp": {},
  "connection_type": 0,
  "sub_config": "L2TP",
  "ipsec": {},
  "pptp": {},
  "enable_vpn_on_demand": false,
  "certificate_uuid": "value",
  "disconnect_on_idle_timeout": 0,
  "vpn_type": 1
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.