# Add a new Defender payload configuration to an existing profile

Create Windows Defender Configuration policy payload

## Endpoint

**POST** `https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy`

## Request

### Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy`

### Scope

`MDMDeviceMgmt.CREATE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** `string` — Mandatory — `application/json`
- **Accept** `string` — Mandatory — `application/json`

#### Path Parameters

- **profile_id** `string` — Mandatory

  Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response.

#### Request Body

`application/json`

JSON Object:

- **allow_archive_scanning** `boolean` — Optional

  Allow Archive Scanning. Default: true

- **allow_behavior_monitoring** `boolean` — Optional

  Allow Behavior Monitoring. Default: true

- **allow_cloud_protection** `boolean` — Optional

  Allow Cloud Protection. Default: true

- **allow_email_scanning** `boolean` — Optional

  Allow Email Scanning. Default: false

- **allow_full_scan_on_mapped_networkdrives** `boolean` — Optional

  Allow Full Scan On Mapped Networkdrives. Default: false

- **allow_full_scan_removable_drive_scanning** `boolean` — Optional

  Allow Full Scan Removable Drive Scanning. Default: true

- **allow_intrusion_prevention_system** `boolean` — Optional

  Allow Intrusion Prevention System. Default: true

- **allow_ioav_protection** `boolean` — Optional

  Allow Ioav Protection. Default: true

- **cloud_block_level** `integer` — Optional

  Cloud Block Level. Default: 0

- **allow_onaccess_protection** `boolean` — Optional

  Allow Onaccess Protection. Default: true

- **allow_realtime_monitoring** `boolean` — Optional

  Allow Realtime Monitoring. Default: true

- **allow_scanning_network_files** `boolean` — Optional

  Allow Scanning Network Files. Default: false

- **allow_script_scanning** `boolean` — Optional

  Allow Script Scanning. Default: true

- **allow_user_ui_access** `boolean` — Optional

  Allow User Ui Access. Default: true

- **check_for_signatures_before_runningscan** `boolean` — Optional

  Check For Signatures Before Runningscan. Default: false

- **pua_protection** `integer` — Optional

  Pua Protection. Default: 0

- **realtime_scan_direction** `integer` — Optional

  Realtime Scan Direction. Default: 0

- **scan_parameter** `integer` — Optional

  Scan Parameter. Default: 1

- **allow_switch_to_async_inspection** `boolean` — Optional

  Allow Switch To Async Inspection. Default: false

- **disable_cpu_throttle_on_idle_scans** `boolean` — Optional

  Disable Cpu Throttle On Idle Scans. Default: true

- **disable_network_protection_perf_telemetry** `boolean` — Optional

  Disable Network Protection Perf Telemetry. Default: false

- **enable_filehash_computation** `boolean` — Optional

  Enable Filehash Computation. Default: false

- **hide_exclusions_from_local_admins** `boolean` — Optional

  Hide Exclusions From Local Admins. Default: false

- **hide_exclusions_from_local_users** `boolean` — Optional

  Hide Exclusions From Local Users. Default: false

### Sample Request

#### Curl

```curl
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"allow_behavior_monitoring":true,"disable_cpu_throttle_on_idle_scans":true,"allow_switch_to_async_inspection":false,"hide_exclusions_from_local_admins":false,"allow_full_scan_removable_drive_scanning":true,"allow_scanning_network_files":false,"scan_parameter":"2","allow_realtime_monitoring":true,"disable_network_protection_perf_telemetry":false,"allow_email_scanning":false,"hide_exclusions_from_local_users":false,"allow_onaccess_protection":true,"allow_archive_scanning":true,"allow_ioav_protection":true,"allow_full_scan_on_mapped_networkdrives":false,"allow_user_ui_access":true,"allow_cloud_protection":true,"pua_protection":"1","enable_filehash_computation":false,"allow_intrusion_prevention_system":true,"allow_script_scanning":true,"realtime_scan_direction":"1","cloud_block_level":"2","check_for_signatures_before_runningscan":false}'
```

### Sample Request Body

Add Defender payload to the profile

```json
{
  "allow_behavior_monitoring": true,
  "disable_cpu_throttle_on_idle_scans": true,
  "allow_switch_to_async_inspection": false,
  "hide_exclusions_from_local_admins": false,
  "allow_full_scan_removable_drive_scanning": true,
  "allow_scanning_network_files": false,
  "scan_parameter": "2",
  "allow_realtime_monitoring": true,
  "disable_network_protection_perf_telemetry": false,
  "allow_email_scanning": false,
  "hide_exclusions_from_local_users": false,
  "allow_onaccess_protection": true,
  "allow_archive_scanning": true,
  "allow_ioav_protection": true,
  "allow_full_scan_on_mapped_networkdrives": false,
  "allow_user_ui_access": true,
  "allow_cloud_protection": true,
  "pua_protection": "1",
  "enable_filehash_computation": false,
  "allow_intrusion_prevention_system": true,
  "allow_script_scanning": true,
  "realtime_scan_direction": "1",
  "cloud_block_level": "2",
  "check_for_signatures_before_runningscan": false
}
```

## Response

### Response Parameters

#### HTTP Code 200

Response Body — `application/json`

JSON Object:

- **payload_id** `long`

  Unique identifier for the created payload item

- **allow_archive_scanning** `boolean`

  Allow Archive Scanning. Default: true

- **allow_behavior_monitoring** `boolean`

  Allow Behavior Monitoring. Default: true

- **allow_cloud_protection** `boolean`

  Allow Cloud Protection. Default: true

- **allow_email_scanning** `boolean`

  Allow Email Scanning. Default: false

- **allow_full_scan_on_mapped_networkdrives** `boolean`

  Allow Full Scan On Mapped Networkdrives. Default: false

- **allow_full_scan_removable_drive_scanning** `boolean`

  Allow Full Scan Removable Drive Scanning. Default: true

- **allow_intrusion_prevention_system** `boolean`

  Allow Intrusion Prevention System. Default: true

- **allow_ioav_protection** `boolean`

  Allow Ioav Protection. Default: true

- **cloud_block_level** `integer`

  Cloud Block Level. Default: 0

- **allow_onaccess_protection** `boolean`

  Allow Onaccess Protection. Default: true

- **allow_realtime_monitoring** `boolean`

  Allow Realtime Monitoring. Default: true

- **allow_scanning_network_files** `boolean`

  Allow Scanning Network Files. Default: false

- **allow_script_scanning** `boolean`

  Allow Script Scanning. Default: true

- **allow_user_ui_access** `boolean`

  Allow User Ui Access. Default: true

- **check_for_signatures_before_runningscan** `boolean`

  Check For Signatures Before Runningscan. Default: false

- **pua_protection** `integer`

  Pua Protection. Default: 0

- **realtime_scan_direction** `integer`

  Realtime Scan Direction. Default: 0

- **scan_parameter** `integer`

  Scan Parameter. Default: 1

- **allow_switch_to_async_inspection** `boolean`

  Allow Switch To Async Inspection. Default: false

- **disable_cpu_throttle_on_idle_scans** `boolean`

  Disable Cpu Throttle On Idle Scans. Default: true

- **disable_network_protection_perf_telemetry** `boolean`

  Disable Network Protection Perf Telemetry. Default: false

- **enable_filehash_computation** `boolean`

  Enable Filehash Computation. Default: false

- **hide_exclusions_from_local_admins** `boolean`

  Hide Exclusions From Local Admins. Default: false

- **hide_exclusions_from_local_users** `boolean`

  Hide Exclusions From Local Users. Default: false

### Possible Response Codes

- **200** — HTTP code

### Sample Response: HTTP 200

Defender payload successfully added

```json
{
  "allow_behavior_monitoring": true,
  "disable_cpu_throttle_on_idle_scans": true,
  "allow_switch_to_async_inspection": false,
  "hide_exclusions_from_local_admins": false,
  "allow_scanning_network_files": false,
  "scan_parameter": "2",
  "allow_realtime_monitoring": true,
  "disable_network_protection_perf_telemetry": false,
  "allow_email_scanning": false,
  "hide_exclusions_from_local_users": false,
  "allow_onaccess_protection": true,
  "allow_archive_scanning": true,
  "allow_ioav_protection": true,
  "allow_full_scan_on_mapped_networkdrives": false,
  "allow_cloud_protection": true,
  "pua_protection": "1",
  "allow_script_scanning": true,
  "cloud_block_level": "2",
  "check_for_signatures_before_runningscan": false,
  "payload_id": "9007199254741295",
  "allow_full_scan_removable_drive_scanning": true,
  "allow_user_ui_access": true,
  "enable_filehash_computation": false,
  "allow_intrusion_prevention_system": true,
  "realtime_scan_direction": "1"
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.