Create Windows Hello Configuration policy payload
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowshellopolicy
MDMDeviceMgmt.CREATECopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Tenant Id. Default: -1
Enable Pfw
Allow Digits
Allow Uppercase Letter
Allow Lowercase Letter
Allow Special Chars
Min Pin Length
Max Pin Length
Enable Pin Recovery
Pin History
Pin Expiry
Enable Biometrics
Allow Security Key
Enable Device Unlock
Enable Device Lock
Allow Companion Device
Allow Tpm
Enable Anti Spoof
Device Unlock Config
ID for Factors 0 - PIN Factor, 1 - FINGERPRINT, 2 - FACIAL RECOGNITION, 3 - Trusted Signal (Bluetooth / WiFi)
Factory Type for Credential Provider 1 - First Factor, 2 - Second Factor
Tfa Bluetooth
Auth Scenario for Bluetooth Default : 0
Class of the blue tooth device Default : 3
Minimum acceptable RSSI value (in dBm) for the Bluetooth signal to qualify for authentication
Maximum allowed RSSI variation (in dBm) for the Bluetooth signal before the auth scenario is rejected
Tfa Wifi
SSID of the Trusted WiFi
Type of the Trusted WiFi 0 - OPEN, 1 - WEP, 2 - WPA-Personal, 3 - WPA-Enterprise, 4 - WPA2-Personal, 5 - WPA2-Enterprise
BSSID (MAC address) of the trusted Wi-Fi access point used for two-factor authentication
Root CA certificate (PEM/Base64-encoded) used to validate the Wi-Fi network for two-factor authentication
Minimum required Wi-Fi signal quality (0-100) for the auth scenario to succeed
curl --request POST \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowshellopolicy \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"tenant_id":"-1","allow_security_key":"0","enable_biometrics":false,"enable_anti_spoof":false,"enable_pfw":false,"enable_device_unlock":false,"enable_device_lock":false}'Add Hello payload to the profile (PIN Policy Disabled)
{
"tenant_id": "-1",
"allow_security_key": "0",
"enable_biometrics": false,
"enable_anti_spoof": false,
"enable_pfw": false,
"enable_device_unlock": false,
"enable_device_lock": false
}
Add Hello payload to the profile (PIN Policy Enabled)
{
"tenant_id": "749fd9b3-b71e-4210-a8ff-ea830c4c5135",
"max_pin_length": "127",
"allow_companion_device": false,
"allow_uppercase_letter": "0",
"enable_anti_spoof": false,
"allow_special_chars": "0",
"enable_device_unlock": false,
"allow_lowercase_letter": "0",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "6",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "0",
"enable_pfw": true,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Add Hello payload to the profile (TFA Configured)
{
"tenant_id": "-1",
"allow_security_key": "0",
"device_unlock_config": [
{
"factor_type": "1",
"credential_provider_id": "1"
},
{
"factor_type": "1",
"credential_provider_id": "0"
},
{
"factor_type": "2",
"credential_provider_id": "2"
},
{
"factor_type": "2",
"credential_provider_id": "3"
}
],
"tfa_bluetooth": {
"auth_scenario": 0,
"class_of_device": 3
},
"enable_biometrics": false,
"enable_anti_spoof": false,
"enable_pfw": false,
"enable_device_unlock": true,
"tfa_wifi": [
{
"wifi_ssid": "Dummy WiFI",
"wifi_security_type": "5"
}
],
"enable_device_lock": false
}
Unique identifier for the created payload item
Tenant Id. Default: -1
Enable Pfw
Allow Digits
Allow Uppercase Letter
Allow Lowercase Letter
Allow Special Chars
Min Pin Length
Max Pin Length
Enable Pin Recovery
Pin History
Pin Expiry
Enable Biometrics
Allow Security Key
Enable Device Unlock
Enable Device Lock
Allow Companion Device
Allow Tpm
Enable Anti Spoof
Device Unlock Config
ID for Factors 0 - PIN Factor, 1 - FINGERPRINT, 2 - FACIAL RECOGNITION, 3 - Trusted Signal (Bluetooth / WiFi)
Factory Type for Credential Provider 1 - First Factor, 2 - Second Factor
Tfa Bluetooth
Auth Scenario for Bluetooth Default : 0
Class of the blue tooth device Default : 3
Minimum acceptable RSSI value (in dBm) for the Bluetooth signal to qualify for authentication
Maximum allowed RSSI variation (in dBm) for the Bluetooth signal before the auth scenario is rejected
Tfa Wifi
SSID of the Trusted WiFi
Type of the Trusted WiFi 0 - OPEN, 1 - WEP, 2 - WPA-Personal, 3 - WPA-Enterprise, 4 - WPA2-Personal, 5 - WPA2-Enterprise
BSSID (MAC address) of the trusted Wi-Fi access point used for two-factor authentication
Root CA certificate (PEM/Base64-encoded) used to validate the Wi-Fi network for two-factor authentication
Minimum required Wi-Fi signal quality (0-100) for the auth scenario to succeed
Hello payload successfully added (PIN Policy Enabled)
{
"tenant_id": "749fd9b3-b71e-4210-a8ff-ea830c4c5135",
"max_pin_length": "127",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"allow_uppercase_letter": "0",
"enable_anti_spoof": false,
"allow_special_chars": "0",
"enable_device_unlock": false,
"allow_lowercase_letter": "0",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "6",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "0",
"enable_pfw": true,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Hello payload successfully added (PIN Policy Disabled)
{
"tenant_id": "-1",
"max_pin_length": "4",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"allow_uppercase_letter": "2",
"enable_anti_spoof": false,
"allow_special_chars": "2",
"enable_device_unlock": false,
"allow_lowercase_letter": "2",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "4",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "1",
"enable_pfw": false,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Hello payload with TFA successfully added
{
"tenant_id": "-1",
"max_pin_length": "4",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"device_unlock_config": [
{
"factor_type": "1",
"credential_provider_id": "1"
},
{
"factor_type": "1",
"credential_provider_id": "0"
},
{
"factor_type": "2",
"credential_provider_id": "2"
},
{
"factor_type": "2",
"credential_provider_id": "3"
}
],
"allow_uppercase_letter": "2",
"enable_anti_spoof": false,
"allow_special_chars": "2",
"enable_device_unlock": true,
"allow_lowercase_letter": "2",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "4",
"pin_expiry": "0",
"allow_security_key": "0",
"tfa_bluetooth": {
"auth_scenario": "0",
"class_of_device": "3"
},
"enable_biometrics": false,
"allow_digits": "1",
"enable_pfw": false,
"tfa_wifi": [
{
"wifi_ssid": "Dummy WiFI",
"wifi_security_type": "5"
}
],
"enable_device_lock": false,
"enable_pin_recovery": false
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.