# Modify the configuration of a Defender payload item within a profile

Modify Windows Defender policy payload

## Endpoint

`PUT /api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}`

## Request

### Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}`

### Scope

`MDMDeviceMgmt.UPDATE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

| Parameter | Type | Required | Value |
|---|---|---|---|
| Content-Type | string | Mandatory | application/json |
| Accept | string | Mandatory | application/json |

#### Path Parameters

| Parameter | Type | Required | Description |
|---|---|---|---|
| profile_id | string | Mandatory | Unique identifier of the profile. Obtain from the [Create Profile](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-create-profile.html) or [Get Profiles](https://www.manageengine.com/products/desktop-central/help/api/onpremise/mdm-profiles-get-profile.html) response |
| payload_id | string | Mandatory | Unique identifier of the payload item. Obtain from the [Get Payload Item IDs](https://www.manageengine.com/products/desktop-central/help/api/onpremise/windows-get-defender-payload.html) response |

#### Request Body

`application/json`

JSON Object

| Attribute | Type | Required | Description |
|---|---|---|---|
| allow_archive_scanning | boolean | Optional | Allow Archive Scanning. Default: true |
| allow_behavior_monitoring | boolean | Optional | Allow Behavior Monitoring. Default: true |
| allow_cloud_protection | boolean | Optional | Allow Cloud Protection. Default: true |
| allow_email_scanning | boolean | Optional | Allow Email Scanning. Default: false |
| allow_full_scan_on_mapped_networkdrives | boolean | Optional | Allow Full Scan On Mapped Networkdrives. Default: false |
| allow_full_scan_removable_drive_scanning | boolean | Optional | Allow Full Scan Removable Drive Scanning. Default: true |
| allow_intrusion_prevention_system | boolean | Optional | Allow Intrusion Prevention System. Default: true |
| allow_ioav_protection | boolean | Optional | Allow Ioav Protection. Default: true |
| cloud_block_level | integer | Optional | Cloud Block Level. Default: 0 |
| allow_onaccess_protection | boolean | Optional | Allow Onaccess Protection. Default: true |
| allow_realtime_monitoring | boolean | Optional | Allow Realtime Monitoring. Default: true |
| allow_scanning_network_files | boolean | Optional | Allow Scanning Network Files. Default: false |
| allow_script_scanning | boolean | Optional | Allow Script Scanning. Default: true |
| allow_user_ui_access | boolean | Optional | Allow User Ui Access. Default: true |
| check_for_signatures_before_runningscan | boolean | Optional | Check For Signatures Before Runningscan. Default: false |
| pua_protection | integer | Optional | Pua Protection. Default: 0 |
| realtime_scan_direction | integer | Optional | Realtime Scan Direction. Default: 0 |
| scan_parameter | integer | Optional | Scan Parameter. Default: 1 |
| allow_switch_to_async_inspection | boolean | Optional | Allow Switch To Async Inspection. Default: false |
| disable_cpu_throttle_on_idle_scans | boolean | Optional | Disable Cpu Throttle On Idle Scans. Default: true |
| disable_network_protection_perf_telemetry | boolean | Optional | Disable Network Protection Perf Telemetry. Default: false |
| enable_filehash_computation | boolean | Optional | Enable Filehash Computation. Default: false |
| hide_exclusions_from_local_admins | boolean | Optional | Hide Exclusions From Local Admins. Default: false |
| hide_exclusions_from_local_users | boolean | Optional | Hide Exclusions From Local Users. Default: false |

### Sample Request

```curl
curl --request PUT \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"allow_behavior_monitoring":true,"disable_cpu_throttle_on_idle_scans":true,"allow_switch_to_async_inspection":false,"hide_exclusions_from_local_admins":false,"allow_full_scan_removable_drive_scanning":true,"allow_scanning_network_files":false,"scan_parameter":"2","allow_realtime_monitoring":true,"disable_network_protection_perf_telemetry":false,"allow_email_scanning":false,"hide_exclusions_from_local_users":false,"allow_onaccess_protection":true,"allow_archive_scanning":true,"allow_ioav_protection":true,"allow_full_scan_on_mapped_networkdrives":false,"allow_user_ui_access":true,"allow_cloud_protection":true,"pua_protection":"1","enable_filehash_computation":false,"allow_intrusion_prevention_system":true,"allow_script_scanning":true,"realtime_scan_direction":"1","cloud_block_level":"2","check_for_signatures_before_runningscan":false}'
```

### Sample Request Body

Modify Defender payload item

```json
{
  "allow_behavior_monitoring": true,
  "disable_cpu_throttle_on_idle_scans": true,
  "allow_switch_to_async_inspection": false,
  "hide_exclusions_from_local_admins": false,
  "allow_full_scan_removable_drive_scanning": true,
  "allow_scanning_network_files": false,
  "scan_parameter": "2",
  "allow_realtime_monitoring": true,
  "disable_network_protection_perf_telemetry": false,
  "allow_email_scanning": false,
  "hide_exclusions_from_local_users": false,
  "allow_onaccess_protection": true,
  "allow_archive_scanning": true,
  "allow_ioav_protection": true,
  "allow_full_scan_on_mapped_networkdrives": false,
  "allow_user_ui_access": true,
  "allow_cloud_protection": true,
  "pua_protection": "1",
  "enable_filehash_computation": false,
  "allow_intrusion_prevention_system": true,
  "allow_script_scanning": true,
  "realtime_scan_direction": "1",
  "cloud_block_level": "2",
  "check_for_signatures_before_runningscan": false
}
```

## Response

### Response Parameters

#### HTTP Code 200

Response Body: `application/json`

JSON Object

| Attribute | Type | Description |
|---|---|---|
| payload_id | long | Unique identifier of the payload item |
| allow_archive_scanning | boolean | Allow Archive Scanning. Default: true |
| allow_behavior_monitoring | boolean | Allow Behavior Monitoring. Default: true |
| allow_cloud_protection | boolean | Allow Cloud Protection. Default: true |
| allow_email_scanning | boolean | Allow Email Scanning. Default: false |
| allow_full_scan_on_mapped_networkdrives | boolean | Allow Full Scan On Mapped Networkdrives. Default: false |
| allow_full_scan_removable_drive_scanning | boolean | Allow Full Scan Removable Drive Scanning. Default: true |
| allow_intrusion_prevention_system | boolean | Allow Intrusion Prevention System. Default: true |
| allow_ioav_protection | boolean | Allow Ioav Protection. Default: true |
| cloud_block_level | integer | Cloud Block Level. Default: 0 |
| allow_onaccess_protection | boolean | Allow Onaccess Protection. Default: true |
| allow_realtime_monitoring | boolean | Allow Realtime Monitoring. Default: true |
| allow_scanning_network_files | boolean | Allow Scanning Network Files. Default: false |
| allow_script_scanning | boolean | Allow Script Scanning. Default: true |
| allow_user_ui_access | boolean | Allow User Ui Access. Default: true |
| check_for_signatures_before_runningscan | boolean | Check For Signatures Before Runningscan. Default: false |
| pua_protection | integer | Pua Protection. Default: 0 |
| realtime_scan_direction | integer | Realtime Scan Direction. Default: 0 |
| scan_parameter | integer | Scan Parameter. Default: 1 |
| allow_switch_to_async_inspection | boolean | Allow Switch To Async Inspection. Default: false |
| disable_cpu_throttle_on_idle_scans | boolean | Disable Cpu Throttle On Idle Scans. Default: true |
| disable_network_protection_perf_telemetry | boolean | Disable Network Protection Perf Telemetry. Default: false |
| enable_filehash_computation | boolean | Enable Filehash Computation. Default: false |
| hide_exclusions_from_local_admins | boolean | Hide Exclusions From Local Admins. Default: false |
| hide_exclusions_from_local_users | boolean | Hide Exclusions From Local Users. Default: false |

### Possible Response Codes

| Code | Type |
|---|---|
| 200 | HTTP code |

### Sample Response: HTTP 200

Defender payload item successfully modified

```json
{
  "allow_behavior_monitoring": true,
  "disable_cpu_throttle_on_idle_scans": true,
  "allow_switch_to_async_inspection": false,
  "hide_exclusions_from_local_admins": false,
  "allow_scanning_network_files": false,
  "scan_parameter": "2",
  "allow_realtime_monitoring": true,
  "disable_network_protection_perf_telemetry": false,
  "allow_email_scanning": false,
  "hide_exclusions_from_local_users": false,
  "allow_onaccess_protection": true,
  "allow_archive_scanning": true,
  "allow_ioav_protection": true,
  "allow_full_scan_on_mapped_networkdrives": false,
  "allow_cloud_protection": true,
  "pua_protection": "1",
  "allow_script_scanning": true,
  "cloud_block_level": "2",
  "check_for_signatures_before_runningscan": false,
  "payload_id": "9007199254741295",
  "allow_full_scan_removable_drive_scanning": true,
  "allow_user_ui_access": true,
  "enable_filehash_computation": false,
  "allow_intrusion_prevention_system": true,
  "realtime_scan_direction": "1"
}
```

## API Rate Limits

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.