Modify Windows Hello policy payload
https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowshellopolicy/payloaditems/{payload_id}
MDMDeviceMgmt.UPDATECopied!
Authorization: d92d4xxxxxxxxxxxxx15f52
Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response
Unique identifier of the payload item. Obtain from the Get Payload Item IDs response
Tenant Id. Default: -1
Enable Pfw
Allow Digits
Allow Uppercase Letter
Allow Lowercase Letter
Allow Special Chars
Min Pin Length
Max Pin Length
Enable Pin Recovery
Pin History
Pin Expiry
Enable Biometrics
Allow Security Key
Enable Device Unlock
Enable Device Lock
Allow Companion Device
Allow Tpm
Enable Anti Spoof
Device Unlock Config
ID for Factors 0 - PIN Factor, 1 - FINGERPRINT, 2 - FACIAL RECOGNITION, 3 - Trusted Signal (Bluetooth / WiFi)
Factory Type for Credential Provider 1 - First Factor, 2 - Second Factor
Tfa Bluetooth
Auth Scenario for Bluetooth Default : 0
Class of the blue tooth device Default : 3
Minimum acceptable RSSI value (in dBm) for the Bluetooth signal to qualify for authentication
Maximum allowed RSSI variation (in dBm) for the Bluetooth signal before the auth scenario is rejected
Tfa Wifi
SSID of the Trusted WiFi
Type of the Trusted WiFi 0 - OPEN, 1 - WEP, 2 - WPA-Personal, 3 - WPA-Enterprise, 4 - WPA2-Personal, 5 - WPA2-Enterprise
BSSID (MAC address) of the trusted Wi-Fi access point used for two-factor authentication
Root CA certificate (PEM/Base64-encoded) used to validate the Wi-Fi network for two-factor authentication
Minimum required Wi-Fi signal quality (0-100) for the auth scenario to succeed
curl --request PUT \
--url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowshellopolicy/payloaditems/{payload_id} \
--header 'Accept: application/json' \
--header 'Authorization: d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"tenant_id":"-1","allow_security_key":"0","enable_biometrics":false,"enable_anti_spoof":false,"enable_pfw":false,"enable_device_unlock":false,"enable_device_lock":false}'Modify Hello payload item (PIN Policy Disabled)
{
"tenant_id": "-1",
"allow_security_key": "0",
"enable_biometrics": false,
"enable_anti_spoof": false,
"enable_pfw": false,
"enable_device_unlock": false,
"enable_device_lock": false
}
Modify Hello payload item (PIN Policy Enabled)
{
"tenant_id": "749fd9b3-b71e-4210-a8ff-ea830c4c5135",
"max_pin_length": "127",
"allow_companion_device": false,
"allow_uppercase_letter": "0",
"enable_anti_spoof": false,
"allow_special_chars": "0",
"enable_device_unlock": false,
"allow_lowercase_letter": "0",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "6",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "0",
"enable_pfw": true,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Modify Hello payload item (TFA Configured)
{
"tenant_id": "-1",
"allow_security_key": "0",
"device_unlock_config": [
{
"factor_type": "1",
"credential_provider_id": "1"
},
{
"factor_type": "1",
"credential_provider_id": "0"
},
{
"factor_type": "2",
"credential_provider_id": "2"
},
{
"factor_type": "2",
"credential_provider_id": "3"
}
],
"tfa_bluetooth": {
"auth_scenario": 0,
"class_of_device": 3
},
"enable_biometrics": false,
"enable_anti_spoof": false,
"enable_pfw": false,
"enable_device_unlock": true,
"tfa_wifi": [
{
"wifi_ssid": "Dummy WiFI",
"wifi_security_type": "5"
}
],
"enable_device_lock": false
}
Unique identifier of the payload item
Tenant Id. Default: -1
Enable Pfw
Allow Digits
Allow Uppercase Letter
Allow Lowercase Letter
Allow Special Chars
Min Pin Length
Max Pin Length
Enable Pin Recovery
Pin History
Pin Expiry
Enable Biometrics
Allow Security Key
Enable Device Unlock
Enable Device Lock
Allow Companion Device
Allow Tpm
Enable Anti Spoof
Device Unlock Config
ID for Factors 0 - PIN Factor, 1 - FINGERPRINT, 2 - FACIAL RECOGNITION, 3 - Trusted Signal (Bluetooth / WiFi)
Factory Type for Credential Provider 1 - First Factor, 2 - Second Factor
Tfa Bluetooth
Auth Scenario for Bluetooth Default : 0
Class of the blue tooth device Default : 3
Minimum acceptable RSSI value (in dBm) for the Bluetooth signal to qualify for authentication
Maximum allowed RSSI variation (in dBm) for the Bluetooth signal before the auth scenario is rejected
Tfa Wifi
SSID of the Trusted WiFi
Type of the Trusted WiFi 0 - OPEN, 1 - WEP, 2 - WPA-Personal, 3 - WPA-Enterprise, 4 - WPA2-Personal, 5 - WPA2-Enterprise
BSSID (MAC address) of the trusted Wi-Fi access point used for two-factor authentication
Root CA certificate (PEM/Base64-encoded) used to validate the Wi-Fi network for two-factor authentication
Minimum required Wi-Fi signal quality (0-100) for the auth scenario to succeed
Hello payload item successfully modified
{
"tenant_id": "-1",
"max_pin_length": 1,
"payload_id": 9007199254741000,
"allow_uppercase_letter": 1,
"allow_digits": 1,
"enable_pfw": true,
"allow_special_chars": 1,
"allow_lowercase_letter": 1,
"pin_history": 1,
"min_pin_length": 1,
"enable_pin_recovery": true
}
Hello payload item successfully modified (PIN Policy Enabled)
{
"tenant_id": "749fd9b3-b71e-4210-a8ff-ea830c4c5135",
"max_pin_length": "127",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"allow_uppercase_letter": "0",
"enable_anti_spoof": false,
"allow_special_chars": "0",
"enable_device_unlock": false,
"allow_lowercase_letter": "0",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "6",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "0",
"enable_pfw": true,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Hello payload item successfully modified (PIN Policy Disabled)
{
"tenant_id": "-1",
"max_pin_length": "4",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"allow_uppercase_letter": "2",
"enable_anti_spoof": false,
"allow_special_chars": "2",
"enable_device_unlock": false,
"allow_lowercase_letter": "2",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "4",
"pin_expiry": "0",
"allow_security_key": "0",
"enable_biometrics": false,
"allow_digits": "1",
"enable_pfw": false,
"enable_device_lock": false,
"enable_pin_recovery": false
}
Hello payload item with TFA successfully modified
{
"tenant_id": "-1",
"max_pin_length": "4",
"payload_id": "9007199254741295",
"allow_companion_device": false,
"device_unlock_config": [
{
"factor_type": "1",
"credential_provider_id": "1"
},
{
"factor_type": "1",
"credential_provider_id": "0"
},
{
"factor_type": "2",
"credential_provider_id": "2"
},
{
"factor_type": "2",
"credential_provider_id": "3"
}
],
"allow_uppercase_letter": "2",
"enable_anti_spoof": false,
"allow_special_chars": "2",
"enable_device_unlock": true,
"allow_lowercase_letter": "2",
"allow_tpm": false,
"pin_history": "0",
"min_pin_length": "4",
"pin_expiry": "0",
"allow_security_key": "0",
"tfa_bluetooth": {
"auth_scenario": "0",
"class_of_device": "3"
},
"enable_biometrics": false,
"allow_digits": "1",
"enable_pfw": false,
"tfa_wifi": [
{
"wifi_ssid": "Dummy WiFI",
"wifi_security_type": "5"
}
],
"enable_device_lock": false,
"enable_pin_recovery": false
}
![]()
Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.