# Modifies the privilege elevation application group by adding or removing rules

Updates the privilege application group by adding new rules or removing existing ones. Prefetch vendorID or productVendorID from [Get App Rule Types](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-app-rule-types.html) for new rules, and prefetch appRuleID from [Get Privilege Application Group](https://www.manageengine.com/products/desktop-central/help/api/cloud/acp-get-privilege-app-group.html) for rules to remove.

## Endpoint

**POST** `/dcapi/appctrl/privilegeAppGroup`

## Request

### Request URL

`https://`[*{serverurl}*](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)`/dcapi/appctrl/privilegeAppGroup`

### Scope

`DesktopCentralCloud.AppControl.CREATE`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** (`string`, **Mandatory**): `application/addUpdatePrivilegeAppGroup.v1+json`
- **Accept** (`string`, **Mandatory**): `application/addUpdatePrivilegeAppGroup.v1+json`

#### Request Body

`application/json`

- JSON Object
  - **jitRequestMode** (`string`, **Mandatory**): JIT request mode (0=Disabled, 1=Enabled, 2=Approval Required)
  - **configSpecificAppEnabled** (`boolean`, **Mandatory**): Whether config-specific app elevation is enabled
  - **appGroupType** (`integer`, **Mandatory**): Type of application group (3=Privilege)
  - **addedRules** (`JSON Array`, **Mandatory**): Rules to add
  - **removedRules** (`JSON Array`, **Mandatory**): Rules to remove

### Sample Request

```curl
curl --request POST \
  --url https://appdomains/dcapi/appctrl/privilegeAppGroup \
  --header 'Accept: application/addUpdatePrivilegeAppGroup.v1+json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/addUpdatePrivilegeAppGroup.v1+json' \
  --data '{"removedRules":[{"appRuleType":1,"appRuleIDs":[610]}],"appGroupType":3,"configSpecificAppEnabled":true,"jitRequestMode":"2","addedRules":[{"appRuleType":2}]}'
```

### Sample Request Body

Update privilege group — add product rules and remove existing vendor rules

```json
{
  "removedRules": [
    {
      "appRuleType": 1,
      "appRuleIDs": [
        610
      ]
    }
  ],
  "appGroupType": 3,
  "configSpecificAppEnabled": true,
  "jitRequestMode": "2",
  "addedRules": [
    {
      "appRuleType": 2,
      "verifiedAppRepoIDs": [
        700
      ]
    }
  ]
}
```

## Response Parameters

### HTTP 200

Response Body — `application/json`

- JSON Object
  - **status** (`boolean`): Whether the operation completed successfully (true=success, false=failure)

### Sample Response: HTTP 200

Privilege application group updated successfully

```json
{
  "status": true
}
```

### HTTP 401

Response Body — `application/json`

- JSON Object
  - **errorCode** (`long`): Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)
  - **errorMsg** (`string`): Authentication failure reason

### Sample Response: HTTP 401

Authentication credentials missing or invalid

```json
{
  "errorMessage": "Authentication credentials are missing or invalid",
  "errorCode": "UNAUTHORIZED"
}
```

### HTTP 500

Response Body — `application/json`

- JSON Object
  - **errorCode** (`string`): Internal error code: INTERNAL_ERROR when exception occurs updating privilege app group
  - **errorMessage** (`string`): Detailed message: Error Occurred while add or update privilege app group

### Sample Response: HTTP 500

Internal error while updating privilege app group

```json
{
  "errorMessage": "Error Occurred while add or update privilege app group",
  "errorCode": "INTERNAL_ERROR"
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.