# Clone a published configuration profile

Clones a published configuration profile with all its payloads.

## Endpoint

`POST /bsp/api/v1/bmp/profiles/{profile_id}/clone`

## Request

### Request URL

`https://{serverurl}/bsp/api/v1/bmp/profiles/{profile_id}/clone`

### Scope

`DesktopCentralCloud.BrowserManager.CREATE`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Accept** `string` — **Mandatory**
  - `application/json`

#### Path Parameters

- **profile_id** `string` — **Mandatory**
  - Retrieve the configuration profile ID from the `profileid` key in the response returned by [List Configuration Profiles](https://www.manageengine.com/products/desktop-central/help/api/cloud/profiles-list-profiles.html)

#### Query Parameters

- **new_profile** `boolean` — Optional
  - Optional. `true` = clone as new profile; `false`/omitted = clone as new draft version. Default: `false`

### Sample Request

#### Curl

```curl
curl --request POST \
  --url https://appdomains/bsp/api/v1/bmp/profiles/{profile_id}/clone \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'
```

#### Java

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/bsp/api/v1/bmp/profiles/{profile_id}/clone"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse<string> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());

  }
}
```

#### Python

```python
import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/bsp/api/v1/bmp/profiles/{profile_id}/clone", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))
```

#### Deluge

```javascript
headersMap = Map();
headersMap.put("Accept", "application/json");

response = invokeUrl
[
    url: "https://appDomains/bsp/api/v1/bmp/profiles/{profile_id}/clone"
    type: POST
    headers: headersMap
    connection: connection_name
]

info response;
```

#### PowerShell

```powershell
$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/bsp/api/v1/bmp/profiles/{profile_id}/clone' -Method POST -Headers $headers
```

## Response Parameters

### HTTP Code 200

Response body: `application/json`

`JSON Object` — Full configuration profile details including metadata, version info, and associated payloads.

- **profile_id** `string`
  - Profile ID
- **profile_name** `string`
  - Display name
- **profile_description** `string`
  - Description
- **profile_type** `string`
  - Profile type code. `64100` = Browser Customization, `64005` = File Activity, `64011` = Browser Router, `64050` = Web Isolation, `64200` = Threat Prevention, `64201` = Data Leakage Prevention, `64210` = Browser Lockdown, `64500` = Compliance, `64510` = Default Extension, `64950` = URL Filter, `64960` = Managed Browser
- **scope** `string`
  - `'0'` = Device, `'1'` = User
- **is_moved_to_trash** `boolean`
  - In trash
- **collection_id** `string`
  - Collection reference ID
- **platform_type** `string`
  - `'1'` = Windows, `'2'` = Mac, `'-1'` = All platforms (Windows + Mac)
- **latest_version** `string`
  - Latest version (increments on modify)
- **latest_published_version** `string`
  - Latest published version, or `'--'` if never published
- **payloads** `JSON Array`
  - Associated payload configurations

### HTTP Code 401

Response body: `application/json`

`JSON Object`

- **errorCode** `long`
  - Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required)
- **errorMsg** `string`
  - Authentication failure reason

### HTTP Code 403

Response body: `application/json`

`JSON Object`

- **errorCode** `long`
  - Forbidden error code returned when the authenticated user does not have the required uem-roles (e.g., DataEncryption_Admin or DataEncryptionRecoveryKey_Admin)
- **errorMsg** `string`
  - Message indicating insufficient privileges to access this resource

### HTTP Code 404

Response body: `application/json`

`JSON Object` — Resource not found error.

- **errormsg** `string`
  - Not found error message

### HTTP Code 409

Response body: `application/json`

`JSON Object` — Conflict error due to the current state of the profile.

- **errormsg** `string`
  - Conflict error message

### HTTP Code 429

Response body: `application/json`

`JSON Object`

- **errorCode** `long`
  - Rate limit error code returned when the API call threshold (configured via threshold/duration in security XML) is exceeded; client is locked out for lock-period minutes
- **errorMsg** `string`
  - Rate limit exceeded message with retry guidance

### HTTP Code 500

Response body: `application/json`

`JSON Object` — Internal server error response for profile operations.

- **error_description** `string`
  - Error message describing the server failure
- **error_code** `string`
  - Error code for internal server errors

## Sample Responses

### HTTP 200

#### Cloned File Activity Restriction profile (64005)

```json
{
  "collection_id": "222",
  "profile_name": "FileActivityFilter 3",
  "profile_type": "64005",
  "platform_type": "-1",
  "latest_version": "2",
  "is_moved_to_trash": false,
  "payloads": [
    {
      "config_name": "CONTENT_RESTRICTION_PAYLOAD",
      "payload_type": "64800",
      "payload_id": "332",
      "custom_mail_id": "--",
      "custom_message": "--",
      "exclude_rules_json": {
        "sites": [],
        "site_groups": []
      },
      "all_condition_match": true,
      "rules_json": {
        "rule_01": {
          "rule_type": 2,
          "rule_value": [
            "5"
          ],
          "enable": "0",
          "range": 1,
          "greater": 0
        },
        "rule_execution_order": "(rule_01)"
      },
      "message_type": "0",
      "whitelisted": "0",
      "custom_logo_path": "--"
    }
  ],
  "profile_id": "111",
  "scope": "0",
  "latest_published_version": "1",
  "profile_description": ""
}
```

#### Cloned URL Filter profile (64950)

```json
{
  "collection_id": "222",
  "profile_name": "Updated Policy Name",
  "profile_type": "64950",
  "platform_type": "-1",
  "latest_version": "3",
  "is_moved_to_trash": false,
  "payloads": [
    {
      "ssl_cert_protection": "-1",
      "config_name": "URL_FILTER_PAYLOAD",
      "payload_type": "64950",
      "payload_id": "928",
      "block_malicious_site": "-1",
      "rules_json": {
        "rule_2": {
          "enable": "1",
          "rule_value": [
            "00:00:00",
            "23:59:59"
          ],
          "range": "1",
          "type": "1",
          "greater": "0"
        },
        "rule_1": {
          "enable": "0",
          "rule_value": {
            "categories": [
              {
                "name": "News",
                "id": "1"
              }
            ]
          },
          "range": "1",
          "type": "2",
          "greater": "0"
        },
        "rule_execution_order": "(rule_1 & rule_2)"
      },
      "restrict_cert_override_error": "-1",
      "custom_mail_id": "--",
      "custom_message": "Access to this website [domain] [category] is currently blocked in your organization. Contact your system administrator for further information",
      "block_websites_with_ads": "-1",
      "whitelisted": "0",
      "webcategory_override_allowed": "0",
      "block_other_sites_to_injectcode": "-1",
      "custom_logo_path": "603",
      "custom_url": "--"
    }
  ],
  "profile_id": "111",
  "scope": "0",
  "latest_published_version": "2",
  "profile_description": ""
}
```

#### Cloned Web Isolation profile (64050)

```json
{
  "collection_id": "222",
  "profile_name": "Isolation Policy Copy",
  "profile_type": "64050",
  "platform_type": "1",
  "latest_version": "1",
  "is_moved_to_trash": false,
  "payloads": [
    {
      "payload_type": "64151",
      "payload_id": "532",
      "proxy_range": "10.0.0.0/8",
      "defender_app_gaurd_id": "200",
      "sites": [
        {
          "name": "www.google.com",
          "id": "304",
          "type": "webdomain"
        }
      ],
      "allow_session_persistence": "1",
      "prevent_non_ent_in_ent": "0",
      "config_label": "WEB_ISOLATION"
    }
  ],
  "profile_id": "111",
  "scope": "0",
  "latest_published_version": "--",
  "profile_description": "Cloned from Isolation Policy"
}
```

### HTTP 401

#### API key is missing or invalid

```json
{
  "errorCode": "IAM0001",
  "errorMsg": "Authentication key is invalid. Please regenerate the key and try again."
}
```

### HTTP 403

#### Forbidden

```json
{
  "errorCode": "FORBIDDEN",
  "errorMsg": "User does not have permission to perform this operation"
}
```

### HTTP 404

#### Source profile to clone does not exist

```json
{
  "errormsg": "Profile not found"
}
```

### HTTP 409

#### Only published profiles can be cloned

```json
{
  "errormsg": "Cannot clone unpublished profile."
}
```

### HTTP 429

#### Rate limit exceeded

```json
{
  "errorCode": "RATE_LIMIT_EXCEEDED",
  "errorMsg": "Too many requests. Please try again after 5 minutes"
}
```

### HTTP 500

#### Server error

```json
{
  "error_description": "Internal Server error, Please try again in a moment.",
  "error_code": "COM0004"
}
```

## Rate Limits

![ ](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.