--- title: "POST /v1/{+name}:modifyPolicyApplications" method: POST path: "/v1/{+name}:modifyPolicyApplications" tags: ["enterprises"] --- # POST /v1/{+name}:modifyPolicyApplications `POST /v1/{+name}:modifyPolicyApplications` Updates or creates applications in a policy. ## Path parameters - `name` string, required ## Request body - ModifyPolicyApplicationsRequest — Request to update or create ApplicationPolicy objects in the given Policy. - `changes` ApplicationPolicyChange[] — Required. The changes to be made to the ApplicationPolicy objects. There must be at least one ApplicationPolicyChange. - `updateMask` string, google-fieldmask — The field mask indicating the fields to update. If omitted, all modifiable fields are updated. - `application` ApplicationPolicy — Policy for an individual app. Note: Application availability on a given device cannot be changed using this policy if installAppsDisabled is enabled. The maximum number of applications that you can specify per policy is 3,000. - `roles` Role[] — Optional. Roles the app has.Apps having certain roles can be exempted from power and background execution restrictions, suspension and hibernation on Android 14 and above. The user control can also be disallowed for apps with certain roles on Android 11 and above. Refer to the documentation of each RoleType for more details.The app is notified about the roles that are set for it if the app has a notification receiver service with . The app is notified whenever its roles are updated or after the app is installed when it has nonempty list of roles. The app can use this notification to bootstrap itself after the installation. See Integrate with the AMAPI SDK (https://developers.google.com/android/management/sdk-integration) and Manage app roles (https://developers.google.com/android/management/app-roles) guides for more details on the requirements for the service.For the exemptions to be applied and the app to be notified about the roles, the signing key certificate fingerprint of the app on the device must match one of the signing key certificate fingerprints obtained from Play Store or one of the entries in ApplicationPolicy.signingKeyCerts. Otherwise, a NonComplianceDetail with APP_SIGNING_CERT_MISMATCH is reported.There must not be duplicate roles with the same roleType. Multiple apps cannot hold a role with the same roleType. A role with type ROLE_TYPE_UNSPECIFIED is not allowed. - `roleType` 'ROLE_TYPE_UNSPECIFIED' | 'COMPANION_APP' | 'KIOSK' | 'MOBILE_THREAT_DEFENSE_ENDPOINT_DETECTION_RESPONSE' | 'SYSTEM_HEALTH_MONITORING' — Required. The type of the role an app can have. - `managedConfiguration` object — Managed configuration applied to the app. The format for the configuration is dictated by the ManagedProperty values supported by the app. Each field name in the managed configuration must match the key field of the ManagedProperty. The field value must be compatible with the type of the ManagedProperty: *type* *JSON value* BOOL true or false STRING string INTEGER number CHOICE string MULTISELECT array of strings HIDDEN string BUNDLE_ARRAY array of objects Note: string values cannot be longer than 65535 characters. - `minimumVersionCode` integer — The minimum version of the app that runs on the device. If set, the device attempts to update the app to at least this version code. If the app is not up-to-date, the device will contain a NonComplianceDetail with non_compliance_reason set to APP_NOT_UPDATED. The app must already be published to Google Play with a version code greater than or equal to this value. At most 20 apps may specify a minimum version code per policy. - `accessibleTrackIds` string[] — List of the app’s track IDs that a device belonging to the enterprise can access. If the list contains multiple track IDs, devices receive the latest version among all accessible tracks. If the list contains no track IDs, devices only have access to the app’s production track. More details about each track are available in AppTrackInfo. - `disabled` boolean — Whether the app is disabled. When disabled, the app data is still preserved. - `workProfileWidgets` 'WORK_PROFILE_WIDGETS_UNSPECIFIED' | 'WORK_PROFILE_WIDGETS_ALLOWED' | 'WORK_PROFILE_WIDGETS_DISALLOWED' — Specifies whether the app installed in the work profile is allowed to add widgets to the home screen. - `preferentialNetworkId` 'PREFERENTIAL_NETWORK_ID_UNSPECIFIED' | 'NO_PREFERENTIAL_NETWORK' | 'PREFERENTIAL_NETWORK_ID_ONE' | 'PREFERENTIAL_NETWORK_ID_TWO' | 'PREFERENTIAL_NETWORK_ID_THREE' | 'PREFERENTIAL_NETWORK_ID_FOUR' | 'PREFERENTIAL_NETWORK_ID_FIVE' — Optional. ID of the preferential network the application uses. There must be a configuration for the specified network ID in preferentialNetworkServiceConfigs. If set to PREFERENTIAL_NETWORK_ID_UNSPECIFIED, the application will use the default network ID specified in defaultPreferentialNetworkId. See the documentation of defaultPreferentialNetworkId for the list of apps excluded from this defaulting. This applies on both work profiles and fully managed devices on Android 13 and above. - `lockTaskAllowed` boolean — Whether the app is allowed to lock itself in full-screen mode. DEPRECATED. Use InstallType KIOSK or kioskCustomLauncherEnabled to configure a dedicated device. - `packageName` string — The package name of the app. For example, com.google.android.youtube for the YouTube app. - `customAppConfig` CustomAppConfig — Configuration for a custom app. - `userUninstallSettings` 'USER_UNINSTALL_SETTINGS_UNSPECIFIED' | 'DISALLOW_UNINSTALL_BY_USER' | 'ALLOW_UNINSTALL_BY_USER' — Optional. User uninstall settings of the custom app. - `signingKeyCerts` ApplicationSigningKeyCert[] — Optional. Signing key certificates of the app.This field is required in the following cases: The app has installType set to CUSTOM (i.e. a custom app). The app has roles set to a nonempty list and the app does not exist on the Play Store. The app has extensionConfig set (i.e. an extension app) but ExtensionConfig.signingKeyFingerprintsSha256 (deprecated) is not set and the app does not exist on the Play Store.If this field is not set for a custom app, the policy is rejected. If it is not set when required for a non-custom app, a NonComplianceDetail with INVALID_VALUE is reported.For other cases, this field is optional and the signing key certificates obtained from Play Store are used.See following policy settings to see how this field is used: choosePrivateKeyRules ApplicationPolicy.InstallType.CUSTOM ApplicationPolicy.extensionConfig ApplicationPolicy.roles - `signingKeyCertFingerprintSha256` string, byte — Required. The SHA-256 hash value of the signing key certificate of the app. This must be a valid SHA-256 hash value, i.e. 32 bytes. - `installType` 'INSTALL_TYPE_UNSPECIFIED' | 'PREINSTALLED' | 'FORCE_INSTALLED' | 'BLOCKED' | 'AVAILABLE' | 'REQUIRED_FOR_SETUP' | 'KIOSK' | 'CUSTOM' — The type of installation to perform. - `connectedWorkAndPersonalApp` 'CONNECTED_WORK_AND_PERSONAL_APP_UNSPECIFIED' | 'CONNECTED_WORK_AND_PERSONAL_APP_DISALLOWED' | 'CONNECTED_WORK_AND_PERSONAL_APP_ALLOWED' — Controls whether the app can communicate with itself across a device’s work and personal profiles, subject to user consent. - `extensionConfig` ExtensionConfig — Configuration to enable an app as an extension app, with the capability of interacting with Android Device Policy offline. For Android versions 11 and above, extension apps are exempt from battery restrictions so will not be placed into the restricted App Standby Bucket (https://developer.android.com/topic/performance/appstandby#restricted-bucket). Extensions apps are also protected against users clearing their data or force-closing the application, although admins can continue to use the clear app data command on extension apps if needed for Android 11 and above. - `signingKeyFingerprintsSha256` string[] — Hex-encoded SHA-256 hashes of the signing key certificates of the extension app. Only hexadecimal string representations of 64 characters are valid.The signing key certificate fingerprints are always obtained from the Play Store and this field is used to provide additional signing key certificate fingerprints. However, if the application is not available on the Play Store, this field needs to be set. A NonComplianceDetail with INVALID_VALUE is reported if this field is not set when the application is not available on the Play Store.The signing key certificate fingerprint of the extension app on the device must match one of the signing key certificate fingerprints obtained from the Play Store or the ones provided in this field for the app to be able to communicate with Android Device Policy.In production use cases, it is recommended to leave this empty. - `notificationReceiver` string — Fully qualified class name of the receiver service class for Android Device Policy to notify the extension app of any local command status updates. The service must be exported in the extension app's AndroidManifest.xml and extend NotificationReceiverService (https://developers.google.com/android/management/reference/amapi/com/google/android/managementapi/notification/NotificationReceiverService) (see Integrate with the AMAPI SDK (https://developers.google.com/android/management/sdk-integration) guide for more details). - `credentialProviderPolicy` 'CREDENTIAL_PROVIDER_POLICY_UNSPECIFIED' | 'CREDENTIAL_PROVIDER_ALLOWED' — Optional. Whether the app is allowed to act as a credential provider on Android 14 and above. - `installConstraint` InstallConstraint[] — Optional. The constraints for installing the app. You can specify a maximum of one InstallConstraint. Multiple constraints are rejected. - `deviceIdleConstraint` 'DEVICE_IDLE_CONSTRAINT_UNSPECIFIED' | 'DEVICE_IDLE_NOT_REQUIRED' | 'INSTALL_ONLY_WHEN_DEVICE_IDLE' — Optional. Device idle constraint. - `networkTypeConstraint` 'NETWORK_TYPE_CONSTRAINT_UNSPECIFIED' | 'INSTALL_ON_ANY_NETWORK' | 'INSTALL_ONLY_ON_UNMETERED_NETWORK' — Optional. Network type constraint. - `chargingConstraint` 'CHARGING_CONSTRAINT_UNSPECIFIED' | 'CHARGING_NOT_REQUIRED' | 'INSTALL_ONLY_WHEN_CHARGING' — Optional. Charging constraint. - `installPriority` integer — Optional. Amongst apps with installType set to: FORCE_INSTALLED PREINSTALLEDthis controls the relative priority of installation. A value of 0 (default) means this app has no priority over other apps. For values between 1 and 10,000, a lower value means a higher priority. Values outside of the range 0 to 10,000 inclusive are rejected. - `managedConfigurationTemplate` ManagedConfigurationTemplate — The managed configurations template for the app, saved from the managed configurations iframe. - `templateId` string — The ID of the managed configurations template. - `configurationVariables` object — Optional, a map containing configuration variables defined for the configuration. - `permissionGrants` PermissionGrant[] — Explicit permission grants or denials for the app. These values override the default_permission_policy and permission_grants which apply to all apps. - `policy` 'PERMISSION_POLICY_UNSPECIFIED' | 'PROMPT' | 'GRANT' | 'DENY' — The policy for granting the permission. - `permission` string — The Android permission or group, e.g. android.permission.READ_CALENDAR or android.permission_group.CALENDAR. - `defaultPermissionPolicy` 'PERMISSION_POLICY_UNSPECIFIED' | 'PROMPT' | 'GRANT' | 'DENY' — The default policy for all permissions requested by the app. If specified, this overrides the policy-level default_permission_policy which applies to all apps. It does not override the permission_grants which applies to all apps. - `alwaysOnVpnLockdownExemption` 'ALWAYS_ON_VPN_LOCKDOWN_EXEMPTION_UNSPECIFIED' | 'VPN_LOCKDOWN_ENFORCED' | 'VPN_LOCKDOWN_EXEMPTION' — Specifies whether the app is allowed networking when the VPN is not connected and alwaysOnVpnPackage.lockdownEnabled is enabled. If set to VPN_LOCKDOWN_ENFORCED, the app is not allowed networking, and if set to VPN_LOCKDOWN_EXEMPTION, the app is allowed networking. Only supported on devices running Android 10 and above. If this is not supported by the device, the device will contain a NonComplianceDetail with non_compliance_reason set to API_LEVEL and a fieldPath. If this is not applicable to the app, the device will contain a NonComplianceDetail with non_compliance_reason set to UNSUPPORTED and a fieldPath. The fieldPath is set to applications[i].alwaysOnVpnLockdownExemption, where i is the index of the package in the applications policy. - `autoUpdateMode` 'AUTO_UPDATE_MODE_UNSPECIFIED' | 'AUTO_UPDATE_DEFAULT' | 'AUTO_UPDATE_POSTPONED' | 'AUTO_UPDATE_HIGH_PRIORITY' — Controls the auto-update mode for the app. - `userControlSettings` 'USER_CONTROL_SETTINGS_UNSPECIFIED' | 'USER_CONTROL_ALLOWED' | 'USER_CONTROL_DISALLOWED' — Optional. Specifies whether user control is permitted for the app. User control includes user actions like force-stopping and clearing app data. Certain types of apps have special treatment, see USER_CONTROL_SETTINGS_UNSPECIFIED and USER_CONTROL_ALLOWED for more details. - `delegatedScopes` string[] — The scopes delegated to the app from Android Device Policy. These provide additional privileges for the applications they are applied to. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/androidmanagement.md) · [All operations](https://skmtc.net/google/apis/androidmanagement/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/androidmanagement/versions/956638790236/schema)