Release_iOS-15_macOS-12

declarative/declarations/activations/simple.yaml

@@ -0,0 +1,23 @@
+title: Activation:Simple
+description: An activation used to install a set of configurations.
+payload:
+  declarationtype: com.apple.activation.simple
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: StandardConfigurations
+  type: <array>
+  presence: required
+  content: An array of strings that specify the identifiers of configurations to install.
+    A failure to install one of the configurations doesn't prevent other configurations
+    from installing.
+  subkeys:
+  - key: StandardConfigurationsItems
+    type: <string>
+- key: Predicate
+  type: <string>
+  presence: optional
+  content: A predicate format string as Apple's Predicate Programming <https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/Predicates/AdditionalChapters/Introduction.html>
+    describes. The activation only installs when the predicate evaluates to 'true'
+    or isn't present.

declarative/declarations/assets/credential.userpassword.yaml

@@ -0,0 +1,34 @@
+title: Credential:User Name and Password
+description: A reference to data describing a credential representing a user name
+  and password. Note that this should always be considered as security sensitive data.
+payload:
+  declarationtype: com.apple.asset.credential.userpassword
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: Reference
+  type: <dictionary>
+  presence: required
+  content: The reference to the credential.
+  subkeys:
+  - key: DataURL
+    type: <string>
+    presence: required
+    content: The URL that hosts the credential data. The URL must start with 'https://'.
+  - key: ContentType
+    type: <string>
+    presence: required
+    content: The media type that describes the data.
+  - key: Size
+    type: <integer>
+    presence: required
+    content: The size of the data at the 'DataURL'. Use this value to verify that
+      the returned data is the expected data. Use this value to detect when the data
+      changes.
+  - key: Hash-SHA-256
+    type: <string>
+    presence: required
+    content: |-
+      A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
+      If 'Size' is '0', clients need to ignore this value or set it to an empty string.

declarative/declarations/assets/credentials/usernameandpassword.yaml

@@ -0,0 +1,16 @@
+title: User Name and Password Credentials
+description: Data describing a credential representing a user name and password.
+payload:
+  credentialtype: com.apple.credential.usernameandpassword
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: UserName
+  type: <string>
+  presence: required
+  content: The user's user name for the credential.
+- key: Password
+  type: <string>
+  presence: optional
+  content: The user's password for the credential.

declarative/declarations/assets/useridentity.yaml

@@ -0,0 +1,18 @@
+title: User Identity
+description: User identity data.
+payload:
+  declarationtype: com.apple.asset.useridentity
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: FullName
+  title: Full Name
+  type: <string>
+  presence: optional
+  content: The user's full name.
+- key: EmailAddress
+  title: Email Address
+  type: <string>
+  presence: optional
+  content: The user's email address.

declarative/declarations/configurations/account.caldav.yaml

@@ -0,0 +1,37 @@
+title: Account:CalDAV
+description: Use this configuration to define settings for access to CalDAV servers.
+payload:
+  declarationtype: com.apple.configuration.account.caldav
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: A CalDAV configuration defines a CalDAV calendar and reminders account
+    for a user.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this calendar account. If not present,
+    the system generates a suitable default.
+- key: HostName
+  title: Server Host Name
+  type: <string>
+  presence: required
+  content: The hostname of the CalDAV server (or IP address).
+- key: Port
+  title: Server Port
+  type: <integer>
+  presence: optional
+  content: The port number for the CalDAV server.
+- key: Path
+  title: Server Path
+  type: <string>
+  presence: optional
+  content: The path for the CalDAV server.
+- key: AuthenticationCredentialsAssetReference
+  title: Authentication Credentials Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the credentials for
+    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.

declarative/declarations/configurations/account.carddav.yaml

@@ -0,0 +1,36 @@
+title: Account:CardDAV
+description: Use this configuration to define settings for access to CardDAV servers.
+payload:
+  declarationtype: com.apple.configuration.account.carddav
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: A CardDAV configuration defines a CardDAV contacts account for a user.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this address book account. If not
+    present, the system generates a suitable default.
+- key: HostName
+  title: Server Host Name
+  type: <string>
+  presence: required
+  content: The hostname of the CardDAV server (or IP address).
+- key: Port
+  title: Server Port
+  type: <integer>
+  presence: optional
+  content: The port number for the CardDAV server.
+- key: Path
+  title: Server Path
+  type: <string>
+  presence: optional
+  content: The path for the CardDAV server.
+- key: AuthenticationCredentialsAssetReference
+  title: Authentication Credentials Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the credentials for
+    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.

declarative/declarations/configurations/account.exchange.yaml

@@ -0,0 +1,210 @@
+title: Account:Exchange
+description: Use this configuration to define settings for access to Exchange ActiveSync
+  and Web Services servers.
+payload:
+  declarationtype: com.apple.configuration.account.exchange
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: This payload configures an Exchange ActiveSync account on an iOS device.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this Exchange account. If not present,
+    the system generates a suitable default.
+- key: EnabledProtocolTypes
+  title: Enabled Protocol Types
+  type: <array>
+  presence: required
+  content: |-
+    The set of protocol types to enable on the Exchange server, in order of preference. This is an array of unique strings with possible values:
+    * 'EAS:' Exchange ActiveSync
+    * 'EWS:' Exchange Web Services (EWS)
+    If the device supports one or more of the listed protocol types, it sets up an account for the first supported type.
+    If the device doesn't support any of the listed protocol types, it doesn't set up an account and the system reports an error.
+  subkeys:
+  - key: EnabledProtocolTypesItem
+    type: <string>
+    presence: required
+    rangelist:
+    - EAS
+    - EWS
+- key: UserIdentityAssetReference
+  title: User Identity Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the user identity
+    for this account. The corresponding asset must be of type UserIdentity.
+- key: HostName
+  title: Server Host Name
+  type: <string>
+  presence: optional
+  content: The hostname of the EWS server (or IP address). This is a required field
+    unless the declaration contains an 'OAuth' property, with a 'SignInURL' that has
+    'enabled' as 'true'.
+- key: Port
+  title: Server Port
+  supportedOS:
+    iOS:
+      introduced: n/a
+  type: <integer>
+  presence: optional
+  content: The port number of the EWS server. The system uses this only when this
+    declaration has a 'HostName' value.
+- key: Path
+  title: Server Path
+  supportedOS:
+    iOS:
+      introduced: n/a
+  type: <string>
+  presence: optional
+  content: The path of the EWS server. The system uses this only when this declaration
+    has a 'HostName' value.
+- key: ExternalHostName
+  title: Server External Host Name
+  supportedOS:
+    iOS:
+      introduced: n/a
+  type: <string>
+  presence: optional
+  content: The external hostname of the EWS server (or IP address). This is a required
+    field unless the declaration contains an 'OAuth' property, with a 'SignInURL'
+    that has 'enabled' as 'true'.
+- key: ExternalPort
+  title: Server External Port
+  supportedOS:
+    iOS:
+      introduced: n/a
+  type: <integer>
+  presence: optional
+  content: The external port number of the EWS server. The system uses this only when
+    this declaration has a 'HostName' value.
+- key: External Path
+  title: Server External Path
+  supportedOS:
+    iOS:
+      introduced: n/a
+  type: <string>
+  presence: optional
+  content: The external path of the EWS server. The system uses this only when this
+    declaration has a 'HostName' value.
+- key: OAuth
+  title: Controls use of OAuth
+  type: <dictionary>
+  presence: optional
+  content: The configuration settings for OAuth for this account.
+  subkeys:
+  - key: Enabled
+    title: Use OAuth
+    type: <boolean>
+    presence: required
+    content: If 'true', enables OAuth for this account.
+  - key: SignInURL
+    type: <string>
+    presence: optional
+    content: The URL that this account uses for signing in with OAuth. The system
+      ignores this value unless 'Enabled' is 'true'. The system doesn't use autodiscovery
+      when a declaraction contains this URL, so the declaration must also contain
+      a 'HostName'.
+  - key: TokenRequestURL
+    supportedOS:
+      macOS:
+        introduced: n/a
+    type: <string>
+    presence: optional
+    content: The URL that this account uses for token requests with OAuth. The system
+      ignores this value unless 'Enabled' is 'true'.
+- key: AuthenticationCredentialsAssetReference
+  title: Authentication Credentials Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the credentials for
+    this account to authenticate with an Exchange server. The corresponding asset
+    must be of type CredentialUserNameAndPassword.
+- key: MailServiceActive
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'true', activates the mail service for this account.
+- key: LockMailService
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', prevents the user from changing the status of the mail service
+    for this account.
+- key: ContactsServiceActive
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'true', activates the address book service for this account.
+- key: LockContactsService
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', prevents the user from changing the status of the address book
+    service for this account.
+- key: CalendarServiceActive
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'true', activates the calendar service for this account.
+- key: LockCalendarService
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', prevents the user from changing the status of the calendar service
+    for this account.
+- key: RemindersServiceActive
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'true', activates the reminders service for this account.
+- key: LockRemindersService
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', prevents the user from changing the status of the reminders
+    service for this account.
+- key: NotesServiceActive
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'true', activates the notes service for this account.
+- key: LockNotesService
+  supportedOS:
+    macOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', prevents the user from changing the status of the notes service
+    for this account.

declarative/declarations/configurations/account.google.yaml

@@ -0,0 +1,25 @@
+title: Account:Google
+description: Use this configuration to define settings for access to Google services.
+payload:
+  declarationtype: com.apple.configuration.account.google
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: A Google configuration defines a Google account for a user. The user will
+    be prompted to enter their credentials shortly after the configuration successfully
+    installs.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this Google account. If not present,
+    the system generates a suitable default.
+- key: UserIdentityAssetReference
+  title: User Identity Asset Reference
+  type: <string>
+  presence: required
+  content: The identifier of an asset declaration that contains the user identity
+    for this Google account. The corresponding asset must be of type UserIdentity.
+    The asset must contain an 'EmailAddress' key that specifies the full Google email
+    address for the account.

declarative/declarations/configurations/account.ldap.yaml

@@ -0,0 +1,69 @@
+title: Account:LDAP
+description: Use this configuration to define settings for access to LDAP servers.
+payload:
+  declarationtype: com.apple.configuration.account.ldap
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: An LDAP configuration defines an LDAP directory account for a user.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this LDAP account. If not present,
+    the system generates a suitable default.
+- key: HostName
+  title: Server Host Name
+  type: <string>
+  presence: required
+  content: The hostname of the LDAP server (or IP address).
+- key: Port
+  title: Server Port
+  type: <integer>
+  presence: optional
+  content: The port number of the LDAP server (or IP address).
+- key: AuthenticationCredentialsAssetReference
+  title: Authentication Credentials Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the credentials for
+    this account. The corresponding asset must be of type UserNameAndPasswordCredentials.
+- key: SearchSettings
+  title: Search Settings
+  type: <array>
+  presence: optional
+  content: The array of nodes to start LDAP searches from. There must be at least
+    one node for this account to be useful. macOS only searches one node and ignores
+    other items in the array.
+  subkeys:
+  - key: SearchSettingsItem
+    title: An LDAP Search Setting
+    type: <dictionary>
+    subkeys:
+    - key: VisibleDescription
+      title: Visible Description
+      type: <string>
+      presence: optional
+      content: The description of this search setting in the Contacts and Settings
+        apps. If not present, the apps display no name.
+    - key: SearchBase
+      title: Search Base
+      type: <string>
+      presence: required
+      content: The path to the node where a search starts. For example, 'ou=people,o=example
+        corp'.
+    - key: Scope
+      title: Scope
+      type: <string>
+      presence: optional
+      rangelist:
+      - Base
+      - OneLevel
+      - Subtree
+      default: Subtree
+      content: |-
+        The type of recursion to use in the saerch.
+        * 'Base': Only the 'SearchBase' node.
+        * 'OneLevel': The 'SearchBase' node and its immediate children.
+        * 'Subtree': The 'SearchBase' node and all its chidren, regardless of depth.

declarative/declarations/configurations/account.mail.yaml

@@ -0,0 +1,103 @@
+title: Account:Mail
+description: Use this configuration to define settings for access to email servers.
+payload:
+  declarationtype: com.apple.configuration.account.mail
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: An email configuration defines an email account for a user.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this mail account. If not present,
+    the system generates a suitable default.
+- key: UserIdentityAssetReference
+  title: User Identity Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the user identity
+    for this account. The corresponding asset must be of type UserIdentity.
+- key: IncomingServer
+  title: Incoming Server Settings
+  type: <dictionary>
+  presence: required
+  content: The settings for the incoming mail server for this account.
+  subkeys:
+  - key: ServerType
+    title: Server Type
+    type: <string>
+    presence: required
+    rangelist:
+    - IMAP
+    - POP
+    content: The mail protocol this account uses.
+  - key: HostName
+    title: Server Host Name
+    type: <string>
+    presence: required
+    content: The host name for the incoming mail server.
+  - key: Port
+    title: Server Port
+    type: <integer>
+    presence: optional
+    content: The port number for the incoming mail server.
+  - key: AuthenticationMethod
+    title: Server Authentication Method
+    type: <string>
+    presence: required
+    rangelist:
+    - None
+    - Password
+    - CRAMMD5
+    - NTLM
+    - HTTPMD5
+    content: The authentication method for the incoming mail server.
+  - key: AuthenticationCredentialsAssetReference
+    title: Authentication Credentials Asset Reference
+    type: <string>
+    presence: optional
+    content: |-
+      The identifier of an asset declaration that contains the credentials for this account to authenticate with an incoming mail server. The corresponding asset must be of type CredentialUserNameAndPassword.
+      If the 'AuthenticationMethod' is 'None', this field must be blank. Otherwise, the declaration must contain this field.
+  - key: IMAPPathPrefix
+    title: IMAP Path Prefix
+    type: <string>
+    presence: optional
+    content: The path prefix for the IMAP server. The system uses this only when 'ServerType'
+      is 'IMAP'.
+- key: OutgoingServer
+  title: Outgoing Server Settings
+  type: <dictionary>
+  presence: required
+  content: The settings for the outgoing mail server for this account.
+  subkeys:
+  - key: HostName
+    title: Server Host Name
+    type: <string>
+    presence: required
+    content: The host name for the outgoing mail server.
+  - key: Port
+    title: Server Port
+    type: <integer>
+    presence: optional
+    content: The port number for the outgoing mail server.
+  - key: AuthenticationMethod
+    title: Server Authentication Method
+    type: <string>
+    presence: required
+    rangelist:
+    - None
+    - Password
+    - CRAMMD5
+    - NTLM
+    - HTTPMD5
+    content: The authentication method for the outgoing mail server.
+  - key: AuthenticationCredentialsAssetReference
+    title: Authentication Credentials Asset Reference
+    type: <string>
+    presence: optional
+    content: |-
+      The identifier of an asset declaration that contains the credentials for this account to authenticate with an outgoing mail server. The corresponding asset must be of type CredentialUserNameAndPassword.
+      If the 'AuthenticationMethod' is 'None', this field must be blank. Otherwise, the declaration must contain this field.

declarative/declarations/configurations/account.subscribed-calendar.yaml

@@ -0,0 +1,28 @@
+title: Account:Subscribed Calendar
+description: Use this configuration to define settings for a subscribed calendar.
+payload:
+  declarationtype: com.apple.configuration.account.subscribed-calendar
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+  content: A subscribed calendar configuration defines a subscribed calendar for a
+    user.
+payloadkeys:
+- key: VisibleName
+  title: Account Name
+  type: <string>
+  presence: optional
+  content: The name that apps show to the user for this calendar account. If not present,
+    the system generates a suitable default.
+- key: CalendarURL
+  title: Calendar URL
+  type: <string>
+  presence: required
+  content: The URL of the subscribed calendar. The URL must start with 'https://'.
+- key: AuthenticationCredentialsAssetReference
+  title: Authentication Credentials Asset Reference
+  type: <string>
+  presence: optional
+  content: The identifier of an asset declaration that contains the credentials for
+    this account to authenticate with a calendar server. The corresponding asset must
+    be of type CredentialUserNameAndPassword.

declarative/declarations/configurations/legacy.interactive.yaml

@@ -0,0 +1,22 @@
+title: Legacy Interactive Profile
+description: Specifies an MDMv1 profile to present to the user who may choose to download
+  and install it
+payload:
+  declarationtype: com.apple.configuration.legacy.interactive
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: ProfileURL
+  title: Profile's URL.
+  type: <string>
+  presence: required
+  content: |-
+    The URL of the profile to download and install. This must be an 'https://' URL. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
+    If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS, the system rejects the entire profile.
+- key: VisibleName
+  title: Configuration Visible Name
+  type: <string>
+  presence: required
+  content: The visible name of the configuration. This name needs to indicate the
+    nature of the profile.

declarative/declarations/configurations/legacy.yaml

@@ -0,0 +1,15 @@
+title: Legacy Profile
+description: Specifies an MDMv1 profile to download and install
+payload:
+  declarationtype: com.apple.configuration.legacy
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: ProfileURL
+  title: Profile's URL.
+  type: <string>
+  presence: required
+  content: |-
+    The URL of the profile to download and install. This must be an 'https://' URL. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
+    If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS, the system rejects the entire profile.

declarative/declarations/configurations/management.status-subscriptions.yaml

@@ -0,0 +1,22 @@
+title: Management:Status Subscriptions
+description: Use this configuration to define the status subscriptions that cause
+  status to be reported by the client.
+payload:
+  declarationtype: com.apple.configuration.management.status-subscriptions
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: StatusItems
+  title: Status Items
+  type: <array>
+  presence: required
+  content: An array of status items that the device notifies subscribers about.
+  subkeys:
+  - key: StatusItem
+    type: <dictionary>
+    subkeys:
+    - key: Name
+      type: <string>
+      presence: required
+      content: The name of the status item to send to subscribers.

declarative/declarations/configurations/management.test.yaml

@@ -0,0 +1,24 @@
+title: Management:Test
+description: A configuration used for testing only
+payload:
+  declarationtype: com.apple.configuration.management.test
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: Echo
+  title: Status Echo
+  type: <string>
+  presence: required
+  content: The string to echo back in a status response reason.
+- key: ReturnStatus
+  title: Status to Return
+  type: <string>
+  presence: optional
+  rangelist:
+  - Installed
+  - Failed
+  - PendingClient
+  default: Installed
+  content: The status the system reports back when the device implements the configuration.
+    Use this to override the normal 'success' result.

declarative/declarations/configurations/passcode.settings.yaml

@@ -0,0 +1,72 @@
+title: Passcode:Settings
+description: Use this configuration to define passcode policy settings
+payload:
+  declarationtype: com.apple.configuration.passcode.settings
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: RequirePasscode
+  title: Require Passcode on Device
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', requires the user to set a passcode without any requirements
+    about the length or quality of the passcode. The presence of any other keys implicitly
+    requires a passcode, and overrides this key's value.
+- key: RequireComplexPasscode
+  title: Require Complex Passcode
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', requires a complex passcode. A complex passcode is one that
+    doesn't contain repeated characters or increasing/decreasing characters (such
+    as 123 or CBA), and must contain at least one nonnumeric/nonalphabetic character.
+- key: MinimumLength
+  title: Minimum Passcode Length
+  type: <integer>
+  presence: optional
+  range:
+    min: 0
+    max: 16
+  default: 0
+  content: The minimum number of characters a passcode can contain.
+- key: MaximumFailedAttempts
+  title: Maximum Number of Failed Attempts
+  type: <integer>
+  presence: optional
+  range:
+    min: 2
+    max: 11
+  default: 11
+  content: |-
+    The number of failed passcode attempts that the system allows the user before iOS erases the device or macOS locks the device. If you don't change this setting, after six failed attempts, the device imposes a time delay before the user can enter a passcode again. The time delay increases with each failed attempt.
+    After the final failed attempt, the system securely erases all data and settings from the iOS device. A macOS device locks after the final attempt. The passcode time delay begins after the sixth attempt, so if this value is six or lower, the system has no time delay and triggers the erase or lock as soon as the user exceeds the limit.
+- key: MaximumGracePeriodInMinutes
+  title: Maximum Grace Period
+  type: <integer>
+  presence: optional
+  content: |-
+    The maximum period that a user can select, during which the user can unlock the device without a passcode. A value of '0' means no grace period, and the device requires a passcode immediately. In the absence of this key, the user can select any period.
+    macOS translates this to screensaver settings.
+- key: MaximumInactivityInMinutes
+  title: Automatic Device Lock
+  type: <integer>
+  presence: optional
+  range:
+    min: 0
+    max: 15
+  content: |-
+    The maximum period that a user can select, during which the device can be idle before the system automatically locks it. When the device reaches this limit, the device locks and the user must enter the passcode to unlock it. In the absence of this key, the user can select any period.
+    macOS translates this to screensaver settings.
+- key: PasscodeReuseLimit
+  title: Passcode Reuse Limit
+  type: <integer>
+  presence: optional
+  range:
+    min: 1
+    max: 50
+  content: The number of historical passcode entries the system checks when vaildating
+    a new passcode. The device refuses a new passcode if it matches a previously used
+    passcode within the specified passcode history range. In the absence of this key,
+    the system performs no historical check.

declarative/declarations/declarationbase.yaml

@@ -0,0 +1,25 @@
+title: DeclarationBase
+description: Keys common to all declarations used with the Remote Management protocol.
+payload:
+  declarationtype: any
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: Type
+  type: <string>
+  presence: required
+  content: A string specifying the type of this declaration.
+- key: Identifier
+  type: <string>
+  presence: required
+  content: A string uniquely identifying this declaration.
+- key: ServerToken
+  type: <string>
+  presence: required
+  content: A unique token generated by the server specifying a particular revision
+    of the declaration.
+- key: Payload
+  type: <dictionary>
+  presence: required
+  content: The payload describing this declaration.

declarative/declarations/management/organization-info.yaml

@@ -0,0 +1,37 @@
+title: Management:Organization Information
+description: Use this declaration to tell the client about the server's organization
+  information.
+payload:
+  declarationtype: com.apple.management.organization-info
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: Name
+  title: Organization Name
+  type: <string>
+  presence: required
+  content: The name of the organization.
+- key: Email
+  title: Organization Email Address
+  type: <string>
+  presence: optional
+  content: The email address of the contact person for the organization.
+- key: URL
+  title: Organization URL
+  type: <string>
+  presence: optional
+  content: The website of the organization to contact for support.
+- key: Proof
+  title: Organization Identity
+  type: <dictionary>
+  presence: optional
+  content: The additional properties that verify the identity and authenticity of
+    the organization.
+  subkeys:
+  - key: IdentityToken
+    title: Organization Identity Token
+    type: <string>
+    presence: optional
+    content: A token that verifies the identity of the organization when using this
+      service.

declarative/declarations/management/server-capabilities.yaml

@@ -0,0 +1,25 @@
+title: Management:Server Capabilities
+description: Use this declaration to tell the client about the server's capabilities.
+payload:
+  declarationtype: com.apple.management.server-capabilities
+  supportedOS:
+    iOS:
+      introduced: '15.0'
+payloadkeys:
+- key: Version
+  title: Protocol Version
+  type: <string>
+  presence: required
+  content: The server's protocol version.
+- key: SupportedFeatures
+  title: Supported Features
+  type: <dictionary>
+  presence: required
+  content: |-
+    A dictionary that contains the server's optional protocol features.
+    Each dictionary item uses the key name to represent a feature, and the value to hold the feature's associated parameters. This protocol reserves keys with a prefix of “'com.apple.'”, which appear as subkeys in this dictionary.
+  subkeys:
+  - key: ANY
+    type: <any>
+    presence: optional
+    content: Additional keys may be present.