title: Managed Application Attributes Command
description: Query attributes in managed apps on a device.
payload:
  requesttype: ManagedApplicationAttributes
  supportedOS:
    iOS:
      introduced: '7.0'
      accessrights: AllowAppInstallation
      supervised: false
      requiresdep: false
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: n/a
    tvOS:
      introduced: '10.2'
      accessrights: AllowAppInstallation
      supervised: false
    visionOS:
      introduced: '1.1'
      accessrights: AllowAppInstallation
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '10.0'
      accessrights: AllowAppInstallation
      supervised: false
payloadkeys:
- key: Identifiers
  type: <array>
  presence: required
  content: |-
    The bundle identifiers of the managed apps.

    > Important:
    > For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
  subkeys:
  - key: IdentifiersItem
    type: <string>
responsekeys:
- key: ApplicationAttributes
  type: <array>
  presence: required
  content: An array of app attribute items.
  subkeys:
  - key: ApplicationAttributesItem
    type: <dictionary>
    content: A dictionary that contains a managed app attributes item.
    subkeys:
    - key: Identifier
      type: <string>
      presence: required
      content: |-
        The app's bundle identifier.

        > Note:
        > For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
    - key: Attributes
      type: <dictionary>
      presence: optional
      content: The app's attributes.
      subkeys:
      - key: VPNUUID
        supportedOS:
          tvOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: A per-app VPN unique identifier for this app.
      - key: ContentFilterUUID
        supportedOS:
          iOS:
            introduced: '16.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: The content Filter UUID assigned to this app.
      - key: DNSProxyUUID
        supportedOS:
          iOS:
            introduced: '16.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: The DNS Proxy UUID assigned to this app.
      - key: RelayUUID
        supportedOS:
          iOS:
            introduced: '17.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: The relay UUID for this app.
      - key: AssociatedDomains
        supportedOS:
          iOS:
            introduced: '13.0'
          tvOS:
            introduced: n/a
        type: <array>
        presence: optional
        content: This app's associated domains.
        subkeys:
        - key: AssociatedDomain
          type: <string>
      - key: AssociatedDomainsEnableDirectDownloads
        supportedOS:
          iOS:
            introduced: '14.0'
          tvOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: false
        content: If `true`, perform claimed site association verification directly
          at the domain instead of on Apple's servers. Only set this to `true` for
          domains that can't access the internet.
      - key: Removable
        supportedOS:
          iOS:
            introduced: '14.0'
          tvOS:
            introduced: '14.0'
        type: <boolean>
        presence: optional
        default: true
        content: If `false`, this app isn't removable while it's a managed app.
      - key: TapToPayScreenLock
        supportedOS:
          iOS:
            introduced: '16.4'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: false
        content: If `true`, Tap to Pay on iPhone requires users to use Face ID or
          a passcode to unlock their device after every transaction that requires
          a customer's card PIN. If `false`, the user can configure this setting on
          their device.
      - key: CellularSliceUUID
        supportedOS:
          iOS:
            introduced: '17.0'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: The data network name (DNN) or app category. For DNN, the value is
          `DNN:name`, where `name` is the carrier-provided DNN name. For app category,
          the value is `AppCategory:category`, where `category` is a carrier-provided
          string like "Enterprise1".
      - key: Hideable
        supportedOS:
          iOS:
            introduced: '18.1'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: true
        content: If `false`, the system prevents the user from hiding the app. It
          doesn't affect the user's ability to leave it in the App Library, while
          removing it from the Home Screen.
      - key: Lockable
        supportedOS:
          iOS:
            introduced: '18.1'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: true
        content: If `false`, the system prevents the user from locking the app. This
          also prevents the user from hiding the app.
notes:
- title: ''
  content: |-
    This command allows the server to get attributes of managed apps.

    The response doesn't include apps that Declarative Device Management is managing.

    Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
  files:
  - request-file: examples/mdm/commands/managed.application.attributes/example1.plist
    response-file: examples/mdm/commands/managed.application.attributes/example2.plist