apple_device-management/mdm/checkin/declarativemanagement.yaml

title: Declarative Management
description: Sends declarative management requests to the server.
payload:
  requesttype: DeclarativeManagement
  supportedOS:
    iOS:
      introduced: '15.0'
      supervised: false
      requiresdep: false
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: true
      userenrollment:
        mode: allowed
    macOS:
      introduced: '13.0'
      devicechannel: true
      userchannel: true
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    tvOS:
      introduced: '16.0'
      supervised: false
      requiresdep: false
    visionOS:
      introduced: '1.1'
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '10.0'
      supervised: false
      requiresdep: false
  content: Check-in protocol declarative management request and response.
payloadkeys:
- key: MessageType
  type: <string>
  presence: required
  rangelist:
  - DeclarativeManagement
  content: The message type, which requires a value of `DeclarativeManagement`.
- key: Endpoint
  type: <string>
  presence: required
  content: |-
    The type of operation the declaration is requesting. This key needs to be one of these values:

    - `tokens`: For fetching synchronization tokens from the server
    - `declaration-items`: For fetching the declaration manifest from the server
    - `status`: For sending a status report to the server
    - `declaration/…/…`: For fetching a specific declaration from the server. Include the declaration type and identifier separated by slash characters (`/`).
- key: Data
  type: <data>
  presence: optional
  content: A Base64-encoded JSON object using the `SynchronizationTokens` schema.
- key: UDID
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: required
  content: The device's UDID (unique device identifier). The system requires this
    value if the enrollment type is a device enrollment.
- key: EnrollmentID
  supportedOS:
    iOS:
      userenrollment:
        mode: required
    macOS:
      userenrollment:
        mode: required
    tvOS:
      introduced: n/a
    visionOS:
      userenrollment:
        mode: required
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The per-enrollment identifier for the device. The system requires this
    value if the enrollment type is a user enrollment.
- key: EnrollmentUserID
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      devicechannel: false
      userenrollment:
        mode: required
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The per-enrollment identifier for the user. The system requires this value
    if the enrollment type is a user enrollment on the user channel.
- key: UserShortName
  supportedOS:
    iOS:
      sharedipad:
        mode: required
    macOS:
      devicechannel: false
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: optional
  content: |-
    For macOS, this value is the short name of the user.

    For Shared iPad, this value is the Managed Apple Account identifier of the user on Shared iPad. It indicates that the token is for the user channel.
- key: UserID
  supportedOS:
    iOS:
      sharedipad:
        mode: required
    macOS:
      devicechannel: false
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: optional
  content: |-
    For macOS, this value is the ID of the user.

    For Shared iPad, this value is `FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF` to indicate that authentication doesn't occur.
- key: UserLongName
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      devicechannel: false
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The full name of the user.
notes:
- title: ''
  content: |-
    The `Data` field is optional, depending on the `Endpoint` value, as described below:

    * `tokens`: The client uses the `tokens` endpoint to request the current synchronization tokens from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `TokensResponse` schema.
    * `declaration-items`: The client uses the `declaration-items` endpoint to request the current declaration manifest from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `DeclarationItemsResponse` schema.
    * `declaration/…/…` : The client uses the `declaration/…/…` endpoint to request a specific declaration from the server. It doesn't use the `Data` field.

    The endpoint value is a path with three segments separated by a slash character (`/`). The first segment is always `declaration`. The second segment indicates the declaration type and is one of `activation`, `asset`, `configuration`, or `management`. The third segment is the `Identifier` of the declaration to fetch.

    A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object representing the requested declaration. If the declaration isn't present on the server, it needs to return a `404 Not Found` HTTP status response to the device. That causes the device to remove any corresponding declaration that is present on it.
    * `status`: The client uses the `status` endpoint to send a status report to the server. The `Data` field needs to be present and set to a Base64-encoded JSON object conforming to the `StatusReport` schema. A successful response to this request is a `200 OK` HTTP status, with an empty response body.