apple_device-management/mdm/commands/managed.application.attributes.yaml

title: Managed Application Attributes Command
description: Queries managed application attributes. Attributes can be set on managed
  apps. These attributes can be changed over time.
payload:
  requesttype: ManagedApplicationAttributes
  supportedOS:
    iOS:
      introduced: '7.0'
      accessrights: AllowAppInstallation
      supervised: false
      requiresdep: false
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: n/a
    tvOS:
      introduced: '10.2'
      accessrights: AllowAppInstallation
      supervised: false
    visionOS:
      introduced: '1.1'
      accessrights: AllowAppInstallation
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '10.0'
      accessrights: AllowAppInstallation
      supervised: false
  content: Queries managed application attributes. Attributes can be set on managed
    apps. These attributes can be changed over time. The response will not include
    apps that are managed by Declarative Device Management.
payloadkeys:
- key: Identifiers
  type: <array>
  presence: required
  content: |-
    The bundle identifiers of the managed apps.
    For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the 'watchBundleId' key that's part of the Content Metadata query. For more information on this query, see Getting App and Book Information (Legacy).
  subkeys:
  - key: IdentifiersItem
    type: <string>
responsekeys:
- key: ApplicationAttributes
  type: <array>
  presence: required
  content: An array of app attributes items.
  subkeys:
  - key: ApplicationAttributesItem
    type: <dictionary>
    subkeys:
    - key: Identifier
      type: <string>
      presence: required
      content: |-
        The app's bundle identifier.
        For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired.
    - key: Attributes
      type: <dictionary>
      presence: optional
      content: The app's attributes.
      subkeys:
      - key: VPNUUID
        supportedOS:
          tvOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: A per-app VPN unique identifier for this app.
      - key: ContentFilterUUID
        supportedOS:
          iOS:
            introduced: '16.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: |-
          The content Filter UUID assigned to this app.
          Available in iOS 16 and later.
      - key: DNSProxyUUID
        supportedOS:
          iOS:
            introduced: '16.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: |-
          The DNS Proxy UUID assigned to this app.
          Available in iOS 16 and later.
      - key: RelayUUID
        supportedOS:
          iOS:
            introduced: '17.0'
          tvOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: The relay UUID for this app.
      - key: AssociatedDomains
        supportedOS:
          iOS:
            introduced: '13.0'
          tvOS:
            introduced: n/a
        type: <array>
        presence: optional
        content: This app's associated domains. This value is available in iOS 13
          and later.
        subkeys:
        - key: AssociatedDomain
          type: <string>
      - key: AssociatedDomainsEnableDirectDownloads
        supportedOS:
          iOS:
            introduced: '14.0'
          tvOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: false
        content: If 'true', perform claimed site association verification directly
          at the domain instead of on Apple's servers. Only set this to 'true' for
          domains that can't access the internet. This value is available in iOS 14
          and later.
      - key: Removable
        supportedOS:
          iOS:
            introduced: '14.0'
          tvOS:
            introduced: '14.0'
        type: <boolean>
        presence: optional
        default: true
        content: If 'false', this app isn't removable while it's a managed app. This
          value is available in iOS 14 and later.
      - key: TapToPayScreenLock
        supportedOS:
          iOS:
            introduced: '16.4'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: false
        content: Enabling this setting will require Tap to Pay on iPhone users to
          use Face ID or a passcode to unlock their device after every transaction
          that requires a customer’s card PIN. Disabling this setting will allow users
          to configure this setting on their device based on personal preference.
      - key: CellularSliceUUID
        supportedOS:
          iOS:
            introduced: '17.0'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <string>
        presence: optional
        content: Either data network name (DNN) or traffic category can be set as
          the enterprise slice identifier. For DNN, the value must be encoded as "DNN:name”,
          where "name" is the carrier provided DNN name. For app category, the value
          must be encoded as "AppCategory:category", where "category" is a carrier
          provided string like "Enterprise1".
      - key: Hideable
        supportedOS:
          iOS:
            introduced: '18.1'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: true
        content: If set to false, the user is prevented from hiding the app. It does
          not affect the user's ability to leave it in the App Library, while removing
          it from the home screen.
      - key: Lockable
        supportedOS:
          iOS:
            introduced: '18.1'
          tvOS:
            introduced: n/a
          visionOS:
            introduced: n/a
          watchOS:
            introduced: n/a
        type: <boolean>
        presence: optional
        default: true
        content: If set to false, the user is prevented from locking the app. Because
          hiding an app also requires locking it, disallowing the user from locking
          the app will also prevent the user from hiding it.