# Apple Device Policy Explorer

> A read-only, hourly-refreshed mirror of Apple's official device-management
> definitions (github.com/apple/device-management): MDM Configuration Profile
> payloads and Declarative Device Management (DDM) declarations, with per-OS
> version availability. Use this to design or troubleshoot Apple MDM/DDM policies
> with accurate payload types, keys, and OS support — instead of guessing.

## Dataset summary (branch: release)

- Total policies: 174 (127 MDM Configuration Profiles, 47 Declarative declarations)
- Supported platforms:
  - iOS (latest 26.4): 98 payloads
  - macOS (latest 26.4): 158 payloads
  - tvOS (latest 26.0): 23 payloads
  - watchOS (latest 26.4): 16 payloads
  - visionOS (latest 26.4): 34 payloads
- Source: github.com/apple/device-management, mirrored hourly
- Data last updated: 2026-06-12T20:54:04.341Z
- Branches available: release, seed_OS_27_0 (default: release)

## How to use this data (search → drill down)

1. Search for relevant payloads with `GET /api/search` (compact results).
2. Take a result's `payloadType` and fetch the full record (every key, type,
   default, per-OS introduced/deprecated version) with `GET /api/policy/{payloadType}`.

A machine-readable OpenAPI 3.1 contract is at https://appledevicepolicy.tools/openapi.json
(also at https://appledevicepolicy.tools/.well-known/openapi.json).
A full one-line-per-policy index is at https://appledevicepolicy.tools/llms-full.txt

## Endpoints

### GET /api/search
Compact, filtered, paginated search. Returns small rows plus a `detailUrl`.
Query parameters:
- `q`        free text; case-insensitive substring match over title, description, payloadType, and keys
- `os`       one of iOS, macOS, tvOS, watchOS, visionOS
- `category` `mdm` (Configuration Profile) or `ddm` (Declarative)
- `status`   `new` or `deprecated`
- `branch`   defaults to `release`
- `limit`    default 25, max 100
- `offset`   default 0
Response: `{ query, branch, total, limit, offset, count, results[] }` where each
result is `{ payloadType, title, description, category, supportedOS[], keyCount,
isNew, isDeprecated, detailUrl, matchedKeys?, matchedKeyCount? }`.

### GET /api/policy/{payloadType}
The full policy definition for one payload: all keys with types, defaults,
descriptions, and per-OS introduced/deprecated versions. `?branch=` optional.
This is the authoritative record to use when generating a policy.

### GET /api/policies
The entire policy list for a branch (heavy — includes all keys). Prefer
/api/search for normal use. `?branch=` optional.

## Worked examples

Find Wi-Fi related payloads on macOS:
```
curl "https://appledevicepolicy.tools/api/search?q=wifi&os=macOS&limit=5"
```

Find what's new in Declarative Device Management:
```
curl "https://appledevicepolicy.tools/api/search?status=new&category=ddm"
```

Drill into the passcode payload for full keys and version availability:
```
curl "https://appledevicepolicy.tools/api/policy/com.apple.mobiledevice.passwordpolicy?branch=release"
```

## Notes

- Matching is case-insensitive substring (not fuzzy/semantic). Try specific
  terms (e.g. "passcode", "firewall", "softwareupdate") and the payloadType.
- Data tracks Apple's repo and refreshes hourly; "new"/"deprecated" flags are
  computed against each branch's latest discovered OS versions.
- This service mirrors Apple's published definitions; always validate generated
  profiles against the target OS versions.