The payload that configures privacy preferences.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Services Services A dictionary whose keys are limited to the privacy policy control services. In the case of conflicting specifications, the most restrictive setting (deny) is used. 24 subkeys | dictionary | required | — | ✗No | macOS (10.14+) |
└─ AddressBook AddressBook Specifies the policies for contact information managed by the Contacts.app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Calendar Calendar Specifies the policies for calendar information managed by the Calendar.app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Reminders Reminders Specifies the policies for reminders information managed by the Reminders app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Photos Photos The pictures managed by the Photos app in `~/Pictures/.photoslibrary`. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Camera Camera A system camera. Access to the camera can't be given in a profile; it can only be denied. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Microphone Microphone A system microphone. Access to the microphone can't be given in a profile; it can only be denied. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Accessibility Accessibility Specifies the policies for the app via the Accessibility subsystem. The ability to grant access by this profile is deprecated as of macOS 26.2, and will be removed in macOS 27.0. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ PostEvent PostEvent Specifies the policies for the application to use CoreGraphics APIs to send CGEvents to the system event stream. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAllFiles SystemPolicyAllFiles Allows the application access to all protected files, including system administration files. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicySysAdminFiles SystemPolicySysAdminFiles Allows the application access to some files used in system administration. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ AppleEvents AppleEvents Specifies the policies for the app sending restricted AppleEvents to another process. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ MediaLibrary MediaLibrary Allows the application to access Apple Music, music and video activity, and the media library. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ FileProviderPresence FileProviderPresence Allows a File Provider application to know when the user is using files managed by the File Provider. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ ListenEvent ListenEvent Allows the application to use CoreGraphics and HID APIs to listen to (receive) CGEvents and HID events from all processes. Access to these events can't be given in a profile; it can only be denied. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ ScreenCapture ScreenCapture Allows the application to capture (read) the contents of the system display. Access to the contents can't be given in a profile; it can only be denied. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SpeechRecognition SpeechRecognition Allows the application to use the system Speech Recognition facility and to send speech data to Apple. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDesktopFolder SystemPolicyDesktopFolder Allows the application to access files in the user's Desktop folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDocumentsFolder SystemPolicyDocumentsFolder Allows the application to access files in the user's Documents folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDownloadsFolder SystemPolicyDownloadsFolder Allows the application to access files in the user's Downloads folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyNetworkVolumes SystemPolicyNetworkVolumes Allows the application to access files on network volumes. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyRemovableVolumes SystemPolicyRemovableVolumes Allows the application to access files on removable volumes. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAppBundles SystemPolicyAppBundles Allows the application to update or delete other apps. Available in macOS 13 and later. 1 subkey | array | optional | — | ✓Yes | macOS (13.0+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAppData SystemPolicyAppData Specifies the policies for the app to access the data of other apps. 1 subkey | array | optional | — | ✓Yes | macOS (14.0+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ BluetoothAlways BluetoothAlways Specifies the policies for the app to access Bluetooth devices. 1 subkey | array | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtained via the command `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
