profiles

type ACMECertificate struct {
	// The directory URL of the ACME server. The URL must use the https scheme.
	DirectoryURL string `plist:"DirectoryURL" json:"DirectoryURL"`
	// A unique string identifying a specific device. The server may use this as an anti-replay
	// code to prevent issuing multiple certificates. This identifier also indicates to the
	// ACME server that the device has access to a valid client identifier issued by the
	// enterprise infrastructure. This can help the ACME server determine whether to trust the
	// device. Though this is a relatively weak indication because of the risk that an attacker
	// can intercept the client identifier.
	ClientIdentifier string `plist:"ClientIdentifier" json:"ClientIdentifier"`
	// The valid values for `KeySize` depend on the values of `KeyType` and `HardwareBound`.
	// See those keys for specific requirements.
	KeySize int64 `plist:"KeySize" json:"KeySize"`
	// The type of key pair to generate. Allowed values:
	KeyType string `plist:"KeyType" json:"KeyType"`
	// If `false`, the private key isn't bound to the device.
	HardwareBound bool `plist:"HardwareBound" json:"HardwareBound"`
	// The device requests this subject for the certificate that the ACME server issues. The
	// ACME server may override or ignore this field in the certificate it issues.
	Subject [][][]string `plist:"Subject,omitempty" json:"Subject,omitempty"`
	// The Subject Alt Name that the device requests for the certificate that the ACME server
	// issues. The ACME server may override or ignore this field in the certificate it issues.
	SubjectAltName *ACMECertificateSubjectAltName `plist:"SubjectAltName,omitempty" json:"SubjectAltName,omitempty"`
	// This value is a bit field.
	UsageFlags *int64 `plist:"UsageFlags,omitempty" json:"UsageFlags,omitempty"`
	// The value is an array of strings. Each string is an OID in dotted notation. For
	// instance, `["1.3.6.1.5.5.7.3.2", "1.3.6.1.5.5.7.3.4"]` indicates client authentication
	// and email protection.
	ExtendedKeyUsage []string `plist:"ExtendedKeyUsage,omitempty" json:"ExtendedKeyUsage,omitempty"`
	// If `true`, the device provides attestations that describe the device and the generated
	// key to the ACME server. The server can use the attestations as strong evidence that the
	// key is bound to the device, and that the device has properties listed in the
	// attestation. The server can use that as part of a trust score to decide whether to issue
	// the requested certificate.
	Attest *bool `plist:"Attest,omitempty" json:"Attest,omitempty"`
	// If `true`, the private key of the identity obtained through Automated Certificate
	// Management Environment (ACME) needs to be tagged as "non-extractable" in the keychain.
	KeyIsExtractable *bool `plist:"KeyIsExtractable,omitempty" json:"KeyIsExtractable,omitempty"`
	// If `true`, all apps have access to the private key.
	AllowAllAppsAccess *bool `plist:"AllowAllAppsAccess,omitempty" json:"AllowAllAppsAccess,omitempty"`
}

type ACMECertificateSubjectAltName struct {
	// The RFC 822 (email address) string.
	Rfc822Name *string `plist:"rfc822Name,omitempty" json:"rfc822Name,omitempty"`
	// The DNS name.
	DNSName *string `plist:"dNSName,omitempty" json:"dNSName,omitempty"`
	// The Uniform Resource Identifier.
	UniformResourceIdentifier *string `plist:"uniformResourceIdentifier,omitempty" json:"uniformResourceIdentifier,omitempty"`
	// The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
	NtPrincipalName *string `plist:"ntPrincipalName,omitempty" json:"ntPrincipalName,omitempty"`
}

type AIMAccount struct {
	// The description of the account.
	AIMAccountDescription *string `plist:"AIMAccountDescription,omitempty" json:"AIMAccountDescription,omitempty"`
	// The server address.
	AIMHostName string `plist:"AIMHostName" json:"AIMHostName"`
	// The user's login name.
	AIMUserName *string `plist:"AIMUserName,omitempty" json:"AIMUserName,omitempty"`
	// The user's password.
	AIMPassword *string `plist:"AIMPassword,omitempty" json:"AIMPassword,omitempty"`
	// If `true`, enables SSL.
	AIMUseSSL *bool `plist:"AIMUseSSL,omitempty" json:"AIMUseSSL,omitempty"`
	// The connection port for the server.
	AIMPort *int64 `plist:"AIMPort,omitempty" json:"AIMPort,omitempty"`
	// The authentication method for the account.
	AIMAuthentication string `plist:"AIMAuthentication" json:"AIMAuthentication"`
}

type APN struct {
	// The list of access point names (APNs).
	DefaultsData APNDefaultsData `plist:"DefaultsData,omitempty" json:"DefaultsData,omitempty"`
	// The domain name.
	DefaultsDomainName string `plist:"DefaultsDomainName" json:"DefaultsDomainName"`
}

type APNDefaultsData struct {
	// An array of APN dictionaries (\`APN.DefaultsData.Apns\`).
	Apns []APNDefaultsDataApns `plist:"apns,omitempty" json:"apns,omitempty"`
}

type APNDefaultsDataApns struct {
	// The access point name.
	Apn string `plist:"apn" json:"apn"`
	// The user name. If missing, the device prompts for it during profile installation.
	Username *string `plist:"username,omitempty" json:"username,omitempty"`
	// The password for the user. For obfuscation purposes, the system encodes the password. If
	// missing, the device prompts for the password during profile installation.
	Password []byte `plist:"password,omitempty" json:"password,omitempty"`
	// The IP address or URL of the APN proxy.
	Proxy *string `plist:"proxy,omitempty" json:"proxy,omitempty"`
	// The port number of the APN proxy.
	ProxyPort *int64 `plist:"proxyPort,omitempty" json:"proxyPort,omitempty"`
}

type Accessibility struct {
	// The minimum zoom level in the Zoom options.
	CloseViewFarPoint *int64 `plist:"closeViewFarPoint,omitempty" json:"closeViewFarPoint,omitempty"`
	// If `true`, enables "Use keyboard shortcuts" in the Zoom options.
	CloseViewHotkeysEnabled *bool `plist:"closeViewHotkeysEnabled,omitempty" json:"closeViewHotkeysEnabled,omitempty"`
	// The maximum zoom level in the Zoom options.
	CloseViewNearPoint *int64 `plist:"closeViewNearPoint,omitempty" json:"closeViewNearPoint,omitempty"`
	// If `true`, enables "Use scroll gesture" in the Zoom options.
	CloseViewScrollWheelToggle *bool `plist:"closeViewScrollWheelToggle,omitempty" json:"closeViewScrollWheelToggle,omitempty"`
	// If `true`, enables "Show preview rectangle" in the Zoom options. Only available in macOS
	// 10.15 and earlier.
	CloseViewShowPreview *bool `plist:"closeViewShowPreview,omitempty" json:"closeViewShowPreview,omitempty"`
	// If `true`, enables "Smooth images" in the Zoom options.
	CloseViewSmoothImages *bool `plist:"closeViewSmoothImages,omitempty" json:"closeViewSmoothImages,omitempty"`
	// The contrast value in the Display options.
	Contrast *float64 `plist:"contrast,omitempty" json:"contrast,omitempty"`
	// If `true`, enables "Flash the screen" in the Audio options.
	FlashScreen *bool `plist:"flashScreen,omitempty" json:"flashScreen,omitempty"`
	// If `true`, enables "Use grayscale" in the Display options.
	Grayscale *bool `plist:"grayscale,omitempty" json:"grayscale,omitempty"`
	// If `true`, enables Mouse Keys in the Mouse & Trackpad options.
	MouseDriver *bool `plist:"mouseDriver,omitempty" json:"mouseDriver,omitempty"`
	// The size of the cursor.
	MouseDriverCursorSize *int64 `plist:"mouseDriverCursorSize,omitempty" json:"mouseDriverCursorSize,omitempty"`
	// If `true`, ignores the built-in trackpad.
	MouseDriverIgnoreTrackpad *bool `plist:"mouseDriverIgnoreTrackpad,omitempty" json:"mouseDriverIgnoreTrackpad,omitempty"`
	// The initial delay before moving the mouse with Mouse Keys.
	MouseDriverInitialDelay *int64 `plist:"mouseDriverInitialDelay,omitempty" json:"mouseDriverInitialDelay,omitempty"`
	// The maximum speed for the cursor when using Mouse Keys.
	MouseDriverMaxSpeed *int64 `plist:"mouseDriverMaxSpeed,omitempty" json:"mouseDriverMaxSpeed,omitempty"`
	// If `true`, enables "Slow Keys" in the Keyboard options.
	SlowKey *bool `plist:"slowKey,omitempty" json:"slowKey,omitempty"`
	// If `true`, enables "click key sounds" for Slow Keys.
	SlowKeyBeepOn *bool `plist:"slowKeyBeepOn,omitempty" json:"slowKeyBeepOn,omitempty"`
	// The acceptance delay, in milliseconds, for Slow Keys.
	SlowKeyDelay *int64 `plist:"slowKeyDelay,omitempty" json:"slowKeyDelay,omitempty"`
	// If `true`, plays stereo audio as mono.
	StereoAsMono *bool `plist:"stereoAsMono,omitempty" json:"stereoAsMono,omitempty"`
	// If `true`, enables Sticky Keys in the Keyboard options.
	StickyKey *bool `plist:"stickyKey,omitempty" json:"stickyKey,omitempty"`
	// If `true`, enables the beep when a modifier key is set for Sticky Keys.
	StickyKeyBeepOnModifier *bool `plist:"stickyKeyBeepOnModifier,omitempty" json:"stickyKeyBeepOnModifier,omitempty"`
	// If `true`, enables "Display pressed keys on screen" for Sticky Keys.
	StickyKeyShowWindow *bool `plist:"stickyKeyShowWindow,omitempty" json:"stickyKeyShowWindow,omitempty"`
	// If `true`, enables Voice Over.
	VoiceOverOnOffKey *bool `plist:"voiceOverOnOffKey,omitempty" json:"voiceOverOnOffKey,omitempty"`
	// If `true`, enables Invert Colors in Display Accommodations.
	WhiteOnBlack *bool `plist:"whiteOnBlack,omitempty" json:"whiteOnBlack,omitempty"`
}

type Accounts struct {
	// If `true`, the system enables the guest account.
	EnableGuestAccount *bool `plist:"EnableGuestAccount,omitempty" json:"EnableGuestAccount,omitempty"`
	// If `true`, the system disables the guest account. This property has no effect if
	// `EnableGuestAccount` is `true`.
	DisableGuestAccount *bool `plist:"DisableGuestAccount,omitempty" json:"DisableGuestAccount,omitempty"`
}

type ActiveDirectoryCertificate struct {
	// The fully qualified host name of the CA.
	CertServer string `plist:"CertServer" json:"CertServer"`
	// The certificate template for your environment. The default user certificate value is
	// \`User\`. The default computer certificate value is \`Machine\`.
	CertTemplate string `plist:"CertTemplate" json:"CertTemplate"`
	// A user-friendly description of the certification identity.
	Description *string `plist:"Description,omitempty" json:"Description,omitempty"`
	// The number of days in advance of certificate expiration that the notification center
	// notifies the user.
	CertificateRenewalTimeInterval *int64 `plist:"CertificateRenewalTimeInterval,omitempty" json:"CertificateRenewalTimeInterval,omitempty"`
	// The name of the certificate authority (CA), which is determined from the common name
	// (CN) of the Active Directory entry. Available in macOS 10.8 and later. Valid values:
	CertificateAuthority *string `plist:"CertificateAuthority,omitempty" json:"CertificateAuthority,omitempty"`
	// This value is most commonly `RPC`; if using web enrollment, use `HTTP`. Available in
	// macOS 10.8 and later.
	CertificateAcquisitionMechanism *string `plist:"CertificateAcquisitionMechanism,omitempty" json:"CertificateAcquisitionMechanism,omitempty"`
	// If `true`, gives apps access to the private key. Available in macOS 10.10 and later.
	AllowAllAppsAccess *bool `plist:"AllowAllAppsAccess,omitempty" json:"AllowAllAppsAccess,omitempty"`
	// If `true`, the system prompts the user for credentials when is installs the profile.
	// This key applies only to user certificates with the Manual Download profile delivery
	// method. Omit this key for computer certificates. Available in macOS 10.8 and later.
	PromptForCredentials *bool `plist:"PromptForCredentials,omitempty" json:"PromptForCredentials,omitempty"`
	// If `true`, the system allows exporting the private key. Available in macOS 10.10 and
	// later.
	KeyIsExtractable *bool `plist:"KeyIsExtractable,omitempty" json:"KeyIsExtractable,omitempty"`
	// The RSA key size for the certificate signing request (CSR). Available in macOS 10.11 and
	// later.
	Keysize *int64 `plist:"Keysize,omitempty" json:"Keysize,omitempty"`
	// If `true`, the certificate obtained with this payload attempts auto-renewal.
	// Auto-renewal can only be used with device Active Directory certificate payloads.
	// Available in macOS 10.13.4 and later.
	EnableAutoRenewal *bool `plist:"EnableAutoRenewal,omitempty" json:"EnableAutoRenewal,omitempty"`
}

type AirPlay struct {
	// If present, only AirPlay destinations in this list are available to the device. This
	// allow list applies to supervised devices.
	AllowList []AirPlayAllowList `plist:"AllowList,omitempty" json:"AllowList,omitempty"`
	// If present, sets passwords for known AirPlay destinations. Using multiple entries for
	// the same destination, whether within the same payload or across multiple installed
	// payloads, is an error and results in undefined behavior.
	Passwords []AirPlayPasswords `plist:"Passwords,omitempty" json:"Passwords,omitempty"`
	// Use `AllowList` instead. This key is deprecated in iOS 14.5 and macOS 11.3.
	Whitelist []AirPlayWhitelist `plist:"Whitelist,omitempty" json:"Whitelist,omitempty"`
}

type AirPlayAllowList struct {
	// The device ID of the AirPlay destination in the format `xx:xx:xx:xx:xx:xx`. This field
	// isn't case-sensitive.
	DeviceID *string `plist:"DeviceID,omitempty" json:"DeviceID,omitempty"`
	// The name of the AirPlay device.
	DeviceName *string `plist:"DeviceName,omitempty" json:"DeviceName,omitempty"`
}

type AirPlayPasswords struct {
	// The name of the AirPlay destination; used in iOS, and available in macOS 15 and later.
	DeviceName *string `plist:"DeviceName,omitempty" json:"DeviceName,omitempty"`
	// The password for the AirPlay destination.
	Password string `plist:"Password" json:"Password"`
	// The device ID of the AirPlay destination; used in macOS.
	DeviceID *string `plist:"DeviceID,omitempty" json:"DeviceID,omitempty"`
}

type AirPlaySecurity struct {
	// The security policy for AirPlay. Allowed values:
	SecurityType string `plist:"SecurityType" json:"SecurityType"`
	// The access policy for AirPlay.
	AccessType string `plist:"AccessType" json:"AccessType"`
	// The AirPlay password; required if `SecurityType` is `PASSWORD`.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
}

type AirPlayWhitelist struct {
	// The device ID of the AirPlay destination in the format `xx:xx:xx:xx:xx:xx`. This field
	// isn't case-sensitive.
	DeviceID *string `plist:"DeviceID,omitempty" json:"DeviceID,omitempty"`
	// The name of the AirPlay device.
	DeviceName *string `plist:"DeviceName,omitempty" json:"DeviceName,omitempty"`
}

type AirPrint struct {
	// An array of AirPrint printers that are presented to the user.
	AirPrint []AirPrintAirPrint `plist:"AirPrint,omitempty" json:"AirPrint,omitempty"`
}

type AirPrintAirPrint struct {
	// The IP address or hostname of the AirPrint destination.
	IPAddress string `plist:"IPAddress" json:"IPAddress"`
	// The resource path associated with the printer. This path corresponds to the `rp`
	// parameter of the `_ipps.tcp` Bonjour record. For example:
	ResourcePath string `plist:"ResourcePath" json:"ResourcePath"`
	// The listening port of the AirPrint destination. Available only in iOS 11 and later.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// If `true`, AirPrint connections are secured by Transport Layer Security (TLS). Available
	// only in iOS 11 and later.
	ForceTLS *bool `plist:"ForceTLS,omitempty" json:"ForceTLS,omitempty"`
}

type AppLayerVPN struct {
	// A globally unique identifier for this VPN configuration.
	VPNUUID string `plist:"VPNUUID" json:"VPNUUID"`
	// A string representing the data network name (DNN) or app category identifying a Cellular
	// Slice. The device forces the VPN tunnel to use the specified Cellular Slice.
	CellularSliceUUID *string `plist:"CellularSliceUUID,omitempty" json:"CellularSliceUUID,omitempty"`
	// An array with entries that must each specify a domain that triggers the VPN connection
	// in Safari. Each entry is in the format `www.apple.com`.
	SafariDomains []string `plist:"SafariDomains,omitempty" json:"SafariDomains,omitempty"`
	// An array with entries that must each specify a domain that triggers this VPN connection
	// in Mail. Each entry is in the format `www.apple.com`.
	MailDomains []string `plist:"MailDomains,omitempty" json:"MailDomains,omitempty"`
	// An array with entries that must each specify a domain that triggers this VPN connection
	// in Calendar. Each entry is in the format `www.apple.com`.
	CalendarDomains []string `plist:"CalendarDomains,omitempty" json:"CalendarDomains,omitempty"`
	// An array with entries that must each specify a domain that triggers this VPN connection
	// in Contacts. Each entry is in the format `www.apple.com`.
	ContactsDomains []string `plist:"ContactsDomains,omitempty" json:"ContactsDomains,omitempty"`
	// An array with entries that must each specify a domain that triggers this VPN. The
	// domains must also be part of the `apple-app-site-association` file, as described in
	// `Supporting associated domains`.
	AssociatedDomains []string `plist:"AssociatedDomains,omitempty" json:"AssociatedDomains,omitempty"`
	// An array with entries that each specify a domain that doesn't trigger this VPN for
	// connections to the domain.
	ExcludedDomains []string `plist:"ExcludedDomains,omitempty" json:"ExcludedDomains,omitempty"`
	// If `true`, automatically connects the VPN when associated apps for this per-app VPN
	// service initiate network communication. Otherwise, the user must initiate the connection
	// manually before those apps can initiate network communication. If this key isn't
	// present, the value of the `OnDemandEnabled` key determines the status of per-app VPN On
	// Demand.
	OnDemandMatchAppEnabled *bool `plist:"OnDemandMatchAppEnabled,omitempty" json:"OnDemandMatchAppEnabled,omitempty"`
	// An array of SMB domains that's accessible through this VPN connection.
	SMBDomains []string `plist:"SMBDomains,omitempty" json:"SMBDomains,omitempty"`
}

type AppLock struct {
	// A dictionary that contains information about the app.
	App AppLockApp `plist:"App,omitempty" json:"App,omitempty"`
}

type AppLockApp struct {
	// The app's bundle identifier.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// A dictionary of options that the user can't change.
	Options *AppLockAppOptions `plist:"Options,omitempty" json:"Options,omitempty"`
	// A dictionary of user-editable options.
	UserEnabledOptions *AppLockAppUserEnabledOptions `plist:"UserEnabledOptions,omitempty" json:"UserEnabledOptions,omitempty"`
}

type AppLockAppOptions struct {
	// If `true`, the system disables the touch screen. In tvOS, it disables the touch surface
	// on the Apple TV Remote.
	DisableTouch *bool `plist:"DisableTouch,omitempty" json:"DisableTouch,omitempty"`
	// If `true`, the system disables device rotation sensing.
	DisableDeviceRotation *bool `plist:"DisableDeviceRotation,omitempty" json:"DisableDeviceRotation,omitempty"`
	// If `true`, the system disables the volume buttons.
	DisableVolumeButtons *bool `plist:"DisableVolumeButtons,omitempty" json:"DisableVolumeButtons,omitempty"`
	// If `true`, the system disables the ringer switch. When disabled, the ringer behavior
	// depends on what position the switch was in when it was first disabled.
	DisableRingerSwitch *bool `plist:"DisableRingerSwitch,omitempty" json:"DisableRingerSwitch,omitempty"`
	// If `true`, the system disables the sleep/wake button.
	DisableSleepWakeButton *bool `plist:"DisableSleepWakeButton,omitempty" json:"DisableSleepWakeButton,omitempty"`
	// If `true`, the device doesn't automatically go to sleep after an idle period.
	DisableAutoLock *bool `plist:"DisableAutoLock,omitempty" json:"DisableAutoLock,omitempty"`
	// If `true`, the system enables VoiceOver.
	EnableVoiceOver *bool `plist:"EnableVoiceOver,omitempty" json:"EnableVoiceOver,omitempty"`
	// If `true`, the system enables Zoom.
	EnableZoom *bool `plist:"EnableZoom,omitempty" json:"EnableZoom,omitempty"`
	// If `true`, the system enables Invert Colors.
	EnableInvertColors *bool `plist:"EnableInvertColors,omitempty" json:"EnableInvertColors,omitempty"`
	// If `true`, the system enables AssistiveTouch.
	EnableAssistiveTouch *bool `plist:"EnableAssistiveTouch,omitempty" json:"EnableAssistiveTouch,omitempty"`
	// If `true`, the system enables Speak Selection.
	EnableSpeakSelection *bool `plist:"EnableSpeakSelection,omitempty" json:"EnableSpeakSelection,omitempty"`
	// If `true`, the system enables Mono Audio.
	EnableMonoAudio *bool `plist:"EnableMonoAudio,omitempty" json:"EnableMonoAudio,omitempty"`
	// If `true`, the system enables Voice Control.
	EnableVoiceControl *bool `plist:"EnableVoiceControl,omitempty" json:"EnableVoiceControl,omitempty"`
}

type AppLockAppUserEnabledOptions struct {
	// If `true`, the system allows the user to toggle Voice Control.
	VoiceControl *bool `plist:"VoiceControl,omitempty" json:"VoiceControl,omitempty"`
	// If `true`, the system allows the user to toggle VoiceOver.
	VoiceOver *bool `plist:"VoiceOver,omitempty" json:"VoiceOver,omitempty"`
	// If `true`, the system allows the user to toggle Zoom.
	Zoom *bool `plist:"Zoom,omitempty" json:"Zoom,omitempty"`
	// If `true`, the system allows the user to toggle Invert Colors.
	InvertColors *bool `plist:"InvertColors,omitempty" json:"InvertColors,omitempty"`
	// If `true`, the system allows the user to toggle AssistiveTouch.
	AssistiveTouch *bool `plist:"AssistiveTouch,omitempty" json:"AssistiveTouch,omitempty"`
}

type AppStore struct {
	// If `true`, the system restricts app installations to admin users only. Deprecated in
	// macOS 10.14. Use the `com.apple.SoftwareUpdate` payload key
	// `restrict-software-update-require-admin-to-install` instead.
	RestrictStoreRequireAdminToInstall *bool `plist:"restrict-store-require-admin-to-install,omitempty" json:"restrict-store-require-admin-to-install,omitempty"`
	// If `true`, the system prevents App Store from launching. Available in macOS 10.14 and
	// later. Restricts installations to software updates only in macOS 10.10 through 10.13.
	RestrictStoreSoftwareupdateOnly *bool `plist:"restrict-store-softwareupdate-only,omitempty" json:"restrict-store-softwareupdate-only,omitempty"`
	// If `true`, the system disables app adoption by users. Available in macOS 10.10 and
	// later.
	RestrictStoreDisableAppAdoption *bool `plist:"restrict-store-disable-app-adoption,omitempty" json:"restrict-store-disable-app-adoption,omitempty"`
	// If `true`, the system disables software update notifications. Available in macOS 10.10
	// and later.
	DisableSoftwareUpdateNotifications *bool `plist:"DisableSoftwareUpdateNotifications,omitempty" json:"DisableSoftwareUpdateNotifications,omitempty"`
}

type AppToAppLayerVPNMapping struct {
	// The array of VPN mapping dictionaries.
	AppLayerVPNMapping []AppToAppLayerVPNMappingAppLayerVPNMapping `plist:"AppLayerVPNMapping,omitempty" json:"AppLayerVPNMapping,omitempty"`
}

type AppToAppLayerVPNMappingAppLayerVPNMapping struct {
	// The bundle identifier of the app using the per-app VPN.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// The identifier of the per-app VPN payload, which defines the per-app VPN that the app
	// uses. See the `VPNUUID` key of the `AppLayerVPN` payload.
	VPNUUID string `plist:"VPNUUID" json:"VPNUUID"`
	// The code signature designated requirement of the app using the per-app VPN.
	DesignatedRequirement string `plist:"DesignatedRequirement" json:"DesignatedRequirement"`
	// The code signature signing identifier of the app using the per-app VPN.
	SigningIdentifier string `plist:"SigningIdentifier" json:"SigningIdentifier"`
	// The file-system path of the executable using the per-app VPN.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
	// An array of dictionaries. Each dictionary specifies a per-app VPN rule. Use this
	// property to restrict this per-app VPN rule to only match the app's spawned _helper tool_
	// network traffic.
	MatchTools []AppToAppLayerVPNMappingAppLayerVPNMappingMatchTools `plist:"MatchTools,omitempty" json:"MatchTools,omitempty"`
}

type AppToAppLayerVPNMappingAppLayerVPNMappingMatchTools struct {
	// The code signature designated requirement of the command-line tool using the per-app
	// VPN.
	DesignatedRequirement string `plist:"DesignatedRequirement" json:"DesignatedRequirement"`
	// The code signature signing identifier of the command-line tool using the per-app VPN.
	SigningIdentifier string `plist:"SigningIdentifier" json:"SigningIdentifier"`
	// The file-system path of the command-line tool using the per-app VPN.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
}

type AssociatedDomains struct {
	// A dictionary that maps apps to their associated domains.
	Configuration []AssociatedDomainsConfiguration `plist:"Configuration,omitempty" json:"Configuration,omitempty"`
}

type AssociatedDomainsConfiguration struct {
	// The app identifier to associate the domains with.
	ApplicationIdentifier string `plist:"ApplicationIdentifier" json:"ApplicationIdentifier"`
	// The domains to associate with the app. Each string is in the form of `service:domain`.
	// Use fully qualified hostnames, such as `www.example.com`. See `Supporting associated
	// domains` for more information.
	AssociatedDomains []string `plist:"AssociatedDomains,omitempty" json:"AssociatedDomains,omitempty"`
	// If `true`, the system enables direct download of data for this domain instead of through
	// a CDN. Set the entitlement value for this domain to `service:domain?mode=managed`;
	// otherwise, the system ignores this value. Available in macOS 11 and later.
	EnableDirectDownloads *bool `plist:"EnableDirectDownloads,omitempty" json:"EnableDirectDownloads,omitempty"`
}

type AutonomousSingleAppMode struct {
	// An array of dictionaries that specifies the apps that the system grants access to the
	// Accessibility APIs.
	AllowedApplications []AutonomousSingleAppModeAllowedApplications `plist:"AllowedApplications,omitempty" json:"AllowedApplications,omitempty"`
}

type AutonomousSingleAppModeAllowedApplications struct {
	// The unique bundle identifier. If two dictionaries contain the same `BundleIdentifier`
	// value but a different `TeamIdentifier` value, an error occurs and the profile won't be
	// installed.
	BundleIdentifier string `plist:"BundleIdentifier" json:"BundleIdentifier"`
	// The developer's team identifier that the system used when it signed the app.
	TeamIdentifier string `plist:"TeamIdentifier" json:"TeamIdentifier"`
}

type CalDAV struct {
	// The description of the account.
	CalDAVAccountDescription *string `plist:"CalDAVAccountDescription,omitempty" json:"CalDAVAccountDescription,omitempty"`
	// The server's address.
	CalDAVHostName string `plist:"CalDAVHostName" json:"CalDAVHostName"`
	// The user name for logins. If this profile is part of a non-interactive install, the
	// system requires this field.
	CalDAVUsername *string `plist:"CalDAVUsername,omitempty" json:"CalDAVUsername,omitempty"`
	// The user's password. Only use this in encrypted profiles.
	CalDAVPassword *string `plist:"CalDAVPassword,omitempty" json:"CalDAVPassword,omitempty"`
	// The base URL to the user's calendar.
	CalDAVPrincipalURL *string `plist:"CalDAVPrincipalURL,omitempty" json:"CalDAVPrincipalURL,omitempty"`
	// If `true`, the system enables SSL.
	CalDAVUseSSL *bool `plist:"CalDAVUseSSL,omitempty" json:"CalDAVUseSSL,omitempty"`
	// The server's port.
	CalDAVPort *int64 `plist:"CalDAVPort,omitempty" json:"CalDAVPort,omitempty"`
	// The VPNUUID of the per-app VPN the account uses for network communication. Available in
	// iOS 14 and later.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type CardDAV struct {
	// The description of the account.
	CardDAVAccountDescription *string `plist:"CardDAVAccountDescription,omitempty" json:"CardDAVAccountDescription,omitempty"`
	// The server's address.
	CardDAVHostName string `plist:"CardDAVHostName" json:"CardDAVHostName"`
	// The user name for logins.
	CardDAVUsername *string `plist:"CardDAVUsername,omitempty" json:"CardDAVUsername,omitempty"`
	// The user's password. Only use this in encrypted profiles.
	CardDAVPassword *string `plist:"CardDAVPassword,omitempty" json:"CardDAVPassword,omitempty"`
	// The base URL to the user's address book.
	CardDAVPrincipalURL *string `plist:"CardDAVPrincipalURL,omitempty" json:"CardDAVPrincipalURL,omitempty"`
	// If `true`, the system enables SSL.
	CardDAVUseSSL *bool `plist:"CardDAVUseSSL,omitempty" json:"CardDAVUseSSL,omitempty"`
	// The server's port.
	CardDAVPort *int64 `plist:"CardDAVPort,omitempty" json:"CardDAVPort,omitempty"`
	// An array of communication service rules for this account.
	CommunicationServiceRules *CardDAVCommunicationServiceRules `plist:"CommunicationServiceRules,omitempty" json:"CommunicationServiceRules,omitempty"`
	// The VPNUUID of the per-app VPN the account uses for network communication. Available in
	// iOS 14 and later.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type CardDAVCommunicationServiceRules struct {
	// A dictionary of service handlers for contacts from this account.
	DefaultServiceHandlers *CardDAVCommunicationServiceRulesDefaultServiceHandlers `plist:"DefaultServiceHandlers,omitempty" json:"DefaultServiceHandlers,omitempty"`
}

type CardDAVCommunicationServiceRulesDefaultServiceHandlers struct {
	// The bundle identifier for the default application that handles audio calls to contacts
	// from this account.
	AudioCall *string `plist:"AudioCall,omitempty" json:"AudioCall,omitempty"`
}

type Cellular struct {
	// A configuration dictionary.
	AttachAPN *CellularAttachAPN `plist:"AttachAPN,omitempty" json:"AttachAPN,omitempty"`
	// An array of access point name (APN) dictionaries.
	APNs []CellularAPNs `plist:"APNs,omitempty" json:"APNs,omitempty"`
}

type CellularAPNs struct {
	// The name for this configuration.
	Name string `plist:"Name" json:"Name"`
	// The authentication type for logging in.
	AuthenticationType *string `plist:"AuthenticationType,omitempty" json:"AuthenticationType,omitempty"`
	// The user name for the APN.
	Username *string `plist:"Username,omitempty" json:"Username,omitempty"`
	// The user's password for the APN.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The proxy server's address.
	ProxyServer *string `plist:"ProxyServer,omitempty" json:"ProxyServer,omitempty"`
	// The proxy server's port number.
	ProxyPort *int64 `plist:"ProxyPort,omitempty" json:"ProxyPort,omitempty"`
	// The default Internet Protocol versions. Available in iOS 10.3 but no longer used in iOS
	// 11 and later. Allowed values:
	DefaultProtocolMask *int64 `plist:"DefaultProtocolMask,omitempty" json:"DefaultProtocolMask,omitempty"`
	// The Internet Protocol versions that the system supports. Available in iOS 10.3 and
	// later. Allowed values:
	AllowedProtocolMask *int64 `plist:"AllowedProtocolMask,omitempty" json:"AllowedProtocolMask,omitempty"`
	// The Internet Protocol versions that the system supports while roaming. Available in iOS
	// 10.3 and later. Allowed values:
	AllowedProtocolMaskInRoaming *int64 `plist:"AllowedProtocolMaskInRoaming,omitempty" json:"AllowedProtocolMaskInRoaming,omitempty"`
	// The Internet Protocol versions that the system supports while roaming. Available in iOS
	// 10.3 and later. Allowed values:
	AllowedProtocolMaskInDomesticRoaming *int64 `plist:"AllowedProtocolMaskInDomesticRoaming,omitempty" json:"AllowedProtocolMaskInDomesticRoaming,omitempty"`
	// If `true`, the system enables XLAT464. Available in iOS 16 and later and watchOS 9 and
	// later.
	EnableXLAT464 *bool `plist:"EnableXLAT464,omitempty" json:"EnableXLAT464,omitempty"`
}

type CellularAttachAPN struct {
	// The name for this configuration.
	Name string `plist:"Name" json:"Name"`
	// The authentication type.
	AuthenticationType *string `plist:"AuthenticationType,omitempty" json:"AuthenticationType,omitempty"`
	// The user name.
	Username *string `plist:"Username,omitempty" json:"Username,omitempty"`
	// The password for the user.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The Internet Protocol versions that the system supports. Allowed values:
	AllowedProtocolMask *int64 `plist:"AllowedProtocolMask,omitempty" json:"AllowedProtocolMask,omitempty"`
}

type CellularPrivateNetwork struct {
	// A list of up to 1000 geofences for private networks. Geofencing is only used on iPhone.
	Geofences []CellularPrivateNetworkGeofences `plist:"Geofences,omitempty" json:"Geofences,omitempty"`
	// The name of the private network configuration data set.
	DataSetName string `plist:"DataSetName" json:"DataSetName"`
	// The version number of this dataset that the system uses to track updates.
	VersionNumber string `plist:"VersionNumber" json:"VersionNumber"`
	// Set to `true` to prefer this private network over Wi-Fi.
	CellularDataPreferred *bool `plist:"CellularDataPreferred,omitempty" json:"CellularDataPreferred,omitempty"`
	// Set to `true` if this private network is NR Standalone.
	EnableNRStandalone *bool `plist:"EnableNRStandalone,omitempty" json:"EnableNRStandalone,omitempty"`
	// A string using the 3GPP "Coordinated NID" (option 1 or option 2) format (defined in 3GPP
	// 31.102, Section 12.7.1). The device uses this value to match a SIM present on the
	// device.
	NetworkIdentifier *string `plist:"NetworkIdentifier,omitempty" json:"NetworkIdentifier,omitempty"`
	// A string using the 3GPP "CSG_ID" format (defined in 3GPP 23.003, Section 4.7). The
	// device uses this value to match a SIM present on the device.
	CsgNetworkIdentifier *string `plist:"CsgNetworkIdentifier,omitempty" json:"CsgNetworkIdentifier,omitempty"`
}

type CellularPrivateNetworkGeofences struct {
	// The longitude of the geofence.
	Longitude float64 `plist:"Longitude" json:"Longitude"`
	// The latitude of the geofence.
	Latitude float64 `plist:"Latitude" json:"Latitude"`
	// Specifies the radius of the geofence in meters. Set this value slightly greater than the
	// private cellular network coverage area.
	Radius float64 `plist:"Radius" json:"Radius"`
	// A geofence identifier that's unique within a list of geofences.
	GeofenceId string `plist:"GeofenceId" json:"GeofenceId"`
}

type CertificatePEM struct {
	// The file name of the enclosed certificate.
	PayloadCertificateFileName *string `plist:"PayloadCertificateFileName,omitempty" json:"PayloadCertificateFileName,omitempty"`
	// The binary representation of the payload, encoded in Base64.
	PayloadContent []byte `plist:"PayloadContent,omitempty" json:"PayloadContent,omitempty"`
}

type CertificatePKCS1 struct {
	// The file name of the enclosed certificate.
	PayloadCertificateFileName *string `plist:"PayloadCertificateFileName,omitempty" json:"PayloadCertificateFileName,omitempty"`
	// The binary representation of the payload, encoded in Base64.
	PayloadContent []byte `plist:"PayloadContent,omitempty" json:"PayloadContent,omitempty"`
}

type CertificatePKCS12 struct {
	// The file name of the enclosed certificate.
	PayloadCertificateFileName *string `plist:"PayloadCertificateFileName,omitempty" json:"PayloadCertificateFileName,omitempty"`
	// The binary representation of the payload, encoded in Base64.
	PayloadContent []byte `plist:"PayloadContent,omitempty" json:"PayloadContent,omitempty"`
	// The password to the identity.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// If `true`, the system allows apps access to the private key. Available in macOS 10.10
	// and later.
	AllowAllAppsAccess *bool `plist:"AllowAllAppsAccess,omitempty" json:"AllowAllAppsAccess,omitempty"`
	// If `false`, the system doesn't tag the private key data as extractable in the keychain.
	KeyIsExtractable *bool `plist:"KeyIsExtractable,omitempty" json:"KeyIsExtractable,omitempty"`
}

type CertificatePreference struct {
	// An email address (in RFC 822 format) or other name for which a preferred certificate is
	// requested.
	Name string `plist:"Name" json:"Name"`
	// The UUID of the certificate payload within the same profile to use for the identity
	// credential.
	PayloadCertificateUUID string `plist:"PayloadCertificateUUID" json:"PayloadCertificateUUID"`
}

type CertificateRevocation struct {
	// An array of certificates that the system checks for revocation.
	EnabledForCerts []CertificateRevocationEnabledForCerts `plist:"EnabledForCerts,omitempty" json:"EnabledForCerts,omitempty"`
}

type CertificateRevocationEnabledForCerts struct {
	// The algorithm must be `sha256`.
	Algorithm string `plist:"Algorithm" json:"Algorithm"`
	// The hash of the DER-encoding of the certificate's `subjectPublicKeyInfo`.
	Hash []byte `plist:"Hash,omitempty" json:"Hash,omitempty"`
}

type CertificateRoot struct {
	// The file name of the enclosed certificate.
	PayloadCertificateFileName *string `plist:"PayloadCertificateFileName,omitempty" json:"PayloadCertificateFileName,omitempty"`
	// The binary representation of the payload encoded in base64.
	PayloadContent []byte `plist:"PayloadContent,omitempty" json:"PayloadContent,omitempty"`
}

type CertificateTransparency struct {
	// An array of certificates for which certificate transparency is disabled. One of the
	// following conditions needs to be met to disable certificate transparency enforcement
	// when this policy is set:
	DisabledForCerts []CertificateTransparencyDisabledForCerts `plist:"DisabledForCerts,omitempty" json:"DisabledForCerts,omitempty"`
	// An array of strings that represent the domains to exclude from certificate transparency
	// enforcement. The system supports using a leading period (`.`) to signify subdomains.
	// However, the system doesn't support wildcards. If you include a leading period, the
	// domain can't be a top-level domain, such as `.com` and `.co.uk`.
	DisabledForDomains []string `plist:"DisabledForDomains,omitempty" json:"DisabledForDomains,omitempty"`
}

type CertificateTransparencyDisabledForCerts struct {
	// The algorithm must be `sha256`.
	Algorithm string `plist:"Algorithm" json:"Algorithm"`
	// The hash of the DER-encoding of the certificate's `subjectPublicKeyInfo`.
	Hash []byte `plist:"Hash,omitempty" json:"Hash,omitempty"`
}

type CommonPayloadKeys struct {
	// The reverse-DNS-style identifier for the payload. This identifier is usually the same as
	// the `TopLevel` value, with an additional appended component. This string must be unique
	// within the profile.
	PayloadIdentifier string `plist:"PayloadIdentifier" json:"PayloadIdentifier"`
	// The globally unique identifier for the payload. The actual content is unimportant, but
	// must be globally unique. In macOS, use `uuidgen` to generate UUIDs.
	PayloadUUID string `plist:"PayloadUUID" json:"PayloadUUID"`
	// The payload type, which each payload domain's reference page specifies.
	PayloadType string `plist:"PayloadType" json:"PayloadType"`
	// The version of this specific payload.
	PayloadVersion int64 `plist:"PayloadVersion" json:"PayloadVersion"`
	// The human-readable description of this payload. This description appears on the Detail
	// screen.
	PayloadDescription *string `plist:"PayloadDescription,omitempty" json:"PayloadDescription,omitempty"`
	// The human-readable name for the profile payload. The name appears on the Detail screen
	// and doesn't need to be unique.
	PayloadDisplayName *string `plist:"PayloadDisplayName,omitempty" json:"PayloadDisplayName,omitempty"`
	// The human-readable string containing the name of the organization that provides the
	// profile. This value doesn't need to match the organization payload value in the
	// enclosing dictionary.
	PayloadOrganization *string `plist:"PayloadOrganization,omitempty" json:"PayloadOrganization,omitempty"`
}

type ConferenceRoomDisplay struct {
	// The custom message displayed on the screen in Conference Room Display mode.
	Message *string `plist:"Message,omitempty" json:"Message,omitempty"`
}

type ContentCaching struct {
	// If true, the system purges content from the cache automatically when it needs disk space
	// for other apps when free disk space runs low on the computer. Set to `false` to maximize
	// effectiveness of Content Caching. Available in macOS 10.15 and later.
	AllowCacheDelete *bool `plist:"AllowCacheDelete,omitempty" json:"AllowCacheDelete,omitempty"`
	// If `true`, the system caches the user's iCloud data. Changes to this value don't have an
	// immediate effect. Clients may take some time, such as hours or days, to react to
	// changes.
	AllowPersonalCaching *bool `plist:"AllowPersonalCaching,omitempty" json:"AllowPersonalCaching,omitempty"`
	// If `true`, the system caches non-iCloud content, such as apps and software updates.
	// Changes to this value don't have an immediate effect. Clients may take some time, such
	// as hours or days, to react to changes.
	AllowSharedCaching *bool `plist:"AllowSharedCaching,omitempty" json:"AllowSharedCaching,omitempty"`
	// If `true`, the system automatically activates the content cache when possible and
	// prevents disabling it. If `allowContentCaching` is `false`, `AutoActivation` is also
	// `false`.
	AutoActivation *bool `plist:"AutoActivation,omitempty" json:"AutoActivation,omitempty"`
	// If `true`, the system automatically enables Internet connection sharing when possible
	// and prevent disabling Internet connection sharing. `DenyTetheredCaching` overrides
	// `AutoEnableTetheredCaching`. Tethered caching requires Content Caching.
	AutoEnableTetheredCaching *bool `plist:"AutoEnableTetheredCaching,omitempty" json:"AutoEnableTetheredCaching,omitempty"`
	// The maximum number of bytes of disk space to use for the content cache. Set to `0` for
	// unlimited disk space.
	CacheLimit *int64 `plist:"CacheLimit,omitempty" json:"CacheLimit,omitempty"`
	// The path to the directory used to store cached content. Changing this setting manually
	// doesn't automatically move cached content from the old location to the new one. To move
	// content automatically, use the Sharing preference's Content Caching pane. The value must
	// be (or end with) `/Library/Application Support/Apple/AssetCache/Data`.
	DataPath *string `plist:"DataPath,omitempty" json:"DataPath,omitempty"`
	// If `true`, the system disables tethered caching.
	DenyTetheredCaching *bool `plist:"DenyTetheredCaching,omitempty" json:"DenyTetheredCaching,omitempty"`
	// If `true`, Content Caching displays exceptional conditions (alerts) as system
	// notifications in the upper corner of the screen. Alerts were automatically displayed
	// starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still
	// available through this setting. Available in macOS 10.15 and later.
	DisplayAlerts *bool `plist:"DisplayAlerts,omitempty" json:"DisplayAlerts,omitempty"`
	// If `true`, the system prevents the computer from sleeping as long as Content Caching is
	// on (System Preferences > Sharing > Content Caching is on). Customers who want Content
	// Caching to be as available as much as possible should turn this setting on. Available in
	// macOS 10.15 and later.
	KeepAwake *bool `plist:"KeepAwake,omitempty" json:"KeepAwake,omitempty"`
	// An array of dictionaries that describe a range of client IP addresses to serve.
	ListenRanges []ContentCachingRanges `plist:"ListenRanges,omitempty" json:"ListenRanges,omitempty"`
	// If `true`, the content cache provides content to the clients in the `ListenRanges`.
	ListenRangesOnly *bool `plist:"ListenRangesOnly,omitempty" json:"ListenRangesOnly,omitempty"`
	// If `true`, the content cache provides content to the clients in the union of the
	// `ListenRanges`, `PeerListenRanges` and `Parents`.
	ListenWithPeersAndParents *bool `plist:"ListenWithPeersAndParents,omitempty" json:"ListenWithPeersAndParents,omitempty"`
	// If `true`, the content cache offers content to clients only on the same immediate local
	// network only. No content is offered to clients on other networks reachable by the
	// content cache. If `LocalSubnetsOnly` is `true`, the system ignores `ListenRanges`.
	LocalSubnetsOnly *bool `plist:"LocalSubnetsOnly,omitempty" json:"LocalSubnetsOnly,omitempty"`
	// If `true`, the Content Cache logs the IP address and port number of the clients that
	// request content.
	LogClientIdentity *bool `plist:"LogClientIdentity,omitempty" json:"LogClientIdentity,omitempty"`
	// An array of the local IP addresses of other content caches that this cache should
	// download from or upload to, instead of downloading from or uploading to Apple directly.
	// The system ignores invalid addresses and addresses of computers that aren't content
	// caches. The system skips Parent caches that become unavailable. If all parent content
	// caches become unavailable, the content cache downloads from or uploads to Apple
	// directly, until a parent content cache becomes available again.
	Parents []string `plist:"Parents,omitempty" json:"Parents,omitempty"`
	// The policy to implement when choosing among more than one configured parent content
	// cache. With every policy, the system skips parent caches that are temporarily
	// unavailable. Allowed values:
	ParentSelectionPolicy *string `plist:"ParentSelectionPolicy,omitempty" json:"ParentSelectionPolicy,omitempty"`
	// An array of dictionaries describing a range of peer IP addresses that the content cache
	// uses to filter its list of peers to query for content. The content cache only queries
	// peers in `PeerFilterRanges`. When `PeerFilterRanges` is an empty array, the content
	// cache doesn't query any peers.
	PeerFilterRanges []ContentCachingRanges `plist:"PeerFilterRanges,omitempty" json:"PeerFilterRanges,omitempty"`
	// An array of dictionaries describing a range of peer IP addresses the content cache
	// responds to. When `PeerListenRanges` is an empty array, the content cache responds with
	// an error to all cache queries.
	PeerListenRanges []ContentCachingRanges `plist:"PeerListenRanges,omitempty" json:"PeerListenRanges,omitempty"`
	// If `true`, the content cache only peers with other content caches on the same immediate
	// local network, rather than with content caches that use the same public IP address as
	// the device. When `PeerLocalSubnetsOnly` is `true`, it overrides the configuration of
	// `PeerFilterRanges` and `PeerListenRanges`. If the network changes, the local network
	// peering restrictions update appropriately. If `false`, the content cache defers to
	// `PeerFilterRanges` and `PeerListenRanges` for configuring the peering restrictions.
	PeerLocalSubnetsOnly *bool `plist:"PeerLocalSubnetsOnly,omitempty" json:"PeerLocalSubnetsOnly,omitempty"`
	// The TCP port number on which the content cache accepts requests for uploads or
	// downloads. Set to `0` to pick a random, available port.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// An array of dictionaries describing a range of public IP addresses that the cloud
	// servers should use for matching clients to content caches.
	PublicRanges []ContentCachingRanges `plist:"PublicRanges,omitempty" json:"PublicRanges,omitempty"`
}

type ContentCachingRanges struct {
	// The IP address type.
	Type *string `plist:"type,omitempty" json:"type,omitempty"`
	// The first IP address in the range.
	First string `plist:"first" json:"first"`
	// The last IP address in the range.
	Last string `plist:"last" json:"last"`
}

type DNSProxy struct {
	// The bundle identifier of the app containing the DNS proxy network extension.
	AppBundleIdentifier string `plist:"AppBundleIdentifier" json:"AppBundleIdentifier"`
	// The bundle identifier of the DNS proxy network extension to use. Declaring the bundle
	// identifier is useful for apps that contain more than one DNS proxy extension.
	ProviderBundleIdentifier *string `plist:"ProviderBundleIdentifier,omitempty" json:"ProviderBundleIdentifier,omitempty"`
	// The dictionary of vendor-specific configuration items.
	ProviderConfiguration map[string]any `plist:"ProviderConfiguration,omitempty" json:"ProviderConfiguration,omitempty"`
	// A globally unique identifier for this DNS proxy configuration. The proxy processes DNS
	// lookups traffic for managed apps with the same `DNSProxyUUID` in their app attributes.
	// This key is required for user enrollment.
	DNSProxyUUID *string `plist:"DNSProxyUUID,omitempty" json:"DNSProxyUUID,omitempty"`
}

type DNSSettings struct {
	// A dictionary that defines a configuration for an encrypted DNS server.
	DNSSettings DNSSettingsDNSSettings `plist:"DNSSettings,omitempty" json:"DNSSettings,omitempty"`
	// An array of rules that define the DNS settings. If not set, the system always applies
	// the DNS settings. These rules are identical to the `OnDemandRules` array in VPN
	// payloads.
	OnDemandRules []DNSSettingsOnDemandRulesElement `plist:"OnDemandRules,omitempty" json:"OnDemandRules,omitempty"`
	// If `true`, the system prohibits users from disabling DNS settings. This key is only
	// available on supervised devices.
	ProhibitDisablement *bool `plist:"ProhibitDisablement,omitempty" json:"ProhibitDisablement,omitempty"`
}

type DNSSettingsDNSSettings struct {
	// The encrypted transport protocol used to communicate with the DNS server.
	DNSProtocol string `plist:"DNSProtocol" json:"DNSProtocol"`
	// The URI template of a DNS-over-HTTPS server, as defined in RFC 8484. This URL needs to
	// use the `https://` scheme, and the system uses the hostname or address in the URL to
	// validate the server certificate. If no `ServerAddresses` are provided, the system uses
	// the hostname or address in the URL to determine the server addresses. Required if
	// `DNSProtocol` is `HTTPS`.
	ServerURL *string `plist:"ServerURL,omitempty" json:"ServerURL,omitempty"`
	// The hostname of a DNS-over-TLS server used to validate the server certificate, as
	// defined in RFC 7858. If no `ServerAddresses` are provided, the system uses the hostname
	// to determine the server addresses. This key must be present only if the DNSProtocol is
	// `TLS`.
	ServerName *string `plist:"ServerName,omitempty" json:"ServerName,omitempty"`
	// An unordered list of DNS server IP address strings. These IP addresses can be a mixture
	// of IPv4 and IPv6 addresses.
	ServerAddresses []string `plist:"ServerAddresses,omitempty" json:"ServerAddresses,omitempty"`
	// If `true`, the device allows failover to the default system DNS resolver.
	AllowFailover *bool `plist:"AllowFailover,omitempty" json:"AllowFailover,omitempty"`
	// The UUID that points to an identity certificate payload. The system uses this identity
	// to authenticate the user to the DNS resolver.
	PayloadCertificateUUID *string `plist:"PayloadCertificateUUID,omitempty" json:"PayloadCertificateUUID,omitempty"`
	// A list of domain strings used to determine which DNS queries use the DNS server. If not
	// set, all domains use the DNS server.
	SupplementalMatchDomains []string `plist:"SupplementalMatchDomains,omitempty" json:"SupplementalMatchDomains,omitempty"`
}

type DNSSettingsOnDemandRulesElement struct {
	// The action to take if this dictionary matches the current network. Allowed values:
	Action string `plist:"Action" json:"Action"`
	// An array of dictionaries that provide per-connection rules. The system uses this array
	// only for settings where the `Action` value is `EvaluateConnection`.
	ActionParameters []DNSSettingsOnDemandRulesElementActionParameters `plist:"ActionParameters,omitempty" json:"ActionParameters,omitempty"`
	// An array of domain names. This rule matches if any of the domain names in the specified
	// list matches any domain in the device's search domains list.
	DNSDomainMatch []string `plist:"DNSDomainMatch,omitempty" json:"DNSDomainMatch,omitempty"`
	// An array of IP addresses. This rule matches if any of the network's specified DNS
	// servers match any entry in the array.
	DNSServerAddressMatch []string `plist:"DNSServerAddressMatch,omitempty" json:"DNSServerAddressMatch,omitempty"`
	// An interface type. If specified, this rule matches only if the primary network interface
	// hardware matches the specified type.
	InterfaceTypeMatch *string `plist:"InterfaceTypeMatch,omitempty" json:"InterfaceTypeMatch,omitempty"`
	// An array of SSIDs to match against the current network. If the network isn't a Wi-Fi
	// network or if the SSID doesn't appear in this array, the match fails. Omit this key and
	// the corresponding array to match against any SSID.
	SSIDMatch []string `plist:"SSIDMatch,omitempty" json:"SSIDMatch,omitempty"`
	// A URL to probe. This rule matches if this URL is successfully fetched and returns a 200
	// HTTP status code without redirection.
	URLStringProbe *string `plist:"URLStringProbe,omitempty" json:"URLStringProbe,omitempty"`
}

type DNSSettingsOnDemandRulesElementActionParameters struct {
	// The domains for which this evaluation applies.
	Domains []string `plist:"Domains,omitempty" json:"Domains,omitempty"`
	// The DNS settings behavior for the specified domains. Allowed values:
	DomainAction string `plist:"DomainAction" json:"DomainAction"`
}

type Declarations struct {
	// The set of declarations to apply. The array items are Base64-encoded data
	// representations of the declaration JSON data.
	Declarations [][]byte `plist:"Declarations,omitempty" json:"Declarations,omitempty"`
}

type Desktop struct {
	// If `true`, locks the desktop picture. Replaced with allowWallpaperModification in macOS
	// 10.13.
	Locked *bool `plist:"locked,omitempty" json:"locked,omitempty"`
	// The path to the desktop picture. If set, this picture is always locked.
	OverridePicturePath *string `plist:"override-picture-path,omitempty" json:"override-picture-path,omitempty"`
}

type DirectoryService struct {
	// The Active Directory domain to join.
	HostName string `plist:"HostName" json:"HostName"`
	// The user name of the account for the domain.
	UserName *string `plist:"UserName,omitempty" json:"UserName,omitempty"`
	// The password of the account for the domain.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The client's identifier.
	ClientID *string `plist:"ClientID,omitempty" json:"ClientID,omitempty"`
	// The directory service description.
	Description *string `plist:"Description,omitempty" json:"Description,omitempty"`
	// The organizational unit to add the joining computer object to.
	ADOrganizationalUnit *string `plist:"ADOrganizationalUnit,omitempty" json:"ADOrganizationalUnit,omitempty"`
	// The network home protocol to use: `afp` or `smb`.
	ADMountStyle *string `plist:"ADMountStyle,omitempty" json:"ADMountStyle,omitempty"`
	// If `true`, the system enables the `ADCreateMobileAccountAtLogin` key.
	ADCreateMobileAccountAtLoginFlag *bool `plist:"ADCreateMobileAccountAtLoginFlag,omitempty" json:"ADCreateMobileAccountAtLoginFlag,omitempty"`
	// If `true`, the system creates a mobile account at login.
	ADCreateMobileAccountAtLogin *bool `plist:"ADCreateMobileAccountAtLogin,omitempty" json:"ADCreateMobileAccountAtLogin,omitempty"`
	// If `true`, the system enables the `ADWarnUserBeforeCreatingMA` key.
	ADWarnUserBeforeCreatingMAFlag *bool `plist:"ADWarnUserBeforeCreatingMAFlag,omitempty" json:"ADWarnUserBeforeCreatingMAFlag,omitempty"`
	// If `true`, the system enables the warning before creating the mobile account.
	ADWarnUserBeforeCreatingMA *bool `plist:"ADWarnUserBeforeCreatingMA,omitempty" json:"ADWarnUserBeforeCreatingMA,omitempty"`
	// If `true`, the system enables the `ADForceHomeLocal` key.
	ADForceHomeLocalFlag *bool `plist:"ADForceHomeLocalFlag,omitempty" json:"ADForceHomeLocalFlag,omitempty"`
	// If `true`, the system forces a local home directory.
	ADForceHomeLocal *bool `plist:"ADForceHomeLocal,omitempty" json:"ADForceHomeLocal,omitempty"`
	// If `true`, the system enables the `ADUseWindowsUNCPath` key.
	ADUseWindowsUNCPathFlag *bool `plist:"ADUseWindowsUNCPathFlag,omitempty" json:"ADUseWindowsUNCPathFlag,omitempty"`
	// If `true`, the system uses the UNC path from Active Directory to derive the network home
	// location.
	ADUseWindowsUNCPath *bool `plist:"ADUseWindowsUNCPath,omitempty" json:"ADUseWindowsUNCPath,omitempty"`
	// If `true`, the system enables the `ADAllowMultiDomainAuth` key.
	ADAllowMultiDomainAuthFlag *bool `plist:"ADAllowMultiDomainAuthFlag,omitempty" json:"ADAllowMultiDomainAuthFlag,omitempty"`
	// If `true`, the system allows authentication from any domain in the namespace.
	ADAllowMultiDomainAuth *bool `plist:"ADAllowMultiDomainAuth,omitempty" json:"ADAllowMultiDomainAuth,omitempty"`
	// If `true`, the system enables the `ADDefaultUserShell` key.
	ADDefaultUserShellFlag *bool `plist:"ADDefaultUserShellFlag,omitempty" json:"ADDefaultUserShellFlag,omitempty"`
	// The default user shell.
	ADDefaultUserShell *string `plist:"ADDefaultUserShell,omitempty" json:"ADDefaultUserShell,omitempty"`
	// If `true`, the system enables the `ADMapUIDAttribute` key.
	ADMapUIDAttributeFlag *bool `plist:"ADMapUIDAttributeFlag,omitempty" json:"ADMapUIDAttributeFlag,omitempty"`
	// The map UID to attribute.
	ADMapUIDAttribute *string `plist:"ADMapUIDAttribute,omitempty" json:"ADMapUIDAttribute,omitempty"`
	// If `true`, the system enables the `ADMapGIDAttribute` key.
	ADMapGIDAttributeFlag *bool `plist:"ADMapGIDAttributeFlag,omitempty" json:"ADMapGIDAttributeFlag,omitempty"`
	// The map GID to attribute.
	ADMapGIDAttribute *string `plist:"ADMapGIDAttribute,omitempty" json:"ADMapGIDAttribute,omitempty"`
	// If `true`, the system enables the `ADMapGGIDAttributeFlag` key.
	ADMapGGIDAttributeFlag *bool `plist:"ADMapGGIDAttributeFlag,omitempty" json:"ADMapGGIDAttributeFlag,omitempty"`
	// The map group GID to attribute.
	ADMapGGIDAttribute *string `plist:"ADMapGGIDAttribute,omitempty" json:"ADMapGGIDAttribute,omitempty"`
	// If `true`, the system enables the `ADPreferredDCServer` key.
	ADPreferredDCServerFlag *bool `plist:"ADPreferredDCServerFlag,omitempty" json:"ADPreferredDCServerFlag,omitempty"`
	// The preferred domain server.
	ADPreferredDCServer *string `plist:"ADPreferredDCServer,omitempty" json:"ADPreferredDCServer,omitempty"`
	// If `true`, the system enables the `ADDomainAdminGroupList` key.
	ADDomainAdminGroupListFlag *bool `plist:"ADDomainAdminGroupListFlag,omitempty" json:"ADDomainAdminGroupListFlag,omitempty"`
	// The list of Active Directory groups with admin access.
	ADDomainAdminGroupList []string `plist:"ADDomainAdminGroupList,omitempty" json:"ADDomainAdminGroupList,omitempty"`
	// If `true`, the system enables the `ADNamespace` key.
	ADNamespaceFlag *bool `plist:"ADNamespaceFlag,omitempty" json:"ADNamespaceFlag,omitempty"`
	// The primary user account naming convention; either `forest` or `domain`.
	ADNamespace *string `plist:"ADNamespace,omitempty" json:"ADNamespace,omitempty"`
	// If `true`, the system enables the `ADPacketSign` key.
	ADPacketSignFlag *bool `plist:"ADPacketSignFlag,omitempty" json:"ADPacketSignFlag,omitempty"`
	// The packet signing policy.
	ADPacketSign *string `plist:"ADPacketSign,omitempty" json:"ADPacketSign,omitempty"`
	// If `true`, the system enables the `ADPacketEncrypt` key.
	ADPacketEncryptFlag *bool `plist:"ADPacketEncryptFlag,omitempty" json:"ADPacketEncryptFlag,omitempty"`
	// The packet encryption policy.
	ADPacketEncrypt *string `plist:"ADPacketEncrypt,omitempty" json:"ADPacketEncrypt,omitempty"`
	// If `true`, the system enables the `ADRestrictDDNS` key.
	ADRestrictDDNSFlag *bool `plist:"ADRestrictDDNSFlag,omitempty" json:"ADRestrictDDNSFlag,omitempty"`
	// An array of strings that represent the interfaces allowed for dynamic DNS updates, such
	// as en0 and en1.
	ADRestrictDDNS []string `plist:"ADRestrictDDNS,omitempty" json:"ADRestrictDDNS,omitempty"`
	// If `true`, the system enables the `ADTrustChangePassIntervalDays` key.
	ADTrustChangePassIntervalDaysFlag *bool `plist:"ADTrustChangePassIntervalDaysFlag,omitempty" json:"ADTrustChangePassIntervalDaysFlag,omitempty"`
	// The number of days before requiring a change of the computer trust account password. Set
	// to `0` to disable the feature.
	ADTrustChangePassIntervalDays *int64 `plist:"ADTrustChangePassIntervalDays,omitempty" json:"ADTrustChangePassIntervalDays,omitempty"`
}

type Dock struct {
	// The tile size. Values must be in the range from 16 to 128.
	Tilesize *int64 `plist:"tilesize,omitempty" json:"tilesize,omitempty"`
	// If `true`, locks the size slider.
	SizeImmutable *bool `plist:"size-immutable,omitempty" json:"size-immutable,omitempty"`
	// If `true`, enables magnification.
	Magnification *bool `plist:"magnification,omitempty" json:"magnification,omitempty"`
	// If `true`, locks magnification.
	MagnifyImmutable *bool `plist:"magnify-immutable,omitempty" json:"magnify-immutable,omitempty"`
	// The size of the largest magnification.
	Largesize *int64 `plist:"largesize,omitempty" json:"largesize,omitempty"`
	// If `true`, locks the magnification slider.
	MagsizeImmutable *bool `plist:"magsize-immutable,omitempty" json:"magsize-immutable,omitempty"`
	// The orientation of the Dock.
	Orientation *string `plist:"orientation,omitempty" json:"orientation,omitempty"`
	// If `true`, locks the position.
	PositionImmutable *bool `plist:"position-immutable,omitempty" json:"position-immutable,omitempty"`
	// The minimize effect.
	Mineffect *string `plist:"mineffect,omitempty" json:"mineffect,omitempty"`
	// If `true`, locks "Minimize windows using."
	MineffectImmutable *bool `plist:"mineffect-immutable,omitempty" json:"mineffect-immutable,omitempty"`
	// Set the "Prefer tabs when opening documents" to the provided value.
	Windowtabbing *string `plist:"windowtabbing,omitempty" json:"windowtabbing,omitempty"`
	// If `true`, disables "Prefer tabs when opening documents" checkbox.
	WindowtabbingImmutable *bool `plist:"windowtabbing-immutable,omitempty" json:"windowtabbing-immutable,omitempty"`
	// The behavior when the window's title bar is double-clicked.
	Dblclickbehavior *string `plist:"dblclickbehavior,omitempty" json:"dblclickbehavior,omitempty"`
	// If `true`, locks "Double-click a window's title bar."
	DblclickbehaviorImmutable *bool `plist:"dblclickbehavior-immutable,omitempty" json:"dblclickbehavior-immutable,omitempty"`
	// If `true`, enables "Minimize windows into application icon."
	MinimizeToApplication *bool `plist:"minimize-to-application,omitempty" json:"minimize-to-application,omitempty"`
	// If `true`, disables the "Minimize windows into application icon" checkbox.
	MinintoappImmutable *bool `plist:"minintoapp-immutable,omitempty" json:"minintoapp-immutable,omitempty"`
	// If `true`, enables "Animate opening applications."
	Launchanim *bool `plist:"launchanim,omitempty" json:"launchanim,omitempty"`
	// If `true`, locks "Animate opening applications."
	LaunchanimImmutable *bool `plist:"launchanim-immutable,omitempty" json:"launchanim-immutable,omitempty"`
	// If `true`, enables "Automatically hide and show the Dock."
	Autohide *bool `plist:"autohide,omitempty" json:"autohide,omitempty"`
	// If `true`, locks "Automatically hide."
	AutohideImmutable *bool `plist:"autohide-immutable,omitempty" json:"autohide-immutable,omitempty"`
	// If true, shows the process indicator.
	ShowProcessIndicators *bool `plist:"show-process-indicators,omitempty" json:"show-process-indicators,omitempty"`
	// If `true`, locks "Show indicators."
	ShowindicatorsImmutable *bool `plist:"showindicators-immutable,omitempty" json:"showindicators-immutable,omitempty"`
	// If `true`, enables "Show recent items."
	ShowRecents *bool `plist:"show-recents,omitempty" json:"show-recents,omitempty"`
	// If `true`, disables "Show recent applications" checkbox.
	ShowrecentsImmutable *bool `plist:"showrecents-immutable,omitempty" json:"showrecents-immutable,omitempty"`
	// If `true`, disables changes to the Dock.
	ContentsImmutable *bool `plist:"contents-immutable,omitempty" json:"contents-immutable,omitempty"`
	// One or more special folders that may be created at user login time and placed in the
	// Dock.
	MCXDockSpecialFolders []string `plist:"MCXDockSpecialFolders,omitempty" json:"MCXDockSpecialFolders,omitempty"`
	// If `true`, use the file in `/Library/Preferences/com.apple.dockfixup.plist` when a new
	// user or migrated user logs in. This option has no effect for existing users. Available
	// in macOS 10.12 and later. Only available on the device channel.
	AllowDockFixupOverride *bool `plist:"AllowDockFixupOverride,omitempty" json:"AllowDockFixupOverride,omitempty"`
	// If `true`, uses the `static-apps` and `static-others` dictionaries for the Dock and
	// ignores any items in the `persistent-apps` and `persistent-others` dictionaries. If
	// `false`, the contents are merged with the static items listed first.
	StaticOnly *bool `plist:"static-only,omitempty" json:"static-only,omitempty"`
	// An array of items located on the Documents side of the Dock and cannot be removed from
	// that location.
	StaticOthers []DockStaticItem `plist:"static-others,omitempty" json:"static-others,omitempty"`
	// An array of items located on the Applications side of the Dock and cannot be removed
	// from that location.
	StaticApps []DockStaticItem `plist:"static-apps,omitempty" json:"static-apps,omitempty"`
	// An array of items located on the Applications side of the Dock that can be removed from
	// the Dock.
	PersistentApps []DockStaticItem `plist:"persistent-apps,omitempty" json:"persistent-apps,omitempty"`
	// An array of items located on the Documents side of the Dock that can be removed from the
	// Dock.
	PersistentOthers []DockStaticItem `plist:"persistent-others,omitempty" json:"persistent-others,omitempty"`
}

type DockStaticItem struct {
	// The information about the Dock item.
	TileData DockStaticItemTileData `plist:"tile-data,omitempty" json:"tile-data,omitempty"`
	// The type of tile.
	TileType string `plist:"tile-type" json:"tile-type"`
}

type DockStaticItemTileData struct {
	// The label of the Dock item.
	Label string `plist:"label" json:"label"`
	// The URL string.
	Url *string `plist:"url,omitempty" json:"url,omitempty"`
	// The type of tile:
	FileType int64 `plist:"file-type" json:"file-type"`
	// The data in a file. For Apple use only.
	FileData map[string]any `plist:"file-data,omitempty" json:"file-data,omitempty"`
}

type Domains struct {
	// An array of domains. Mail marks in red all email addresses that lack a suffix matching
	// any of these strings.
	EmailDomains []string `plist:"EmailDomains,omitempty" json:"EmailDomains,omitempty"`
	// An array of domains. The system considers URLs matching the patterns listed in this
	// property managed.
	WebDomains []string `plist:"WebDomains,omitempty" json:"WebDomains,omitempty"`
	// An array of domains. Users can only save passwords in Safari from URLs matching the
	// patterns listed here. This property doesn't disable the autofill feature itself.
	SafariPasswordAutoFillDomains []string `plist:"SafariPasswordAutoFillDomains,omitempty" json:"SafariPasswordAutoFillDomains,omitempty"`
	// An array of up to 10 strings. URLs matching the patterns listed here have relaxed
	// enforcement of cross-site tracking prevention.
	CrossSiteTrackingPreventionRelaxedDomains []string `plist:"CrossSiteTrackingPreventionRelaxedDomains,omitempty" json:"CrossSiteTrackingPreventionRelaxedDomains,omitempty"`
	// An array of up to 10 strings representing app bundle-ids. Apps matching the bundle-ids
	// listed here have relaxed enforcement of cross-site tracking prevention for the domains
	// listed in `CrossSiteTrackingPreventionRelaxedDomains`.
	CrossSiteTrackingPreventionRelaxedApps []string `plist:"CrossSiteTrackingPreventionRelaxedApps,omitempty" json:"CrossSiteTrackingPreventionRelaxedApps,omitempty"`
}

type EducationConfiguration struct {
	// The organization's UUID identifier. This identifier can be any valid UUID. All teacher
	// and student devices that need to communicate with one another must have the same
	// organization UUID, particularly if they originated from different Device Enrollment
	// Programs.
	OrganizationUUID string `plist:"OrganizationUUID" json:"OrganizationUUID"`
	// The organization's display name. The system displays this name in the iOS login screen.
	OrganizationName string `plist:"OrganizationName" json:"OrganizationName"`
	// The UUID of an identity certificate payload within the same profile to use for
	// performing client authentication with other devices. This property supports PKCS12
	// certificates.
	PayloadCertificateUUID *string `plist:"PayloadCertificateUUID,omitempty" json:"PayloadCertificateUUID,omitempty"`
	// The array of UUIDs referring to certificate payloads within the same profile that the
	// system uses to authorize leader peer certificate identities. This array needs to contain
	// all necessary certificates to validate the entire chain of trust. Leader certificates
	// needs to have the common name prefix leader, which is case insensitive.
	LeaderPayloadCertificateAnchorUUID []string `plist:"LeaderPayloadCertificateAnchorUUID,omitempty" json:"LeaderPayloadCertificateAnchorUUID,omitempty"`
	// The array of UUIDs referring to certificate payloads within the same profile that the
	// system uses to authorize group member peer certificate identities. This array must
	// contain all certificates needed to validate the entire chain of trust. Member
	// certificates must have the common name prefix member (case insensitive).
	MemberPayloadCertificateAnchorUUID []string `plist:"MemberPayloadCertificateAnchorUUID,omitempty" json:"MemberPayloadCertificateAnchorUUID,omitempty"`
	// The UUID of an identity certificate payload within the same profile that the system uses
	// to perform client authentication when fetching additional resources, such as student
	// images.
	ResourcePayloadCertificateUUID *string `plist:"ResourcePayloadCertificateUUID,omitempty" json:"ResourcePayloadCertificateUUID,omitempty"`
	// The unique string that identifies the user of this device within the organization.
	UserIdentifier string `plist:"UserIdentifier" json:"UserIdentifier"`
	// _For Shared iPad profiles:_ The array of dictionaries that defines which departments the
	// system displays in the Shared iPad login screen. If set, the system uses this key to
	// configure both Classroom and the Shared iPad login screen.
	Departments []EducationConfigurationDepartments `plist:"Departments,omitempty" json:"Departments,omitempty"`
	// _For Shared iPad profiles:_ The array of dictionaries that defines which groups the user
	// can select in the Login Window.
	Groups []EducationConfigurationGroups `plist:"Groups,omitempty" json:"Groups,omitempty"`
	// For Shared iPad profiles: The array of dictionaries that define the users that the
	// system displays in the iOS Login Window.
	Users []EducationConfigurationUsers `plist:"Users,omitempty" json:"Users,omitempty"`
	// _For leader/teacher profiles:_ The array of dictionaries that defines which device
	// groups the leader can assign devices to. Not included in member payloads.
	DeviceGroups []EducationConfigurationDeviceGroups `plist:"DeviceGroups,omitempty" json:"DeviceGroups,omitempty"`
	// If `true`, the system allows students enrolled in managed classes to modify their
	// teacher's permissions for screen observation on their device.
	ScreenObservationPermissionModificationAllowed *bool `` /* 128-byte string literal not displayed */
}

type EducationConfigurationDepartments struct {
	// The display name of the department.
	Name string `plist:"Name" json:"Name"`
	// The group beacon identifiers that are members of this department.
	GroupBeaconIDs []int64 `plist:"GroupBeaconIDs,omitempty" json:"GroupBeaconIDs,omitempty"`
}

type EducationConfigurationDeviceGroups struct {
	// The unique identifier for the device group in the organization.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// The name of the device group, which must be unique in the organization.
	Name string `plist:"Name" json:"Name"`
	// The serial numbers of the devices in the group.
	SerialNumbers []string `plist:"SerialNumbers,omitempty" json:"SerialNumbers,omitempty"`
}

type EducationConfigurationGroups struct {
	// An unsigned 16 bit integer specifying this group's unique beacon ID.
	BeaconID int64 `plist:"BeaconID" json:"BeaconID"`
	// The display name of the group.
	Name string `plist:"Name" json:"Name"`
	// The description of the group.
	Description *string `plist:"Description,omitempty" json:"Description,omitempty"`
	// Deprecated in iOS 9.3.1 and later. The URL of an image for the group.
	ImageURL *string `plist:"ImageURL,omitempty" json:"ImageURL,omitempty"`
	// The source that provided this group, such as SIS, or MDM.
	ConfigurationSource *string `plist:"ConfigurationSource,omitempty" json:"ConfigurationSource,omitempty"`
	// The user identifiers that are leaders of this group.
	LeaderIdentifiers []string `plist:"LeaderIdentifiers,omitempty" json:"LeaderIdentifiers,omitempty"`
	// The entries in the Users array that are members of the group.
	MemberIdentifiers []string `plist:"MemberIdentifiers,omitempty" json:"MemberIdentifiers,omitempty"`
	// The identifiers that refer to entries in the `DeviceGroups` array to which the
	// instructor can assign users from this class.
	DeviceGroupIdentifiers []string `plist:"DeviceGroupIdentifiers,omitempty" json:"DeviceGroupIdentifiers,omitempty"`
}

type EducationConfigurationUsers struct {
	// The unique identifier for a user in the organization.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// The name of the user.
	Name string `plist:"Name" json:"Name"`
	// The given name of the user.
	GivenName *string `plist:"GivenName,omitempty" json:"GivenName,omitempty"`
	// The family name of the user.
	FamilyName *string `plist:"FamilyName,omitempty" json:"FamilyName,omitempty"`
	// The user's phonetic given name. The system uses this name to sort users in the Classroom
	// app and the Shared iPad Login Screen.
	PhoneticGivenName *string `plist:"PhoneticGivenName,omitempty" json:"PhoneticGivenName,omitempty"`
	// The user's phonetic family name. The system uses this name to sort users in the
	// Classroom app and the Shared iPad login screen.
	PhoneticFamilyName *string `plist:"PhoneticFamilyName,omitempty" json:"PhoneticFamilyName,omitempty"`
	// A string that contains a URL pointing to an image of the user. The system displays this
	// image in the iOS login screen and in the Classroom app. The recommended resolution is
	// 256 x 256 pixels (512 x 512 pixels on a 2x device). The recommended formats are JPEG,
	// PNG, and TIFF. The system uses the `ResourcePayloadCertificateUUID` identity certificate
	// or the MDM client identity to perform authentication when fetching the image.
	ImageURL *string `plist:"ImageURL,omitempty" json:"ImageURL,omitempty"`
	// Deprecated in iOS 9.3.1 and later. The URL pointing to an image of the user. The system
	// uses the `ResourcePayloadCertificateUUID` identity certificate or the MDM client
	// identity to perform authentication when fetching the specified resource.
	FullScreenImageURL *string `plist:"FullScreenImageURL,omitempty" json:"FullScreenImageURL,omitempty"`
	// The Managed Apple Account for this user.
	AppleID *string `plist:"AppleID,omitempty" json:"AppleID,omitempty"`
	// The type of passcode UI to show when the user is at the Login Window.
	PasscodeType *string `plist:"PasscodeType,omitempty" json:"PasscodeType,omitempty"`
}

type EnergySaver struct {
	// The settings for a desktop computer.
	ComAppleEnergySaverDesktopACPower *EnergySaverPowerSettings `plist:"com.apple.EnergySaver.desktop.ACPower,omitempty" json:"com.apple.EnergySaver.desktop.ACPower,omitempty"`
	// The settings for a laptop computer using AC power.
	ComAppleEnergySaverPortableACPower *EnergySaverPowerSettings `plist:"com.apple.EnergySaver.portable.ACPower,omitempty" json:"com.apple.EnergySaver.portable.ACPower,omitempty"`
	// The settings for a laptop computer using battery power.
	ComAppleEnergySaverPortableBatteryPower *EnergySaverPowerSettings `plist:"com.apple.EnergySaver.portable.BatteryPower,omitempty" json:"com.apple.EnergySaver.portable.BatteryPower,omitempty"`
	// The schedule for turning a computer on and off.
	ComAppleEnergySaverDesktopSchedule *EnergySaverEnergySaverSchedule `plist:"com.apple.EnergySaver.desktop.Schedule,omitempty" json:"com.apple.EnergySaver.desktop.Schedule,omitempty"`
	// If `true`, disables sleep.
	SleepDisabled *bool `plist:"SleepDisabled,omitempty" json:"SleepDisabled,omitempty"`
}

type EnergySaverEnergySaverSchedule struct {
	// The schedule for turning the device on.
	RepeatingPowerOn *EnergySaverRepeatingPowerItem `plist:"RepeatingPowerOn,omitempty" json:"RepeatingPowerOn,omitempty"`
	// The schedule for turning the device off.
	RepeatingPowerOff *EnergySaverRepeatingPowerItem `plist:"RepeatingPowerOff,omitempty" json:"RepeatingPowerOff,omitempty"`
}

type EnergySaverPowerSettings struct {
	// The display sleep time, in minutes. A value of 0 means never.
	DisplaySleepTimer *int64 `plist:"Display Sleep Timer,omitempty" json:"Display Sleep Timer,omitempty"`
	// The disk sleep time, in minutes. A value of 0 means never.
	DiskSleepTimer *int64 `plist:"Disk Sleep Timer,omitempty" json:"Disk Sleep Timer,omitempty"`
	// System sleep time, in minutes. A value of 0 means never.
	SystemSleepTimer *int64 `plist:"System Sleep Timer,omitempty" json:"System Sleep Timer,omitempty"`
	// May not be available on all systems.
	ReduceProcessorSpeed *int64 `plist:"Reduce Processor Speed,omitempty" json:"Reduce Processor Speed,omitempty"`
	// May not be available on all systems.
	DynamicPowerStep *int64 `plist:"Dynamic Power Step,omitempty" json:"Dynamic Power Step,omitempty"`
	// If `true`, enables "Wake for network access."
	WakeOnLAN *int64 `plist:"Wake on LAN,omitempty" json:"Wake on LAN,omitempty"`
	// If `true`, enables "Wake for modem ring."
	WakeOnModemRing *int64 `plist:"Wake On Modem Ring,omitempty" json:"Wake On Modem Ring,omitempty"`
	// If `true`, enables "Start up automatically after a power failure."
	AutomaticRestartOnPowerLoss *int64 `plist:"Automatic Restart On Power Loss,omitempty" json:"Automatic Restart On Power Loss,omitempty"`
}

type EnergySaverRepeatingPowerItem struct {
	// The type of action defined by this schedule.
	Eventtype string `plist:"eventtype" json:"eventtype"`
	// One or more days of the week in an unsigned integer bitmap:
	Weekdays *int64 `plist:"weekdays,omitempty" json:"weekdays,omitempty"`
	// The time, in minutes, since midnight.
	Time *int64 `plist:"time,omitempty" json:"time,omitempty"`
}

type Entry struct {
	// ID is the wire identifier: RequestType, MessageType, PayloadType,
	// DeclarationType, StatusItemType, error code, or type name.
	ID string
	// Schema is the YAML path in apple/device-management.
	Schema string
	Title  string
	// New returns a zero value of the type as Payload.
	New func() Payload
	// NewResponse returns a zero response value, or nil when the schema
	// defines no response keys.
	NewResponse func() any
}

type ExchangeActiveSync struct {
	// The full email address for the account. If not present in the payload, the device
	// prompts for this string during profile installation.
	EmailAddress *string `plist:"EmailAddress,omitempty" json:"EmailAddress,omitempty"`
	// The Exchange server host name or IP address.
	Host *string `plist:"Host,omitempty" json:"Host,omitempty"`
	// If `true`, the system enables SSL for authentication.
	SSL *bool `plist:"SSL,omitempty" json:"SSL,omitempty"`
	// If `true`, enables OAuth for authentication. If enabled, don't specify a password.
	OAuth *bool `plist:"OAuth,omitempty" json:"OAuth,omitempty"`
	// This user name for this Exchange account. Required for noninteractive installations like
	// MDM in iOS.
	UserName *string `plist:"UserName,omitempty" json:"UserName,omitempty"`
	// The password of the account. Use only with encrypted profiles.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The `.p12` identity certificate in NSData blob format, for accounts that allow
	// authentication via certificate.
	Certificate []byte `plist:"Certificate,omitempty" json:"Certificate,omitempty"`
	// The name or description of the certificate.
	CertificateName *string `plist:"CertificateName,omitempty" json:"CertificateName,omitempty"`
	// The password necessary for the `.p12` identity certificate. Used with mandatory
	// encryption of profiles.
	CertificatePassword *string `plist:"CertificatePassword,omitempty" json:"CertificatePassword,omitempty"`
	// If `true`, the system prevents moving messages from out of this email account into
	// another account. This setting also prevents forwarding or replying from an account other
	// than the recipient of the message.
	PreventMove *bool `plist:"PreventMove,omitempty" json:"PreventMove,omitempty"`
	// If `true`, prevents this account from sending mail in any app other than the Apple Mail
	// app.
	PreventAppSheet *bool `plist:"PreventAppSheet,omitempty" json:"PreventAppSheet,omitempty"`
	// The UUID of the certificate payload within the same profile to use for the identity
	// credential. If this field is present, the Certificate field isn't used.
	PayloadCertificateUUID *string `plist:"PayloadCertificateUUID,omitempty" json:"PayloadCertificateUUID,omitempty"`
	// If `true`, the system enables S/MIME encryption. In iOS 10.0 and later, this key is
	// ignored. Use `SMIMESigningEnabled` instead.
	SMIMEEnabled *bool `plist:"SMIMEEnabled,omitempty" json:"SMIMEEnabled,omitempty"`
	// If `true`, the system enables S/MIME signing for this account. Available in iOS 10.0 and
	// later.
	SMIMESigningEnabled *bool `plist:"SMIMESigningEnabled,omitempty" json:"SMIMESigningEnabled,omitempty"`
	// The UUID of the identity certificate used to sign messages sent from this account.
	SMIMESigningCertificateUUID *string `plist:"SMIMESigningCertificateUUID,omitempty" json:"SMIMESigningCertificateUUID,omitempty"`
	// If `true`, the system enables S/MIME encryption for this account. Available in iOS 10.0
	// and later. As of iOS 12.0, this key is deprecated. Use `SMIMEEncryptByDefault` instead.
	SMIMEEncryptionEnabled *bool `plist:"SMIMEEncryptionEnabled,omitempty" json:"SMIMEEncryptionEnabled,omitempty"`
	// The payload UUID of the identity certificate used to decrypt messages sent to this
	// account. The system attaches the public certificate to outgoing mail to allow the user
	// to receive encrypted mail. When the user sends encrypted mail, the system uses the
	// public certificate to encrypt the copy of the mail in the user's Sent mailbox.
	SMIMEEncryptionCertificateUUID *string `plist:"SMIMEEncryptionCertificateUUID,omitempty" json:"SMIMEEncryptionCertificateUUID,omitempty"`
	// If `true`, the system displays the per-message encryption switch in the Mail Compose UI.
	SMIMEEnablePerMessageSwitch *bool `plist:"SMIMEEnablePerMessageSwitch,omitempty" json:"SMIMEEnablePerMessageSwitch,omitempty"`
	// If `true`, the system excludes this account from Recent Addresses syncing.
	DisableMailRecentsSyncing *bool `plist:"disableMailRecentsSyncing,omitempty" json:"disableMailRecentsSyncing,omitempty"`
	// The number of days in the past to sync mail on the device.
	MailNumberOfPastDaysToSync *int64 `plist:"MailNumberOfPastDaysToSync,omitempty" json:"MailNumberOfPastDaysToSync,omitempty"`
	// The value of the `X-Apple-Config-Magic` header in each EAS HTTP request.
	HeaderMagic *string `plist:"HeaderMagic,omitempty" json:"HeaderMagic,omitempty"`
	// The communication service handler rules for this account.
	CommunicationServiceRules *ExchangeActiveSyncCommunicationServiceRules `plist:"CommunicationServiceRules,omitempty" json:"CommunicationServiceRules,omitempty"`
	// If `true`, the system enables this account to use Mail Drop.
	AllowMailDrop *bool `plist:"allowMailDrop,omitempty" json:"allowMailDrop,omitempty"`
	// If `true`, the user can turn S/MIME signing on or off in Settings. Available in iOS 12.0
	// and later.
	SMIMESigningUserOverrideable *bool `plist:"SMIMESigningUserOverrideable,omitempty" json:"SMIMESigningUserOverrideable,omitempty"`
	// If `true`, the user can select the signing identity. Available in iOS 12.0 and later.
	SMIMESigningCertificateUUIDUserOverrideable *bool `plist:"SMIMESigningCertificateUUIDUserOverrideable,omitempty" json:"SMIMESigningCertificateUUIDUserOverrideable,omitempty"`
	// If `true`, the system enables S/MIME encryption by default. If
	// `SMIMEEnableEncryptionPerMessageSwitch` is `false`, the user can't change this default.
	// Available in iOS 12.0 and later.
	SMIMEEncryptByDefault *bool `plist:"SMIMEEncryptByDefault,omitempty" json:"SMIMEEncryptByDefault,omitempty"`
	// If `true`, the system enables encryption by default and the user can't change it.
	// Available in iOS 12.0 and later.
	SMIMEEncryptByDefaultUserOverrideable *bool `plist:"SMIMEEncryptByDefaultUserOverrideable,omitempty" json:"SMIMEEncryptByDefaultUserOverrideable,omitempty"`
	// If `true`, the user can select the S/MIME encryption identity, and encryption is
	// on.Available in iOS 12.0 and later.
	SMIMEEncryptionCertificateUUIDUserOverrideable *bool `` /* 128-byte string literal not displayed */
	// If `true`, the system displays the per-message encryption switch in the Mail Compose UI.
	// Available in iOS 12.0 and later.
	SMIMEEnableEncryptionPerMessageSwitch *bool `plist:"SMIMEEnableEncryptionPerMessageSwitch,omitempty" json:"SMIMEEnableEncryptionPerMessageSwitch,omitempty"`
	// If `false`, the system disables the Mail service for this account. The user can reenable
	// Mail service in Settings unless `EnableMailUserOverridable` is `false`.
	EnableMail *bool `plist:"EnableMail,omitempty" json:"EnableMail,omitempty"`
	// If `false`, the system disables the Contacts service for this account. The user can
	// reenable Contacts service in Settings unless `EnableContactsUserOverridable` is `false`.
	EnableContacts *bool `plist:"EnableContacts,omitempty" json:"EnableContacts,omitempty"`
	// If `false`, the system disables the Calendars service for this account. The user can
	// reenable Calendars service in Settings unless `EnableCalendarsUserOverridable` is
	// `false`.
	EnableCalendars *bool `plist:"EnableCalendars,omitempty" json:"EnableCalendars,omitempty"`
	// If `false`, the system disables the Reminders service for this account. The user can
	// reenable Reminders service in Settings unless `EnableRemindersUserOverridable` is
	// `false`.
	EnableReminders *bool `plist:"EnableReminders,omitempty" json:"EnableReminders,omitempty"`
	// If `false`, the system disables the Notes service for this account. The user can
	// reenable Notes service in Settings unless `EnableNotesUserOverridable` is `false`.
	EnableNotes *bool `plist:"EnableNotes,omitempty" json:"EnableNotes,omitempty"`
	// If `false`, the system prevents the user from changing the state of the Mail service for
	// this account in Settings.
	EnableMailUserOverridable *bool `plist:"EnableMailUserOverridable,omitempty" json:"EnableMailUserOverridable,omitempty"`
	// If `false`, the system prevents the user from changing the state of the Contacts service
	// for this account in Settings.
	EnableContactsUserOverridable *bool `plist:"EnableContactsUserOverridable,omitempty" json:"EnableContactsUserOverridable,omitempty"`
	// If `false`, the system prevents the user from changing the state of the Calendars
	// service for this account in Settings.
	EnableCalendarsUserOverridable *bool `plist:"EnableCalendarsUserOverridable,omitempty" json:"EnableCalendarsUserOverridable,omitempty"`
	// If `false`, the system prevents the user from changing the state of the Reminders
	// service for this account in Settings.
	EnableRemindersUserOverridable *bool `plist:"EnableRemindersUserOverridable,omitempty" json:"EnableRemindersUserOverridable,omitempty"`
	// If `false`, prevents the user from changing the state of the Notes service for this
	// account in Settings.
	EnableNotesUserOverridable *bool `plist:"EnableNotesUserOverridable,omitempty" json:"EnableNotesUserOverridable,omitempty"`
	// The URL that this account should use for signing in through OAuth. Ignored unless
	// `OAuth` is `true`. If you specify this URL, auto-discovery isn't used for this account,
	// so you need to also specify a host.
	OAuthSignInURL *string `plist:"OAuthSignInURL,omitempty" json:"OAuthSignInURL,omitempty"`
	// The URL that this account should use for token requests through OAuth. Ignored unless
	// `OAuth` is `true`.
	OAuthTokenRequestURL *string `plist:"OAuthTokenRequestURL,omitempty" json:"OAuthTokenRequestURL,omitempty"`
	// If `true`, the system overrides the previous user/EAS password with the new EAS password
	// in the payload. Available in iOS 14 and later.
	OverridePreviousPassword *bool `plist:"OverridePreviousPassword,omitempty" json:"OverridePreviousPassword,omitempty"`
	// The VPNUUID of the per-app VPN the account uses for network communication. Available in
	// iOS 14 and later.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type ExchangeActiveSyncCommunicationServiceRules struct {
	// The default handlers to use for contacts from this account.
	DefaultServiceHandlers *ExchangeActiveSyncCommunicationServiceRulesDefaultServiceHandlers `plist:"DefaultServiceHandlers,omitempty" json:"DefaultServiceHandlers,omitempty"`
}

type ExchangeActiveSyncCommunicationServiceRulesDefaultServiceHandlers struct {
	// The bundle identifier of the default application to use for audio calls made to contacts
	// from this account.
	AudioCall *string `plist:"AudioCall,omitempty" json:"AudioCall,omitempty"`
}

type ExchangeWebServices struct {
	// The full email address for the account. If the email address string isn't present in the
	// payload, the device prompts for it during profile installation.
	EmailAddress *string `plist:"EmailAddress,omitempty" json:"EmailAddress,omitempty"`
	// The Exchange server host name or IP address. Ignored if using OAuth.
	Host *string `plist:"Host,omitempty" json:"Host,omitempty"`
	// If `true`, the system enables SSL.
	SSL *bool `plist:"SSL,omitempty" json:"SSL,omitempty"`
	// If `true`, the system enables OAuth for authentication. Don't specify a password if
	// `OAuth` is `true`. Available in macOS 10.14 and later
	OAuth *bool `plist:"OAuth,omitempty" json:"OAuth,omitempty"`
	// The URL to load into a web view for authentication through OAuth when autodiscovery
	// isn't used. This setting requires a `Host` value.
	OAuthSignInURL *string `plist:"OAuthSignInURL,omitempty" json:"OAuthSignInURL,omitempty"`
	// The user name for this Exchange account. Required for noninteractive installation, such
	// as through MDM. If missing, the system prompts the user for it during interactive
	// profile installation.
	UserName *string `plist:"UserName,omitempty" json:"UserName,omitempty"`
	// The password of the account. Use only with encrypted profiles.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The UUID of the certificate payload within the same profile to use for the identity
	// credential. Supported on macOS 10.12 or later.
	PayloadCertificateUUID *string `plist:"PayloadCertificateUUID,omitempty" json:"PayloadCertificateUUID,omitempty"`
	// The UUID of the certificate payload within the same profile to use for the identity
	// credential. Supported on macOS 10.11 or later. On macOS 10.12 or later use the
	// PayloadCertificateUUID.
	AuthenticationCertificateUUID *string `plist:"AuthenticationCertificateUUID,omitempty" json:"AuthenticationCertificateUUID,omitempty"`
	// If `true`, the system enables Mail Drop.
	AllowMailDrop *bool `plist:"allowMailDrop,omitempty" json:"allowMailDrop,omitempty"`
	// The server path.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
	// The server port number.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The external server address.
	ExternalHost *string `plist:"ExternalHost,omitempty" json:"ExternalHost,omitempty"`
	// If `true`, the system enables SSL for connections to the external server.
	ExternalSSL *bool `plist:"ExternalSSL,omitempty" json:"ExternalSSL,omitempty"`
	// The external server path.
	ExternalPath *string `plist:"ExternalPath,omitempty" json:"ExternalPath,omitempty"`
	// The external server port number.
	ExternalPort *int64 `plist:"ExternalPort,omitempty" json:"ExternalPort,omitempty"`
}

type ExtensibleSingleSignOn struct {
	// The bundle identifier of the app extension that performs SSO for the specified URLs.
	ExtensionIdentifier string `plist:"ExtensionIdentifier" json:"ExtensionIdentifier"`
	// The team identifier of the app extension. This key is required on macOS and ignored
	// elsewhere.
	TeamIdentifier *string `plist:"TeamIdentifier,omitempty" json:"TeamIdentifier,omitempty"`
	// The type of SSO.
	Type string `plist:"Type" json:"Type"`
	// The realm name for `Credential` payloads. Use proper capitalization for this value.
	// Ignored for `Redirect` payloads.
	Realm *string `plist:"Realm,omitempty" json:"Realm,omitempty"`
	// A dictionary of arbitrary data passed through to the app extension.
	ExtensionData map[string]any `plist:"ExtensionData,omitempty" json:"ExtensionData,omitempty"`
	// An array of URL prefixes of identity providers where the app extension performs SSO.
	URLs []string `plist:"URLs,omitempty" json:"URLs,omitempty"`
	// An array of host or domain names that apps can authenticate through the app extension.
	Hosts []string `plist:"Hosts,omitempty" json:"Hosts,omitempty"`
	// If set to `Cancel`, the system cancels authentication requests when the screen is
	// locked. If set to `DoNotHandle`, the request continues without SSO instead. This doesn't
	// apply to requests where `userInterfaceEnabled` is `false`, or for background
	// `URLSession` requests. Available in iOS 15 and later, and macOS 12 and later.
	ScreenLockedBehavior *string `plist:"ScreenLockedBehavior,omitempty" json:"ScreenLockedBehavior,omitempty"`
	// An array of bundle identifiers of apps that don't use SSO provided by this extension.
	// Available in iOS 15 and later, and macOS 12 and later.
	DeniedBundleIdentifiers []string `plist:"DeniedBundleIdentifiers,omitempty" json:"DeniedBundleIdentifiers,omitempty"`
	// The Platform SSO authentication method the extension uses. Requires that the SSO
	// Extension also supports the method. Available in macOS 13 and later, and deprecated in
	// macOS 14.
	AuthenticationMethod *string `plist:"AuthenticationMethod,omitempty" json:"AuthenticationMethod,omitempty"`
	// The token this device uses for registration with Platform SSO. Use it for silent
	// registration with the Identity Provider. Requires that `AuthenticationMethod` in
	// `PlatformSSO` isn't empty. Available in macOS 13 and later.
	RegistrationToken *string `plist:"RegistrationToken,omitempty" json:"RegistrationToken,omitempty"`
	// The dictionary to configure Platform SSO. Requires `Type` to be set to `Redirect`.
	PlatformSSO *ExtensibleSingleSignOnPlatformSSO `plist:"PlatformSSO,omitempty" json:"PlatformSSO,omitempty"`
}

type ExtensibleSingleSignOnKerberos struct {
	// Set this to `com.apple.AppSSOKerberos.KerberosExtension` for this extension.
	ExtensionIdentifier string `plist:"ExtensionIdentifier" json:"ExtensionIdentifier"`
	// Set this to `apple` for this extension.
	TeamIdentifier string `plist:"TeamIdentifier" json:"TeamIdentifier"`
	// Set this to `Credential` for this extension.
	Type string `plist:"Type" json:"Type"`
	// The Kerberos realm. Use proper capitalization for this value. If in an Active Directory
	// forest, this is the realm where the user logs in.
	Realm string `plist:"Realm" json:"Realm"`
	// This is the dictionary used by the Apple built-in Kerberos extension.
	ExtensionData *ExtensibleSingleSignOnKerberosExtensionData `plist:"ExtensionData,omitempty" json:"ExtensionData,omitempty"`
	// One or more host or domain names for which the app extension performs SSO.
	Hosts []string `plist:"Hosts,omitempty" json:"Hosts,omitempty"`
}

type ExtensibleSingleSignOnKerberosExtensionData struct {
	// The GSS name of the Kerberos cache to use. Rarely set by an administrator.
	CacheName *string `plist:"cacheName,omitempty" json:"cacheName,omitempty"`
	// The principal (username) to use. You don't need to include the realm.
	PrincipalName *string `plist:"principalName,omitempty" json:"principalName,omitempty"`
	// The name of the Active Directory site the Kerberos extension should use. Most
	// administrators don't need to modify this value, as the Kerberos extension can normally
	// find the site automatically.
	SiteCode *string `plist:"siteCode,omitempty" json:"siteCode,omitempty"`
	// The PayloadUUID of a PKINIT certificate.
	CertificateUUID *string `plist:"certificateUUID,omitempty" json:"certificateUUID,omitempty"`
	// If `false`, the Kerberos extension doesn't automatically use LDAP and DNS to determine
	// its AD site name.
	UseSiteAutoDiscovery *bool `plist:"useSiteAutoDiscovery,omitempty" json:"useSiteAutoDiscovery,omitempty"`
	// A list of bundle IDs allowed to access the ticket-granting ticket (TGT).
	CredentialBundleIdACL []string `plist:"credentialBundleIdACL,omitempty" json:"credentialBundleIdACL,omitempty"`
	// If `true`, the Kerberos extension allows only managed apps to access and use the
	// credential. This is in addition to the `credentialBundleIDACL`, if you specify that
	// value. Available in iOS 14 and later, and macOS 12 and later.
	IncludeManagedAppsInBundleIdACL *bool `plist:"includeManagedAppsInBundleIdACL,omitempty" json:"includeManagedAppsInBundleIdACL,omitempty"`
	// If `true`, the Kerberos extension allows the standard Kerberos utilities including
	// `TicketViewer` and `klist` to access and use the credential. This is in addition to
	// `includeManagedAppsInBundleIdACL` or the `credentialBundleIdACL`, if you specify those
	// values. Available in macOS 12 and later.
	IncludeKerberosAppsInBundleIdACL *bool `plist:"includeKerberosAppsInBundleIdACL,omitempty" json:"includeKerberosAppsInBundleIdACL,omitempty"`
	// A custom domain-realm mapping for Kerberos. The system uses this when the DNS name of
	// hosts doesn't match the realm name. Most administrators don't need to customize this.
	DomainRealmMapping *ExtensibleSingleSignOnKerberosExtensionDataDomainRealmMapping `plist:"domainRealmMapping,omitempty" json:"domainRealmMapping,omitempty"`
	// Specifies whether this is the default realm if there's more than one Kerberos extension
	// configuration.
	IsDefaultRealm *bool `plist:"isDefaultRealm,omitempty" json:"isDefaultRealm,omitempty"`
	// The custom user name label used in the Kerberos extension instead of "Username," such as
	// "Company ID". Available in macOS 11 and later.
	CustomUsernameLabel *string `plist:"customUsernameLabel,omitempty" json:"customUsernameLabel,omitempty"`
	// The text to display to the user at the bottom of the Kerberos Login Window. You can also
	// use this to display help information or disclaimer text. Available in iOS 14 and later,
	// and macOS 11 and later.
	HelpText *string `plist:"helpText,omitempty" json:"helpText,omitempty"`
	// If `false`, the system disables password changes. Available in macOS 10.15 and later.
	AllowPasswordChange *bool `plist:"allowPasswordChange,omitempty" json:"allowPasswordChange,omitempty"`
	// If `false`, the system doesn't allow saving passwords in the keychain.
	AllowAutomaticLogin *bool `plist:"allowAutomaticLogin,omitempty" json:"allowAutomaticLogin,omitempty"`
	// If `true`, the system requires the user to provide Touch ID, Face ID or their passcode
	// to access the keychain entry.
	RequireUserPresence *bool `plist:"requireUserPresence,omitempty" json:"requireUserPresence,omitempty"`
	// The number of days that the system allows using passwords on this domain. For most
	// domains, this calculation is automatic. Available in macOS 10.15 and later.
	PwExpireOverride *int64 `plist:"pwExpireOverride,omitempty" json:"pwExpireOverride,omitempty"`
	// The number of days prior to password expiration when the system sends a notification of
	// password expiration to the user. Available in macOS 10.15 and later.
	PwNotificationDays *int64 `plist:"pwNotificationDays,omitempty" json:"pwNotificationDays,omitempty"`
	// The minimum length of passwords on the domain.Available in macOS 10.15 and later.
	PwReqLength *int64 `plist:"pwReqLength,omitempty" json:"pwReqLength,omitempty"`
	// If `true`, the system requires passwords to meet Active Directory's definition of
	// "complex". Available in macOS 10.15 and later.
	PwReqComplexity *bool `plist:"pwReqComplexity,omitempty" json:"pwReqComplexity,omitempty"`
	// The minimum age of passwords before the system allows changing them on this domain.
	// Available in macOS 10.15 and later.
	PwReqMinAge *int64 `plist:"pwReqMinAge,omitempty" json:"pwReqMinAge,omitempty"`
	// The number of prior passwords that the system disallows reuse on this domain. Available
	// in macOS 10.15 and later.
	PwReqHistory *int64 `plist:"pwReqHistory,omitempty" json:"pwReqHistory,omitempty"`
	// The text version of the domain's password requirements. Only for use if
	// `pwReqComplexity` or `pwReqLength` aren't specified. Available in macOS 10.15 and later.
	PwReqText *string `plist:"pwReqText,omitempty" json:"pwReqText,omitempty"`
	// The RTF file formatted version of the domain's password requirements. Only for use if
	// `pwReqComplexity` or `pwReqLength` aren't specified. Available in macOS 15 and later.
	PwReqRTFData []byte `plist:"pwReqRTFData,omitempty" json:"pwReqRTFData,omitempty"`
	// This URL will launch in the user's default web browser when they initiate a password
	// change. Available in macOS 10.15 and later.
	PwChangeURL *string `plist:"pwChangeURL,omitempty" json:"pwChangeURL,omitempty"`
	// If `false`, the system disables password sync. Note that this will not work if the user
	// is logged in with a mobile account. Available in macOS 10.15 and later.
	SyncLocalPassword *bool `plist:"syncLocalPassword,omitempty" json:"syncLocalPassword,omitempty"`
	// The time, in seconds, required to replicate changes in the Active Directory domain. The
	// Kerberos extension uses this when checking password age after a change. Available in
	// macOS 11 and later.
	ReplicationTime *int64 `plist:"replicationTime,omitempty" json:"replicationTime,omitempty"`
	// If `true`, the system doesn't prompt the user to setup the Kerberos extension until
	// either the administrator enables it with the `app-sso` tool or the system receives a
	// Kerberos challenge. Available in macOS 11 and later.
	DelayUserSetup *bool `plist:"delayUserSetup,omitempty" json:"delayUserSetup,omitempty"`
	// If `false`, the system requests the credential on the next matching Kerberos challenge
	// or network state change. If the credential is expired or missing, the system creates a
	// new one. Available in macOS 11 and later.
	MonitorCredentialsCache *bool `plist:"monitorCredentialsCache,omitempty" json:"monitorCredentialsCache,omitempty"`
	// Require that LDAP connections use TLS. Available in macOS 11 and later.
	RequireTLSForLDAP *bool `plist:"requireTLSForLDAP,omitempty" json:"requireTLSForLDAP,omitempty"`
	// This setting affects how other processes use the Kerberos Extension credential. Allowed
	// values:
	CredentialUseMode *string `plist:"credentialUseMode,omitempty" json:"credentialUseMode,omitempty"`
	// The ordered list of preferred Key Distribution Centers (KDCs) to use for Kerberos
	// traffic. Use this if the servers aren't discoverable through DNS. If the servers are
	// specified, then the system uses them for both connectivity checks and attempts to use
	// them first for Kerberos traffic. If the servers don't respond, the device falls back to
	// DNS discovery. Format each entry the same as it would be in a `krb5.conf` file, for
	// example:
	PreferredKDCs []string `plist:"preferredKDCs,omitempty" json:"preferredKDCs,omitempty"`
	// If `true`, the system requires this configuration uses a TGT from Platform SSO instead
	// of requesting a new one. Available in macOS 13 and later.
	UsePlatformSSOTGT *bool `plist:"usePlatformSSOTGT,omitempty" json:"usePlatformSSOTGT,omitempty"`
	// If `true` and `usePlatformSSOTGT` is `true`, the system allows the user to manually sign
	// in. Available in macOS 13 and later.
	AllowPlatformSSOAuthFallback *bool `plist:"allowPlatformSSOAuthFallback,omitempty" json:"allowPlatformSSOAuthFallback,omitempty"`
	// If `true`, the Kerberos Extension handles Kerberos requests only. It doesn't check for
	// password expiration, show the password expiration in the menu, check for external
	// password changes, perform password sync, or retrieve the home directory. Available in
	// macOS 13 and later.
	PerformKerberosOnly *bool `plist:"performKerberosOnly,omitempty" json:"performKerberosOnly,omitempty"`
	// A string with wildcards that can use used to filter the list of available SmartCards by
	// issuer. e.g "\*My CA2\*". If there is one remaining, it will be auto-selected. If there
	// more than one remaining, then the list is shorter. Available in macOS 15 and later.
	IdentityIssuerAutoSelectFilter *string `plist:"identityIssuerAutoSelectFilter,omitempty" json:"identityIssuerAutoSelectFilter,omitempty"`
	// If `true`, allow the user to switch the user interface to SmartCard mode. Available in
	// macOS 15 and later.
	AllowSmartCard *bool `plist:"allowSmartCard,omitempty" json:"allowSmartCard,omitempty"`
	// If `true`, allow the user to switch the user interface to Password mode. Available in
	// macOS 15 and later.
	AllowPassword *bool `plist:"allowPassword,omitempty" json:"allowPassword,omitempty"`
	// If `true`, the user interface will start in SmartCard mode. Available in macOS 15 and
	// later.
	StartInSmartCardMode *bool `plist:"startInSmartCardMode,omitempty" json:"startInSmartCardMode,omitempty"`
}

type ExtensibleSingleSignOnKerberosExtensionDataDomainRealmMapping struct {
	// The key should be the name of the realm, and the value is an array of DNS suffixes that
	// map to the realm.
	Realm []string `plist:"Realm,omitempty" json:"Realm,omitempty"`
}

type ExtensibleSingleSignOnPlatformSSO struct {
	// The Platform SSO authentication method to use with the extension. Requires that the SSO
	// Extension also support the method.
	AuthenticationMethod *string `plist:"AuthenticationMethod,omitempty" json:"AuthenticationMethod,omitempty"`
	// If `true`, the system uses the same signing and encryption keys for all users. Only
	// supported on the device channel.
	UseSharedDeviceKeys *bool `plist:"UseSharedDeviceKeys,omitempty" json:"UseSharedDeviceKeys,omitempty"`
	// The display name for the account in notifications and authentication requests.
	AccountDisplayName *string `plist:"AccountDisplayName,omitempty" json:"AccountDisplayName,omitempty"`
	// The duration, in seconds, until the system requires a full login instead of a refresh.
	// The default value is 64,800 (18 hours). The minimum value is 3600 (1 hour).
	LoginFrequency *int64 `plist:"LoginFrequency,omitempty" json:"LoginFrequency,omitempty"`
	// Enables creating users at the Login Window with an `AuthenticationMethod` of either
	// `Password` or `SmartCard`. Requires that `UseSharedDeviceKeys` is `true`.
	EnableCreateUserAtLogin *bool `plist:"EnableCreateUserAtLogin,omitempty" json:"EnableCreateUserAtLogin,omitempty"`
	// If `true`, the device uses Platform SSO to create the first user account on the Mac
	// during `Setup Assistant`.
	EnableCreateFirstUserDuringSetup *bool `plist:"EnableCreateFirstUserDuringSetup,omitempty" json:"EnableCreateFirstUserDuringSetup,omitempty"`
	// Enables using identity provider accounts at authorization prompts. Requires that
	// `UseSharedDeviceKeys` is `true`. The system assigns groups using `AdministratorGroups`,
	// `AdditionalGroups`, or `AuthorizationGroups`.
	EnableAuthorization *bool `plist:"EnableAuthorization,omitempty" json:"EnableAuthorization,omitempty"`
	// The attribute mapping to use when creating users, or for authorization.
	TokenToUserMapping *ExtensibleSingleSignOnPlatformSSOTokenToUserMapping `plist:"TokenToUserMapping,omitempty" json:"TokenToUserMapping,omitempty"`
	// The set of authentication methods to use for newly created accounts at login or during
	// `Setup Assistant`. The system uses `Password` and `SmartCard` if this key isn't present.
	NewUserAuthenticationMethods []string `plist:"NewUserAuthenticationMethods,omitempty" json:"NewUserAuthenticationMethods,omitempty"`
	// The permission to apply to newly created accounts at login. Allowed values:
	NewUserAuthorizationMode *string `plist:"NewUserAuthorizationMode,omitempty" json:"NewUserAuthorizationMode,omitempty"`
	// The permission to apply to an account each time the user authenticates. Allowed values:
	UserAuthorizationMode *string `plist:"UserAuthorizationMode,omitempty" json:"UserAuthorizationMode,omitempty"`
	// The list of groups to use for administrator access. The system requests membership
	// during authentication.
	AdministratorGroups []string `plist:"AdministratorGroups,omitempty" json:"AdministratorGroups,omitempty"`
	// The list of created groups that don't have administrator access.
	AdditionalGroups []string `plist:"AdditionalGroups,omitempty" json:"AdditionalGroups,omitempty"`
	// The pairing of Authorization Rights to group names. When using this, the system updates
	// the Authorization Right to use the group.
	AuthorizationGroups map[string]string `plist:"AuthorizationGroups,omitempty" json:"AuthorizationGroups,omitempty"`
	// The reader group identifier for use with the `AccessKey`. The value needs to match the
	// configured access key. Required if `NewUserAuthenticationMethods` contains `AccessKey`.
	AccessKeyReaderGroupIdentifier []byte `plist:"AccessKeyReaderGroupIdentifier,omitempty" json:"AccessKeyReaderGroupIdentifier,omitempty"`
	// The `PayloadUUID` of an identity payload to use as the `Terminal` identity of the access
	// key. The identity needs to be trusted by the access key. Required if
	// `NewUserAuthenticationMethods` includes `AccessKey`. Allowed identity payload types:
	AccessKeyTerminalIdentityUUID *string `plist:"AccessKeyTerminalIdentityUUID,omitempty" json:"AccessKeyTerminalIdentityUUID,omitempty"`
	// The `PayloadUUID` of a certificate payload for the issuer certificate of the `Terminal`
	// identity of the access key. Other specifications refer to the key as the "Reader CA
	// Public Key". The key must be an elliptic curve key. Required if
	// `NewUserAuthenticationMethods` includes `AccessKey`. The issuer of the Terminal identity
	// of the access key needs to match this certificate, otherwise the device fails the
	// authentication.
	AccessKeyReaderIssuerCertificateUUID *string `plist:"AccessKeyReaderIssuerCertificateUUID,omitempty" json:"AccessKeyReaderIssuerCertificateUUID,omitempty"`
	// If `true`, the system uses the access key in express mode, and doesn't require
	// authentication before use.
	AllowAccessKeyExpressMode *bool `plist:"AllowAccessKeyExpressMode,omitempty" json:"AllowAccessKeyExpressMode,omitempty"`
	// The policy to apply when using Platform SSO at FileVault unlock on a Mac with Apple
	// silicon. Applies when `AuthenticationMethod` is `Password`. Available in macOS 15 and
	// later.
	FileVaultPolicy []string `plist:"FileVaultPolicy,omitempty" json:"FileVaultPolicy,omitempty"`
	// The policy to apply when using Platform SSO at the Login Window. Applies when
	// `AuthenticationMethod` is `Password`. Available in macOS 15 and later.
	LoginPolicy []string `plist:"LoginPolicy,omitempty" json:"LoginPolicy,omitempty"`
	// The policy to apply when using Platform SSO at screensaver unlock. Applies when
	// `AuthenticationMethod` is `Password`. Available in macOS 15 and later.
	UnlockPolicy []string `plist:"UnlockPolicy,omitempty" json:"UnlockPolicy,omitempty"`
	// The amount of time after the last successful Platform SSO login for using a local
	// account password offline. Required when setting `AllowOfflineGracePeriod`. Available in
	// macOS 15 and later.
	OfflineGracePeriod *int64 `plist:"OfflineGracePeriod,omitempty" json:"OfflineGracePeriod,omitempty"`
	// The amount of time after receiving or updating a `FileVaultPolicy`, `LoginPolicy`, or
	// `UnlockPolicy` that the system can use unregistered local accounts. Required when
	// `AllowAuthenticationGracePeriod` is set. Available in macOS 15 and later.
	AuthenticationGracePeriod *int64 `plist:"AuthenticationGracePeriod,omitempty" json:"AuthenticationGracePeriod,omitempty"`
	// The list of local accounts that aren't subject to the `FileVaultPolicy`, `LoginPolicy`,
	// or `UnlockPolicy`. The accounts don't receive a prompt to register for Platform SSO.
	// Available in macOS 15 and later.
	NonPlatformSSOAccounts []string `plist:"NonPlatformSSOAccounts,omitempty" json:"NonPlatformSSOAccounts,omitempty"`
	// If `true`, the system includes the device UDID and serial number in Platform SSO
	// attestations.
	AllowDeviceIdentifiersInAttestation *bool `plist:"AllowDeviceIdentifiersInAttestation,omitempty" json:"AllowDeviceIdentifiersInAttestation,omitempty"`
	// If `true`, the system requests the user's profile picture from the SSO extension.
	SynchronizeProfilePicture *bool `plist:"SynchronizeProfilePicture,omitempty" json:"SynchronizeProfilePicture,omitempty"`
	// If `true`, the system uses a quicker Authenticated Guest Mode login to Mac behavior. The
	// system erases user data from only select locations in the user home directory after each
	// session completes. Once every eight hours the system erases the full user home directory
	// after a session completes. Turn this on for shared environments that have a high
	// frequency of short sessions.
	TemporarySessionQuickLogin *bool `plist:"TemporarySessionQuickLogin,omitempty" json:"TemporarySessionQuickLogin,omitempty"`
	// If `true`, the system enables the PlatformSSO registration process during Setup
	// Assistant on devices running macOS 26 and later. Set this key to `true` when configuring
	// PlatformSSO before enrollment using the `com.apple.psso.required` error response.
	EnableRegistrationDuringSetup *bool `plist:"EnableRegistrationDuringSetup,omitempty" json:"EnableRegistrationDuringSetup,omitempty"`
}

type ExtensibleSingleSignOnPlatformSSOTokenToUserMapping struct {
	// The claim name to use for the user's account name.
	AccountName *string `plist:"AccountName,omitempty" json:"AccountName,omitempty"`
	// The claim name to use for the user's full name.
	FullName *string `plist:"FullName,omitempty" json:"FullName,omitempty"`
}

type FDEFileVault struct {
	// Set to `On` to enable FileVault and set to `Off` to disable FileVault. Payloads set to
	// `On` sent through MDM need to either include full authentication information in the
	// payload or have the `Defer` option set to `true`. When `Defer` is `true`, the system
	// prompts for the authentication information when the user enables FileVault.
	Enable string `plist:"Enable" json:"Enable"`
	// If `true`, the system defers enabling FileVault until the designated user logs out. For
	// details, see `fdesetup(8)`. Only a local user or a mobile account user can enable
	// FileVault.
	Defer *bool `plist:"Defer,omitempty" json:"Defer,omitempty"`
	// If `true`, the system enables a prompt for missing user name or password fields.
	UserEntersMissingInfo *bool `plist:"UserEntersMissingInfo,omitempty" json:"UserEntersMissingInfo,omitempty"`
	// If `true`, the system creates a personal recovery key and displays it to the user.
	UseRecoveryKey *bool `plist:"UseRecoveryKey,omitempty" json:"UseRecoveryKey,omitempty"`
	// If `false`, the system prevents display of the personal recovery key to the user after
	// the system enables FileVault.
	ShowRecoveryKey *bool `plist:"ShowRecoveryKey,omitempty" json:"ShowRecoveryKey,omitempty"`
	// The path to the location of the recovery key and computer information property list.
	OutputPath *string `plist:"OutputPath,omitempty" json:"OutputPath,omitempty"`
	// The DER-encoded certificate data if the system creates an institutional recovery key.
	// This key isn't supported on a Mac with Apple silicon.
	Certificate []byte `plist:"Certificate,omitempty" json:"Certificate,omitempty"`
	// The UUID of the payload within the same profile containing the asymmetric recovery key
	// certificate payload.
	PayloadCertificateUUID *string `plist:"PayloadCertificateUUID,omitempty" json:"PayloadCertificateUUID,omitempty"`
	// The user name of the Open Directory user to add to FileVault.
	Username *string `plist:"Username,omitempty" json:"Username,omitempty"`
	// The password of the Open Directory user to add to FileVault. Use the
	// `UserEntersMissingInfo` key to prompt for this information.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// If `true` and you don't include certificate information in this payload, the system uses
	// the keychain created at `/Library/Keychains/FileVaultMaster.keychain` when it adds the
	// institutional recovery key.
	UseKeychain *bool `plist:"UseKeychain,omitempty" json:"UseKeychain,omitempty"`
	// The maximum number of times users can bypass enabling FileVault before the system
	// requires the user to enable it to log in. If the value is `0`, the system requires the
	// user to enable FileVault the next time they attempt to log in. Set this key to `-1` to
	// disable this feature.
	DeferForceAtUserLoginMaxBypassAttempts *int64 `plist:"DeferForceAtUserLoginMaxBypassAttempts,omitempty" json:"DeferForceAtUserLoginMaxBypassAttempts,omitempty"`
	// If `true`, the system prevents requests to enable FileVault at user logout time.
	DeferDontAskAtUserLogout *bool `plist:"DeferDontAskAtUserLogout,omitempty" json:"DeferDontAskAtUserLogout,omitempty"`
	// If `true`, and installation of this payload occurs after enrolling with MDM in Setup
	// Assistant, the system requests Setup Assistant to enable FileVault at setup time.
	ForceEnableInSetupAssistant *bool `plist:"ForceEnableInSetupAssistant,omitempty" json:"ForceEnableInSetupAssistant,omitempty"`
}

type FDEFileVaultOptions struct {
	// If `true`, the system won't disable FileVault.
	DontAllowFDEDisable *bool `plist:"dontAllowFDEDisable,omitempty" json:"dontAllowFDEDisable,omitempty"`
	// If `true`, the system won't enable FileVault.
	DontAllowFDEEnable *bool `plist:"dontAllowFDEEnable,omitempty" json:"dontAllowFDEEnable,omitempty"`
	// If `true`, the system won't store th FileVault key across restarts.
	DestroyFVKeyOnStandby *bool `plist:"DestroyFVKeyOnStandby,omitempty" json:"DestroyFVKeyOnStandby,omitempty"`
}

type FDERecoveryKeyEscrow struct {
	// The description of the location where the system escrows the recovery key. The system
	// inserts this text into the message the user sees when it enables FileVault.
	Location string `plist:"Location" json:"Location"`
	// The UUID of a payload within the same profile that contains the certificate that the
	// system uses to encrypt the recovery key. The referenced payload must be of type
	// `com.apple.security.pkcs1`.
	EncryptCertPayloadUUID string `plist:"EncryptCertPayloadUUID" json:"EncryptCertPayloadUUID"`
	// The string that's included in help text if the user appears to have forgotten the
	// password. Site admins can use this key to look up the escrowed key for the particular
	// computer.
	DeviceKey *string `plist:"DeviceKey,omitempty" json:"DeviceKey,omitempty"`
}

type FDERecoveryKeyRedirection struct {
	// The URL to which FDE recovery keys should be sent instead of to Apple. The URL must
	// begin with https://.
	RedirectURL string `plist:"RedirectURL" json:"RedirectURL"`
	// The UUID of a payload within the same profile that contains a certificate used to
	// encrypt the recovery key when it's sent to the redirected URL. The referenced payload
	// must be of type \`com.apple.security.pkcs1\`.
	EncryptCertPayloadUUID string `plist:"EncryptCertPayloadUUID" json:"EncryptCertPayloadUUID"`
}

type FileProvider struct {
	// If `false`, the device prevents the File Provider extension from using synchronization
	// in any app. Also, none of the other options will be evaluated. Synchronization will be
	// totally disabled for any application.
	ManagementAllowsRemoteSyncing *bool `plist:"ManagementAllowsRemoteSyncing,omitempty" json:"ManagementAllowsRemoteSyncing,omitempty"`
	// An array of strings representing the composed identifiers of apps. The device allows the
	// corresponding apps to use File Provider extension synchronization. If present, and
	// `ManagementAllowsRemoteSyncing` is set to `true`, the device allows only the apps in
	// this list to use synchronization. This key is ignored if `ManagementAllowsRemoteSyncing`
	// is set to `false`. If present, the other options will only be evaluated for the apps in
	// this list. The format of the app identifiers is "Bundle-ID (Team-ID)", for example
	// `com.example.app (ABCD1234)`.
	ManagementRemoteSyncingAllowList []string `plist:"ManagementRemoteSyncingAllowList,omitempty" json:"ManagementRemoteSyncingAllowList,omitempty"`
	// If `true`, enables file providers access to the path of the requesting process.
	AllowManagedFileProvidersToRequestAttribution *bool `` /* 126-byte string literal not displayed */
	// If `false`, the device prevents the File Provider extension from using desktop and
	// documents synchronization in any app. This does not impact the ability for apps to
	// utilize the File Provider extension for file and folder syncing with remote storage.
	ManagementAllowsKnownFolderSyncing *bool `plist:"ManagementAllowsKnownFolderSyncing,omitempty" json:"ManagementAllowsKnownFolderSyncing,omitempty"`
	// An array of strings representing the composed identifiers of apps. The device allows the
	// corresponding apps to use File Provider extension desktop and documents synchronization.
	// If present, and `ManagementAllowsKnownFolderSyncing` is set to `true`, the device allows
	// only the apps in this list to use desktop and documents synchronization. This key is
	// ignored if `ManagementAllowsKnownFolderSyncing` is set to `false`. This setting does not
	// impact the ability for apps to use File Provider extension volume access. The format of
	// the app identifiers is "Bundle-ID (Team-ID)", for example `com.example.app (ABCD1234)`.
	ManagementKnownFolderSyncingAllowList []string `plist:"ManagementKnownFolderSyncingAllowList,omitempty" json:"ManagementKnownFolderSyncingAllowList,omitempty"`
	// If `false`, the device only allows File Provider extension volume synchronization for
	// the system "home" volume and any data separated volume, and prevents synchronization
	// with any other volumes. If `true“, the device allows File Provider extension volume
	// synchronization for the system "home" volume, any data separated volume, and any
	// encrypted APFS volumes (on either internal or external media).
	ManagementAllowsExternalVolumeSyncing *bool `plist:"ManagementAllowsExternalVolumeSyncing,omitempty" json:"ManagementAllowsExternalVolumeSyncing,omitempty"`
	// An array of strings representing the composed identifiers of apps. The device allows the
	// corresponding apps to use File Provider extension volume synchronization. If present,
	// and `ManagementAllowsExternalVolumeSyncing` is set to `true`, the device allows only the
	// apps in this list to use volume synchronization. This key is ignored if
	// `ManagementAllowsExternalVolumeSyncing` is set to `false`. The format of the app
	// identifiers is "Bundle-ID (Team-ID)", for example `com.example.app (ABCD1234)`.
	ManagementExternalVolumeSyncingAllowList []string `plist:"ManagementExternalVolumeSyncingAllowList,omitempty" json:"ManagementExternalVolumeSyncingAllowList,omitempty"`
	// An array of strings representing the composed identifiers of apps. The device
	// automatically enables the File Provider domains for the corresponding apps. The device
	// doesn't enable existing domains if enrollment happens after they are created. The device
	// doesn't prevent the user from disabling these File Provider domains. Users need to
	// manually enable File Provider domains in the Finder if their corresponding apps aren't
	// listed here. The format of the app identifiers is "Bundle-ID (Team-ID)", for example
	// `com.example.app (ABCD1234)`.
	ManagementDomainAutoEnablementList []string `plist:"ManagementDomainAutoEnablementList,omitempty" json:"ManagementDomainAutoEnablementList,omitempty"`
}

type Finder struct {
	// If `true`, the system disables the Finder's burn support.
	ProhibitBurn *bool `plist:"ProhibitBurn,omitempty" json:"ProhibitBurn,omitempty"`
	// Specifies whether Finder should operate in Simple or Full mode.
	InterfaceLevel *string `plist:"InterfaceLevel,omitempty" json:"InterfaceLevel,omitempty"`
	// If `true`, the system disables Connect to Server.
	ProhibitConnectTo *bool `plist:"ProhibitConnectTo,omitempty" json:"ProhibitConnectTo,omitempty"`
	// If `true`, the system disables Eject.
	ProhibitEject *bool `plist:"ProhibitEject,omitempty" json:"ProhibitEject,omitempty"`
	// If `true`, the system disables Go to Folder.
	ProhibitGoToFolder *bool `plist:"ProhibitGoToFolder,omitempty" json:"ProhibitGoToFolder,omitempty"`
	// If `false`, the system doesn't show external hard drives on the Desktop.
	ShowExternalHardDrivesOnDesktop *bool `plist:"ShowExternalHardDrivesOnDesktop,omitempty" json:"ShowExternalHardDrivesOnDesktop,omitempty"`
	// If `false`, the system doesn't show internal hard drives on the Desktop.
	ShowHardDrivesOnDesktop *bool `plist:"ShowHardDrivesOnDesktop,omitempty" json:"ShowHardDrivesOnDesktop,omitempty"`
	// If `false`, the system doesn't show mounted file servers on the Desktop.
	ShowMountedServersOnDesktop *bool `plist:"ShowMountedServersOnDesktop,omitempty" json:"ShowMountedServersOnDesktop,omitempty"`
	// If `false`, the system doesn't show removable media items on the Desktop.
	ShowRemovableMediaOnDesktop *bool `plist:"ShowRemovableMediaOnDesktop,omitempty" json:"ShowRemovableMediaOnDesktop,omitempty"`
	// If `false`, the system doesn't warn the user before emptying the trash.
	WarnOnEmptyTrash *bool `plist:"WarnOnEmptyTrash,omitempty" json:"WarnOnEmptyTrash,omitempty"`
}

type Firewall struct {
	// If `true`, the system enables the firewall.
	EnableFirewall bool `plist:"EnableFirewall" json:"EnableFirewall"`
	// If `true`, the system enables blocking all incoming connections.
	BlockAllIncoming *bool `plist:"BlockAllIncoming,omitempty" json:"BlockAllIncoming,omitempty"`
	// If `true`, the system enables stealth mode.
	EnableStealthMode *bool `plist:"EnableStealthMode,omitempty" json:"EnableStealthMode,omitempty"`
	// The list of apps with connections that the firewall controls.
	Applications []FirewallApplications `plist:"Applications,omitempty" json:"Applications,omitempty"`
	// If `true`, the system enables logging. Available in macOS 12 through macOS 14.6.
	EnableLogging *bool `plist:"EnableLogging,omitempty" json:"EnableLogging,omitempty"`
	// The type of logging. Available in macOS 12 and through macOS 14.6.
	LoggingOption *string `plist:"LoggingOption,omitempty" json:"LoggingOption,omitempty"`
	// If `true`, the system allows built-in software to receive incoming connections.
	// Available in macOS 12.3 and later.
	AllowSigned *bool `plist:"AllowSigned,omitempty" json:"AllowSigned,omitempty"`
	// If `true`, the system allows downloaded signed software to receive incoming connections.
	// Available in macOS 12.3 and later.
	AllowSignedApp *bool `plist:"AllowSignedApp,omitempty" json:"AllowSignedApp,omitempty"`
}

type FirewallApplications struct {
	// The bundle identifier for the app.
	BundleID string `plist:"BundleID" json:"BundleID"`
	// If `true`, the system allows connections for the app.
	Allowed bool `plist:"Allowed" json:"Allowed"`
}

type Font struct {
	// The user-visible name for the font. This field is replaced by the actual name of the
	// font after installation. Each payload must contain exactly one font file in trueType
	// (.ttf) or OpenType (.otf) format. Collection formats (.ttc or .otc) are not supported.
	Name *string `plist:"Name,omitempty" json:"Name,omitempty"`
	// The contents of the font file.
	Font []byte `plist:"Font,omitempty" json:"Font,omitempty"`
}

type GlobalHTTPProxy struct {
	// The proxy type. For a manual proxy type, the profile contains the proxy server address,
	// including its port, and optionally a user name and password. For an auto proxy type, you
	// can enter a PAC URL.
	ProxyType *string `plist:"ProxyType,omitempty" json:"ProxyType,omitempty"`
	// The proxy server's network address. The device requires this if `ProxyType` is set to
	// `Manual`, and ignores it if `ProxyType` is set to `Automatic`.
	ProxyServer *string `plist:"ProxyServer,omitempty" json:"ProxyServer,omitempty"`
	// The proxy server's port number. The device requires this if `ProxyType` is set to
	// `Manual`, and ignores this if `ProxyType` is set to `Automatic`.
	ProxyServerPort *int64 `plist:"ProxyServerPort,omitempty" json:"ProxyServerPort,omitempty"`
	// The user name used to authenticate to the proxy server. The device only uses this if
	// `ProxyType` is set to `Manual`, and ignores it if `ProxyType` is set to `Automatic`.
	ProxyUsername *string `plist:"ProxyUsername,omitempty" json:"ProxyUsername,omitempty"`
	// The password used to authenticate to the proxy server. The device only uses this if
	// `ProxyType` is set to `Manual`, and ignores it if `ProxyType` is set to `Automatic`.
	ProxyPassword *string `plist:"ProxyPassword,omitempty" json:"ProxyPassword,omitempty"`
	// The URL of the PAC file that defines the proxy configuration. Starting in iOS 13 and
	// macOS 10.15, only URLs that begin with `http://` or `https://` are allowed. This is only
	// used if `ProxyType` is set to `Automatic`, and is ignored if `ProxyType` is set to
	// `Manual`.
	ProxyPACURL *string `plist:"ProxyPACURL,omitempty" json:"ProxyPACURL,omitempty"`
	// If `true`, allows connecting directly to the destination if the proxy autoconfiguration
	// (PAC) file is unreachable.
	ProxyPACFallbackAllowed *bool `plist:"ProxyPACFallbackAllowed,omitempty" json:"ProxyPACFallbackAllowed,omitempty"`
	// If `true`, allows the device to bypass the proxy server to display the login page for
	// captive networks.
	ProxyCaptiveLoginAllowed *bool `plist:"ProxyCaptiveLoginAllowed,omitempty" json:"ProxyCaptiveLoginAllowed,omitempty"`
}

type GlobalPreferences struct {
	// If `false`, disables fast user switching.
	MultipleSessionEnabled *bool `plist:"MultipleSessionEnabled,omitempty" json:"MultipleSessionEnabled,omitempty"`
	// The `autologout` delay, in seconds. A value of `0` means `autologout` is off. In some
	// cases, this delay may be restricted to values between 5 minutes and 24 hours.
	ComAppleAutologoutAutoLogOutDelay *float64 `plist:"com.apple.autologout.AutoLogOutDelay,omitempty" json:"com.apple.autologout.AutoLogOutDelay,omitempty"`
}

type GoogleAccount struct {
	// A user-visible description of the Google account, shown in the Mail and Settings apps.
	AccountDescription *string `plist:"AccountDescription,omitempty" json:"AccountDescription,omitempty"`
	// The user's full name for the Google account. This name appears in sent messages.
	AccountName *string `plist:"AccountName,omitempty" json:"AccountName,omitempty"`
	// The full Google email address for the account.
	EmailAddress string `plist:"EmailAddress" json:"EmailAddress"`
	// The communication service handler rules for this account.
	CommunicationServiceRules *GoogleAccountCommunicationServiceRules `plist:"CommunicationServiceRules,omitempty" json:"CommunicationServiceRules,omitempty"`
	// The VPNUUID of the per-app VPN the account uses for network communication. Available in
	// iOS 14 and later.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type GoogleAccountCommunicationServiceRules struct {
	// A dictionary that defines which app to use for audio calls from this account.
	DefaultServiceHandlers *GoogleAccountCommunicationServiceRulesDefaultServiceHandlers `plist:"DefaultServiceHandlers,omitempty" json:"DefaultServiceHandlers,omitempty"`
}

type GoogleAccountCommunicationServiceRulesDefaultServiceHandlers struct {
	// The bundle identifier for the default application that handles audio calls to contacts
	// from this account.
	AudioCall *string `plist:"AudioCall,omitempty" json:"AudioCall,omitempty"`
}

type HomeScreenLayout struct {
	// An array of dictionaries, each of which must conform to the icon dictionary format. If
	// this key isn't present, the user's Dock is empty.
	Dock []HomeScreenLayoutIconItem `plist:"Dock,omitempty" json:"Dock,omitempty"`
	// An array of arrays of dictionaries, each of which must conform to the icon dictionary
	// format.
	Pages [][]HomeScreenLayoutPagesItemIconItem `plist:"Pages,omitempty" json:"Pages,omitempty"`
}

type HomeScreenLayoutIconItem struct {
	// The type of the Dock item.
	Type string `plist:"Type" json:"Type"`
	// The human-readable string shown to the user. This setting is valid only if the type is
	// `Folder`.
	DisplayName *string `plist:"DisplayName,omitempty" json:"DisplayName,omitempty"`
	// The bundle identifier of the app. This setting is required if the type is `Application`.
	BundleID *string `plist:"BundleID,omitempty" json:"BundleID,omitempty"`
	// An array of arrays of dictionaries, each conforming to the icon dictionary format. This
	// setting is valid only if the type is `Folder`.
	Pages [][]HomeScreenLayoutIconItem `plist:"Pages,omitempty" json:"Pages,omitempty"`
	// The URL of the existing web clip for this item. This setting is required if `type` is
	// `WebClip`. If more than one web clip exists with the same URL, the behavior is
	// undefined.
	URL *string `plist:"URL,omitempty" json:"URL,omitempty"`
}

type HomeScreenLayoutPagesItemIconItem struct {
	// The type of the Dock item.
	Type string `plist:"Type" json:"Type"`
	// The human-readable string shown to the user. This setting is valid only if the type is
	// `Folder`.
	DisplayName *string `plist:"DisplayName,omitempty" json:"DisplayName,omitempty"`
	// The bundle identifier of the app. This setting is required if the type is `Application`.
	BundleID *string `plist:"BundleID,omitempty" json:"BundleID,omitempty"`
	// An array of arrays of dictionaries, each conforming to the icon dictionary format. This
	// setting is valid only if the type is `Folder`.
	Pages [][]HomeScreenLayoutPagesItemIconItem `plist:"Pages,omitempty" json:"Pages,omitempty"`
	// The URL of the existing web clip for this item. This setting is required if `type` is
	// `WebClip`. If more than one web clip exists with the same URL, the behavior is
	// undefined.
	URL *string `plist:"URL,omitempty" json:"URL,omitempty"`
}

type Identification struct {
	// The dictionary that contains details about the user.
	PayloadIdentification IdentificationPayloadIdentification `plist:"PayloadIdentification,omitempty" json:"PayloadIdentification,omitempty"`
}

type IdentificationPayloadIdentification struct {
	// The UNIX user name for the accounts.
	UserName string `plist:"UserName" json:"UserName"`
	// The full name of the account.
	FullName string `plist:"FullName" json:"FullName"`
	// The address for the account.
	EmailAddress string `plist:"EmailAddress" json:"EmailAddress"`
	// The authorization method. Either the profile contains the password or the user provides
	// it.
	AuthMethod string `plist:"AuthMethod" json:"AuthMethod"`
	// The password for the account. Required when the `AuthMethod` is `Password`.
	Password string `plist:"Password" json:"Password"`
	// The custom instructions for the user, if needed.
	Prompt *string `plist:"Prompt,omitempty" json:"Prompt,omitempty"`
	// The additional descriptive text for the user prompt.
	PromptMessage *string `plist:"PromptMessage,omitempty" json:"PromptMessage,omitempty"`
}

type IdentityPreference struct {
	// The email address (in RFC 822 format), DNS host name, or other name that uniquely
	// identifies a service requiring this identity.
	Name string `plist:"Name" json:"Name"`
	// The UUID of the certificate payload within the same profile to use for the identity
	// credential.
	PayloadCertificateUUID string `plist:"PayloadCertificateUUID" json:"PayloadCertificateUUID"`
}

type JabberAccount struct {
	// The description of the account.
	JabberAccountDescription *string `plist:"JabberAccountDescription,omitempty" json:"JabberAccountDescription,omitempty"`
	// The server's address.
	JabberHostName string `plist:"JabberHostName" json:"JabberHostName"`
	// The user's user name.
	JabberUserName *string `plist:"JabberUserName,omitempty" json:"JabberUserName,omitempty"`
	// The user's password.
	JabberPassword *string `plist:"JabberPassword,omitempty" json:"JabberPassword,omitempty"`
	// If `true`, enables SSL.
	JabberUseSSL *bool `plist:"JabberUseSSL,omitempty" json:"JabberUseSSL,omitempty"`
	// The server's port.
	JabberPort *int64 `plist:"JabberPort,omitempty" json:"JabberPort,omitempty"`
	// The authentication method for the account.
	JabberAuthentication string `plist:"JabberAuthentication" json:"JabberAuthentication"`
}

type LDAP struct {
	// The description of the account.
	LDAPAccountDescription *string `plist:"LDAPAccountDescription,omitempty" json:"LDAPAccountDescription,omitempty"`
	// The server's address.
	LDAPAccountHostName string `plist:"LDAPAccountHostName" json:"LDAPAccountHostName"`
	// The user's user name.
	LDAPAccountUserName *string `plist:"LDAPAccountUserName,omitempty" json:"LDAPAccountUserName,omitempty"`
	// The user's password. Only use this in encrypted profiles.
	LDAPAccountPassword *string `plist:"LDAPAccountPassword,omitempty" json:"LDAPAccountPassword,omitempty"`
	// If `true`, the system enables SSL.
	LDAPAccountUseSSL *bool `plist:"LDAPAccountUseSSL,omitempty" json:"LDAPAccountUseSSL,omitempty"`
	// An array of search settings dictionaries.
	LDAPSearchSettings []LDAPLDAPSearchSettings `plist:"LDAPSearchSettings,omitempty" json:"LDAPSearchSettings,omitempty"`
	// The VPNUUID of the per-app VPN the account uses for network communication. Available in
	// iOS 14 and later.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type LDAPLDAPSearchSettings struct {
	// The description of this search setting.
	LDAPSearchSettingDescription *string `plist:"LDAPSearchSettingDescription,omitempty" json:"LDAPSearchSettingDescription,omitempty"`
	// The path to the node where a search should start.
	LDAPSearchSettingSearchBase string `plist:"LDAPSearchSettingSearchBase" json:"LDAPSearchSettingSearchBase"`
	// The type of recursion to use in the search:
	LDAPSearchSettingScope *string `plist:"LDAPSearchSettingScope,omitempty" json:"LDAPSearchSettingScope,omitempty"`
}

type LightsOutManagementLOM struct {
	// The UUID certificate for the device. This key indicates the device can receive
	// `PowerON`, `PowerOFF`, and `Reset` requests from a LOM controller. This certificate must
	// contain the Key Usage attributes of Digital Signature, Key Encipherment and Data
	// Encipherment. As well as the Extended Key Usage attributes of Server Authentication and
	// Client Authentication.
	DeviceCertificateUUID *string `plist:"DeviceCertificateUUID,omitempty" json:"DeviceCertificateUUID,omitempty"`
	// The UUID certificate for the LOM controller. This key configures the device to accept
	// the `LOMDeviceRequestCommand` from MDM and then send it to the target device.
	ControllerCertificateUUID *string `plist:"ControllerCertificateUUID,omitempty" json:"ControllerCertificateUUID,omitempty"`
	// An array of payload UUIDs containing CA certificates that controllers use to evaluate
	// trust of device certificates.
	DeviceCACertificateUUIDs []string `plist:"DeviceCACertificateUUIDs,omitempty" json:"DeviceCACertificateUUIDs,omitempty"`
	// An array of payload UUIDs containing CA certificates that devices use to evaluate trust
	// of controller certificates.
	ControllerCACertificateUUIDs []string `plist:"ControllerCACertificateUUIDs,omitempty" json:"ControllerCACertificateUUIDs,omitempty"`
}

type LockScreenMessage struct {
	// The asset tag information for the device, displayed in the Login Window and Lock Screen.
	AssetTagInformation *string `plist:"AssetTagInformation,omitempty" json:"AssetTagInformation,omitempty"`
	// Deprecated. Use `LockScreenFootnote` instead.
	IfLostReturnToMessage *string `plist:"IfLostReturnToMessage,omitempty" json:"IfLostReturnToMessage,omitempty"`
	// The footnote displayed in the Login Window and Lock Screen.
	LockScreenFootnote *string `plist:"LockScreenFootnote,omitempty" json:"LockScreenFootnote,omitempty"`
}

type LoginItemsManagedItems struct {
	// An array of login item dictionaries.
	AutoLaunchedApplicationDictionaryManaged []LoginItemsManagedItemsAutoLaunchedApplicationDictionaryManaged `plist:"AutoLaunchedApplicationDictionary-managed,omitempty" json:"AutoLaunchedApplicationDictionary-managed,omitempty"`
}

type LoginItemsManagedItemsAutoLaunchedApplicationDictionaryManaged struct {
	// The URL or path string to the item's location.
	Path string `plist:"Path" json:"Path"`
	// If `true`, the system hides this item in the Users & Groups login items list.
	Hide *bool `plist:"Hide,omitempty" json:"Hide,omitempty"`
}

type LoginWindow struct {
	// If `true`, the system shows the name and password dialog. If `false`, the system
	// displays a list of users.
	SHOWFULLNAME *bool `plist:"SHOWFULLNAME,omitempty" json:"SHOWFULLNAME,omitempty"`
	// If `true`, the system shows only network and system users when showing a user list.
	HideLocalUsers *bool `plist:"HideLocalUsers,omitempty" json:"HideLocalUsers,omitempty"`
	// If `true`, the system shows network users when showing a user list.
	IncludeNetworkUser *bool `plist:"IncludeNetworkUser,omitempty" json:"IncludeNetworkUser,omitempty"`
	// If `true`, the system hides administrator users when showing a user list.
	HideAdminUsers *bool `plist:"HideAdminUsers,omitempty" json:"HideAdminUsers,omitempty"`
	// If `true`, the system displays "Other..." when it shows a list of users.
	SHOWOTHERUSERSMANAGED *bool `plist:"SHOWOTHERUSERS_MANAGED,omitempty" json:"SHOWOTHERUSERS_MANAGED,omitempty"`
	// The admin host info. If present in the payload, the system displays its value in the
	// Login Window as additional computer information. Before macOS 10.10, this string could
	// only contain host name, system version, or IP address. After macOS 10.10, setting this
	// key to any value allows the user to click the time area of the menu bar to toggle
	// through various computer information values.
	AdminHostInfo *string `plist:"AdminHostInfo,omitempty" json:"AdminHostInfo,omitempty"`
	// The list of user GUIDs or group GUIDs of users that the system allows to log in. An
	// asterisk (`*`) string specifies all users or groups. This only applies to network
	// accounts and mobile accounts.
	AllowList []string `plist:"AllowList,omitempty" json:"AllowList,omitempty"`
	// The list of user GUIDs or group GUIDs of users that the system disallows to log in. This
	// list takes priority over the list in the `AllowList` key. This only applies to network
	// accounts and mobile accounts.
	DenyList []string `plist:"DenyList,omitempty" json:"DenyList,omitempty"`
	// If `true`, the system hides mobile account users in a user list. In some cases, mobile
	// users show up as network users.
	HideMobileAccounts *bool `plist:"HideMobileAccounts,omitempty" json:"HideMobileAccounts,omitempty"`
	// If `true`, the system disables the Shut Down button.
	ShutDownDisabled *bool `plist:"ShutDownDisabled,omitempty" json:"ShutDownDisabled,omitempty"`
	// If `true`, the system disables the Restart item.
	RestartDisabled *bool `plist:"RestartDisabled,omitempty" json:"RestartDisabled,omitempty"`
	// If `true`, the system disables the Sleep button.
	SleepDisabled *bool `plist:"SleepDisabled,omitempty" json:"SleepDisabled,omitempty"`
	// If `true`, the system disregards the `>console` special user name, which provides a
	// command line UI.
	DisableConsoleAccess *bool `plist:"DisableConsoleAccess,omitempty" json:"DisableConsoleAccess,omitempty"`
	// The text to display in the Login Window.
	LoginwindowText *string `plist:"LoginwindowText,omitempty" json:"LoginwindowText,omitempty"`
	// If `true`, the system disables the Shut Down menu item when the user is logged in.
	ShutDownDisabledWhileLoggedIn *bool `plist:"ShutDownDisabledWhileLoggedIn,omitempty" json:"ShutDownDisabledWhileLoggedIn,omitempty"`
	// If `true`, the system disables the Restart menu item when the user is logged in.
	RestartDisabledWhileLoggedIn *bool `plist:"RestartDisabledWhileLoggedIn,omitempty" json:"RestartDisabledWhileLoggedIn,omitempty"`
	// If `true`, the system disables the Power Off menu item when the user is logged in.
	PowerOffDisabledWhileLoggedIn *bool `plist:"PowerOffDisabledWhileLoggedIn,omitempty" json:"PowerOffDisabledWhileLoggedIn,omitempty"`
	// If `true`, the system disables the Log Out menu item when the user is logged in.
	// Available in macOS 10.13 and later.
	LogOutDisabledWhileLoggedIn *bool `plist:"LogOutDisabledWhileLoggedIn,omitempty" json:"LogOutDisabledWhileLoggedIn,omitempty"`
	// If `true`, the system disables the immediate Screen Lock functions. Available in macOS
	// 10.13 and later.
	DisableScreenLockImmediate *bool `plist:"DisableScreenLockImmediate,omitempty" json:"DisableScreenLockImmediate,omitempty"`
	// If `true`, the system shows the Input Menu in the Login Window.
	ShowInputMenu *bool `plist:"showInputMenu,omitempty" json:"showInputMenu,omitempty"`
	// If `true`, the system disables the automatic login option when using FileVault.
	DisableFDEAutoLogin *bool `plist:"DisableFDEAutoLogin,omitempty" json:"DisableFDEAutoLogin,omitempty"`
	// The user short name for an existing user to set up auto login.
	AutologinUsername *string `plist:"AutologinUsername,omitempty" json:"AutologinUsername,omitempty"`
	// An optional user password to set up auto login. This must match the `AutologinUsername`
	// user's current password.
	AutologinPassword *string `plist:"AutologinPassword,omitempty" json:"AutologinPassword,omitempty"`
}

type LoginWindowLoginItems struct {
	// If `true`, the system prevents the user from disabling login item launches by using the
	// Shift key.
	DisableLoginItemsSuppression *bool `plist:"DisableLoginItemsSuppression,omitempty" json:"DisableLoginItemsSuppression,omitempty"`
}

type LoginWindowScripts struct {
	// An array of one or more dictionaries of scripts to run at user login time.
	Loginscripts []LoginWindowScriptsScriptsItems `plist:"loginscripts,omitempty" json:"loginscripts,omitempty"`
	// An array of one or more dictionaries of scripts to run at user logout time.
	Logoutscripts []LoginWindowScriptsScriptsItems `plist:"logoutscripts,omitempty" json:"logoutscripts,omitempty"`
	// If `true`, the system doesn't execute the login scripts during login.
	SkipLoginHook *bool `plist:"skipLoginHook,omitempty" json:"skipLoginHook,omitempty"`
	// If `true`, the system doesn't execute the logout scripts during logout.
	SkipLogoutHook *bool `plist:"skipLogoutHook,omitempty" json:"skipLogoutHook,omitempty"`
}

type LoginWindowScriptsScriptsItems struct {
	// The filename for display purposes.
	Filename string `plist:"filename" json:"filename"`
	// The UTF-8 encoded data object representing the executable script.
	Filedata []byte `plist:"filedata,omitempty" json:"filedata,omitempty"`
}

type MDM struct {
	// The UUID of the certificate payload for the device's identity. It may also point to a
	// SCEP payload.
	IdentityCertificateUUID string `plist:"IdentityCertificateUUID" json:"IdentityCertificateUUID"`
	// The topic that MDM listens to for push notifications. The certificate that the server
	// uses to send push notifications must have the same topic in its subject. The topic must
	// begin with the 'com.apple.mgmt.' prefix.
	Topic string `plist:"Topic" json:"Topic"`
	// The URL that the device contacts to retrieve device management instructions. The URL
	// must begin with the `https://` URL scheme, and may contain a port number (`:1234`, for
	// example).
	ServerURL string `plist:"ServerURL" json:"ServerURL"`
	// The URL that the device should use to check in during installation. The URL must begin
	// with the `https://` URL scheme and may contain a port number (`:1234`, for example). If
	// not set, the system uses `ServerURL`.
	CheckInURL *string `plist:"CheckInURL,omitempty" json:"CheckInURL,omitempty"`
	// If 'true', each message coming from the device carries the additional 'Mdm-Signature'
	// HTTP header.
	SignMessage *bool `plist:"SignMessage,omitempty" json:"SignMessage,omitempty"`
	// Logical OR of the following bit flags:
	AccessRights *int64 `plist:"AccessRights,omitempty" json:"AccessRights,omitempty"`
	// If 'true', the device uses the development APNS servers. Otherwise, the device uses the
	// production servers. Set to 'false' if your Apple Push Notification Service certificate
	// was issued by the Apple Push Certificate Portal ('https://identity.apple.com/pushcert').
	// That portal only issues certificates for the production push environment.
	UseDevelopmentAPNS *bool `plist:"UseDevelopmentAPNS,omitempty" json:"UseDevelopmentAPNS,omitempty"`
	// The Managed Apple Account of the user. Previously required for profile-driven user
	// enrollment. Removed as of iOS 18 and macOS 15.
	ManagedAppleID *string `plist:"ManagedAppleID,omitempty" json:"ManagedAppleID,omitempty"`
	// The Managed Apple Account pre-assigned to the authenticated user. Required for
	// account-driven enrollments. Available in iOS 15 and later, and macOS 14 and later.
	AssignedManagedAppleID *string `plist:"AssignedManagedAppleID,omitempty" json:"AssignedManagedAppleID,omitempty"`
	// The enrollment mode the server indicates to use when enrolling. Required for
	// account-driven enrollment. Available in iOS 15 and macOS 14, and later.
	EnrollmentMode *string `plist:"EnrollmentMode,omitempty" json:"EnrollmentMode,omitempty"`
	// An array of strings, each containing the UUID of a certificate to use when evaluating
	// trust to the '.../connect/' URLs of MDM servers.
	ServerURLPinningCertificateUUIDs []string `plist:"ServerURLPinningCertificateUUIDs,omitempty" json:"ServerURLPinningCertificateUUIDs,omitempty"`
	// An array of strings, each containing the payload UUID of a certificate to use when
	// evaluating trust to the '.../checkin/' URLs of MDM servers.
	CheckInURLPinningCertificateUUIDs []string `plist:"CheckInURLPinningCertificateUUIDs,omitempty" json:"CheckInURLPinningCertificateUUIDs,omitempty"`
	// If 'true', the system fails the connection attempt unless it obtains a verified positive
	// response during certificate revocation checks. If 'false', the system performs
	// revocation checks on a best-attempt basis, where failure to reach the server isn't
	// considered fatal.
	PinningRevocationCheckRequired *bool `plist:"PinningRevocationCheckRequired,omitempty" json:"PinningRevocationCheckRequired,omitempty"`
	// A unique array of strings indicating server capabilities:
	ServerCapabilities []string `plist:"ServerCapabilities,omitempty" json:"ServerCapabilities,omitempty"`
	// If 'true', the device attempts to send a `Check-Out` message to the 'CheckInURL' when
	// the profile is removed.
	CheckOutWhenRemoved *bool `plist:"CheckOutWhenRemoved,omitempty" json:"CheckOutWhenRemoved,omitempty"`
	// This property specifies an iTunes Store ID for an app the system can install with the
	// InstallApplicationCommand, without any approval from the user. The MDM vendor or
	// managing organization generally provides this app, which enhances the management
	// experience for the user. The device shows the user details about this app in the
	// account-driven enrollment process prior to installing the MDM profile. Use this property
	// with account-driven MDM enrollments that normally require user approval for app installs
	// through MDM. Only account-driven enrollments support this property and other enrollment
	// types ignore it. Available in iOS 15.1 and later.
	RequiredAppIDForMDM *int64 `plist:"RequiredAppIDForMDM,omitempty" json:"RequiredAppIDForMDM,omitempty"`
	// If 'true', the system warns the user that they need to reboot into RecoveryOS and allow
	// the MDM to use the bootstrap token for authentication for certain sensitive operations
	// such as enabling kernel extensions or installing some types of software updates. If the
	// MDM doesn't need to perform these operations, it can leave this key set to 'false', and
	// the user isn't notified. The SettingsCommand.Command.Settings.MDMOptions.MDMOptions
	// command overrides this default value. This setting only applies to devices that have
	// 'BootstrapTokenRequiredForSoftwareUpdate' or
	// 'BootstrapTokenRequiredForKernelExtensionApproval' set to 'true' in their
	// SecurityInfoResponse.SecurityInfo. DEP-enrolled devices are automatically allowed to use
	// the bootstrap token for authentication. Available in macOS 11 and later.
	PromptUserToAllowBootstrapTokenForAuthentication *bool `` /* 132-byte string literal not displayed */
}

type MacOSServerAccount struct {
	// The server's address.
	HostName string `plist:"HostName" json:"HostName"`
	// The user's user name.
	UserName string `plist:"UserName" json:"UserName"`
	// The user's password.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
	// The description of the account.
	AccountDescription *string `plist:"AccountDescription,omitempty" json:"AccountDescription,omitempty"`
	// An array of dictionaries containing configured account types and relevant settings
	ConfiguredAccounts []MacOSServerAccountConfiguredAccounts `plist:"ConfiguredAccounts,omitempty" json:"ConfiguredAccounts,omitempty"`
}

type MacOSServerAccountConfiguredAccounts struct {
	// com.apple.osxserver.documents (the Documents account type).
	Type string `plist:"Type" json:"Type"`
	// Designates the port number to use when contacting the server. If no port number is
	// specified, the default port is used.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
}