1# @ohos.enterprise.securityManager (Security Management) 2 3The **securityManager** module provides device security management capabilities, including obtaining the security patch status and file system encryption status. 4 5> **NOTE** 6> 7> The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> The APIs of this module can be used only in the stage model. 10> 11> The APIs of this module can be called only by a [device administrator application](../../mdm/mdm-kit-guide.md#introduction) that is enabled. 12 13## Modules to Import 14 15```ts 16import { securityManager } from '@kit.MDMKit'; 17``` 18 19## securityManager.uninstallUserCertificate 20 21uninstallUserCertificate(admin: Want, certUri: string): Promise<void> 22 23Uninstalls a user certificate. This API uses a promise to return the result. 24 25**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 26 27**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 28 29**Parameters** 30 31| Name | Type | Mandatory| Description | 32| ------- | ------------------------------------------------------- | ---- | --------------------------------- | 33| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 34| certUri | string | Yes | Certificate URI, which is set and returned by the [installUserCertificate](#securitymanagerinstallusercertificate) API for installing a user certificate.| 35 36**Return value** 37 38| Type | Description | 39| ------------------- | ------------------------------------------------------------ | 40| Promise<void> | Promise that returns no value. An error object will be thrown if the operation fails.| 41 42**Error codes** 43 44For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 45 46| ID| Error Message | 47| -------- | ------------------------------------------------------------ | 48| 9200001 | The application is not an administrator application of the device. | 49| 9200002 | The administrator application does not have permission to manage the device. | 50| 9201001 | Failed to manage the certificate. | 51| 201 | Permission verification failed. The application does not have the permission required to call the API. | 52| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 53 54**Example** 55 56```ts 57import { Want } from '@kit.AbilityKit'; 58import { BusinessError } from '@kit.BasicServicesKit'; 59let wantTemp: Want = { 60 bundleName: 'com.example.myapplication', 61 abilityName: 'EntryAbility', 62}; 63let aliasStr = "certName" 64securityManager.uninstallUserCertificate(wantTemp, aliasStr).then(() => { 65 console.info(`Succeeded in uninstalling user certificate.`); 66}).catch((err: BusinessError) => { 67 console.error(`Failed to uninstall user certificate. Code is ${err.code}, message is ${err.message}`); 68}); 69``` 70 71## securityManager.installUserCertificate 72 73installUserCertificate(admin: Want, certificate: CertBlob): Promise<string> 74 75Installs a user certificate. This API uses a promise to return the result. 76 77**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 78 79**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 80 81**Parameters** 82 83| Name | Type | Mandatory| Description | 84| ----------- | ------------------------------------------------------- | ---- | -------------- | 85| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 86| certificate | [CertBlob](#certblob) | Yes | Certificate information. The certificate file must be stored in a path that can be accessed by the application, such as the application sandbox path. | 87 88**Return value** 89 90| Type | Description | 91| --------------------- | ---------------------------------------------------- | 92| Promise<string> | Promise used to return the URI of the installed certificate. This URI can be used to uninstall the certificate.| 93 94**Error codes** 95 96For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 97 98| ID| Error Message | 99| -------- | ------------------------------------------------------------ | 100| 9200001 | The application is not an administrator application of the device. | 101| 9200002 | The administrator application does not have permission to manage the device. | 102| 9201001 | Failed to manage the certificate. | 103| 201 | Permission verification failed. The application does not have the permission required to call the API. | 104| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 105 106**Example** 107 108```ts 109import { Want } from '@kit.AbilityKit'; 110import { BusinessError } from '@kit.BasicServicesKit'; 111let wantTemp: Want = { 112 bundleName: 'com.example.myapplication', 113 abilityName: 'EntryAbility', 114}; 115let certFileArray: Uint8Array = new Uint8Array(); 116// Initialize the Context variable in the onCreate callback function of the MainAbility. 117// Place the test file test.cer in the rawfile directory. 118getContext().resourceManager.getRawFileContent("test.cer").then((value) => { 119 certFileArray = value; 120 securityManager.installUserCertificate(wantTemp, { inData: certFileArray, alias: "cert_alias_xts" }) 121 .then((result) => { 122 console.info(`Succeeded in installing user certificate, result : ${JSON.stringify(result)}`); 123 }).catch((err: BusinessError) => { 124 console.error(`Failed to install user certificate. Code: ${err.code}, message: ${err.message}`); 125 }) 126}).catch((err: BusinessError) => { 127 console.error(`Failed to get row file content. message: ${err.message}`); 128 return 129}); 130``` 131 132## securityManager.installUserCertificate<sup>18+</sup> 133 134installUserCertificate(admin: Want, certificate: CertBlob, accountId: number): string 135 136Installs a user certificate based on the system account. 137 138**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 139 140**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 141 142**Parameters** 143 144| Name | Type | Mandatory| Description | 145| ----------- | ------------------------------------------------------- | ---- | -------------- | 146| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 147| certificate | [CertBlob](#certblob) | Yes | Certificate information. The certificate file must be stored in a path that can be accessed by the application, such as the application sandbox path. | 148| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 149 150**Return value** 151 152| Type | Description | 153| --------------------- | ---------------------------------------------------- | 154| string | URI of the installed certificate, which is used to uninstall the certificate.| 155 156**Error codes** 157 158For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 159 160| ID| Error Message | 161| -------- | ------------------------------------------------------------ | 162| 9200001 | The application is not an administrator application of the device. | 163| 9200002 | The administrator application does not have permission to manage the device. | 164| 9201001 | Failed to manage the certificate. | 165| 201 | Permission verification failed. The application does not have the permission required to call the API. | 166| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 167 168**Example** 169 170```ts 171import { Want } from '@kit.AbilityKit'; 172let wantTemp: Want = { 173 bundleName: 'com.example.myapplication', 174 abilityName: 'EntryAbility', 175}; 176let certFileArray: Uint8Array = new Uint8Array(); 177let accountId: number = 100; 178// Initialize the Context variable in the onCreate callback function of the MainAbility. 179// Place the test file test.cer in the rawfile directory. 180getContext().resourceManager.getRawFileContent("test.cer").then((value) => { 181 certFileArray = value; 182 try { 183 let result: string = securityManager.installUserCertificate(wantTemp, { inData: certFileArray, alias: "cert_alias_xts" }, accountId); 184 console.info(`Succeeded in installing user certificate. result: ${result}`); 185 } catch (err) { 186 console.error(`Failed to install user certificate. Code: ${err.code}, message: ${err.message}`); 187 } 188}); 189``` 190## securityManager.getUserCertificates<sup>18+</sup> 191 192getUserCertificates(admin: Want, accountId: number): Array<string> 193 194Obtains the user certificate of a specified system account. 195 196**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 197 198**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 199 200**Parameters** 201 202| Name| Type | Mandatory| Description | 203| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 204| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 205| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 206 207**Return value** 208 209| Type | Description | 210| ------ | -------------------- | 211| Array<string> | All user certificates installed under the specified user ID.| 212 213**Error codes** 214 215For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 216 217| ID| Error Message | 218| -------- | ------------------------------------------------------------ | 219| 9200001 | The application is not an administrator application of the device. | 220| 9200002 | The administrator application does not have permission to manage the device. | 221| 201 | Permission verification failed. The application does not have the permission required to call the API. | 222| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 223 224**Example** 225 226```ts 227import { Want } from '@kit.AbilityKit'; 228let wantTemp: Want = { 229 bundleName: 'com.example.myapplication', 230 abilityName: 'EntryAbility', 231}; 232let accountId: number = 100; 233try { 234 let result: Array<string> = securityManager.getUserCertificates(wantTemp, accountId); 235 console.info(`Succeeded in getting the uri list of user Certificates. result: ${JSON.stringify(result)}`); 236} catch (err) { 237 console.error(`Failed to get the uri list of user Certificates. Code: ${err.code}, message: ${err.message}`); 238} 239``` 240 241## securityManager.getSecurityStatus 242 243getSecurityStatus(admin: Want, item: string): string 244 245Obtains security status. 246 247**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 248 249**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 250 251**Parameters** 252 253| Name| Type | Mandatory| Description | 254| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 255| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 256| item | string | Yes | Type of the security status to obtain.<br>- **patch**: device security patch.<br>- **encryption**: device file system encryption.<!--RP1--><!--RP1End-->| 257 258**Return value** 259 260| Type | Description | 261| ------ | -------------------- | 262| string | Security status obtained.| 263 264**Error codes** 265 266For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 267 268| ID| Error Message | 269| -------- | ------------------------------------------------------------ | 270| 9200001 | The application is not an administrator application of the device. | 271| 9200002 | The administrator application does not have permission to manage the device. | 272| 201 | Permission verification failed. The application does not have the permission required to call the API. | 273| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 274 275**Example** 276 277```ts 278import { Want } from '@kit.AbilityKit'; 279let wantTemp: Want = { 280 bundleName: 'com.example.myapplication', 281 abilityName: 'EntryAbility', 282}; 283 284try { 285 let result: string = securityManager.getSecurityStatus(wantTemp, 'patch'); 286 console.info(`Succeeded in getting security patch tag. tag: ${result}`); 287} catch (err) { 288 console.error(`Failed to get security patch tag. Code: ${err.code}, message: ${err.message}`); 289} 290``` 291 292## securityManager.setPasswordPolicy 293 294setPasswordPolicy(admin: Want, policy: PasswordPolicy): void 295 296Sets the device password policy. 297 298**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 299 300**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 301 302**Parameters** 303 304| Name | Type | Mandatory | Description | 305| -------- | ---------------------------------------- | ---- | ------------------------------- | 306| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 307| policy | [PasswordPolicy](#passwordpolicy) | Yes| Device password policy to set.| 308 309**Error codes** 310 311For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 312 313| ID| Error Message | 314| ------- | ---------------------------------------------------------------------------- | 315| 9200001 | The application is not an administrator application of the device. | 316| 9200002 | The administrator application does not have permission to manage the device. | 317| 201 | Permission verification failed. The application does not have the permission required to call the API. | 318| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 319 320**Example** 321 322```ts 323import { Want } from '@kit.AbilityKit'; 324let wantTemp: Want = { 325 bundleName: 'com.example.myapplication', 326 abilityName: 'EntryAbility', 327}; 328 329let policy: securityManager.PasswordPolicy = { 330 complexityRegex: '^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$', 331 validityPeriod: 1, 332 additionalDescription: 'The password must contain at least eight characters, including at least one uppercase letter, one lowercase letter, one digit, and one special character.', 333} 334try { 335 securityManager.setPasswordPolicy(wantTemp, policy); 336 console.info(`Succeeded in setting password policy.`); 337} catch(err) { 338 console.error(`Failed to set password policy. Code: ${err.code}, message: ${err.message}`); 339} 340``` 341 342## securityManager.getPasswordPolicy 343 344getPasswordPolicy(admin: Want): PasswordPolicy 345 346Obtains the device password policy. 347 348**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 349 350**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 351 352**Parameters** 353 354| Name | Type | Mandatory | Description | 355| -------- | ---------------------------------------- | ---- | ------------------------------- | 356| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 357 358**Return value** 359 360| Type | Description | 361| --------------------- | ------------------------- | 362| [PasswordPolicy](#passwordpolicy) | Device password policy obtained.| 363 364**Error codes** 365 366For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 367 368| ID| Error Message | 369| ------- | ---------------------------------------------------------------------------- | 370| 9200001 | The application is not an administrator application of the device. | 371| 9200002 | The administrator application does not have permission to manage the device. | 372| 201 | Permission verification failed. The application does not have the permission required to call the API. | 373| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 374 375**Example** 376 377```ts 378import { Want } from '@kit.AbilityKit'; 379let wantTemp: Want = { 380 bundleName: 'com.example.myapplication', 381 abilityName: 'EntryAbility', 382}; 383 384try { 385 let result: securityManager.PasswordPolicy = securityManager.getPasswordPolicy(wantTemp); 386 console.info(`Succeeded in getting password policy, result : ${JSON.stringify(result)}`); 387} catch(err) { 388 console.error(`Failed to get password policy. Code: ${err.code}, message: ${err.message}`); 389} 390``` 391 392## securityManager.setAppClipboardPolicy 393 394setAppClipboardPolicy(admin: Want, tokenId: number, policy: ClipboardPolicy): void 395 396Sets the device clipboard policy. 397 398**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 399 400**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 401 402**Parameters** 403 404| Name | Type | Mandatory | Description | 405| -------- | ---------------------------------------- | ---- | ------------------------------- | 406| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 407| tokenId | number | Yes| Application token ID, which can be obtained using [bundleManager.getApplicationInfo](../apis-ability-kit/js-apis-bundleManager-applicationInfo.md). Currently, a maximum of 100 token IDs can be saved.| 408| policy | [ClipboardPolicy](#clipboardpolicy) | Yes| Clipboard policy to set.| 409 410**Error codes** 411 412For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 413 414| ID| Error Message | 415| ------- | ---------------------------------------------------------------------------- | 416| 9200001 | The application is not an administrator application of the device. | 417| 9200002 | The administrator application does not have permission to manage the device. | 418| 201 | Permission verification failed. The application does not have the permission required to call the API. | 419| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 420 421**Example** 422 423```ts 424import { Want } from '@kit.AbilityKit'; 425let wantTemp: Want = { 426 bundleName: 'com.example.myapplication', 427 abilityName: 'EntryAbility', 428}; 429let tokenId: number = 586874394; 430try { 431 securityManager.setAppClipboardPolicy(wantTemp, tokenId, securityManager.ClipboardPolicy.IN_APP); 432 console.info(`Succeeded in setting clipboard policy.`); 433} catch(err) { 434 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 435} 436``` 437 438## securityManager.getAppClipboardPolicy 439 440getAppClipboardPolicy(admin: Want, tokenId?: number): string 441 442Obtains the device clipboard policy. 443 444**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 445 446**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 447 448**Parameters** 449 450| Name | Type | Mandatory | Description | 451| -------- | ---------------------------------------- | ---- | ------------------------------- | 452| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 453| tokenId | number | No| Application token ID, which can be obtained using [bundleManager.getApplicationInfo](../apis-ability-kit/js-apis-bundleManager-applicationInfo.md). Currently, a maximum of 100 token IDs can be saved.| 454 455**Return value** 456 457| Type | Description | 458| --------------------- | ------------------------- | 459| string | Device clipboard policy in JSON format.| 460 461**Error codes** 462 463For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 464 465| ID| Error Message | 466| ------- | ---------------------------------------------------------------------------- | 467| 9200001 | The application is not an administrator application of the device. | 468| 9200002 | The administrator application does not have permission to manage the device. | 469| 201 | Permission verification failed. The application does not have the permission required to call the API. | 470| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 471 472**Example** 473 474```ts 475import { Want } from '@kit.AbilityKit'; 476let wantTemp: Want = { 477 bundleName: 'com.example.myapplication', 478 abilityName: 'EntryAbility', 479}; 480let tokenId: number = 586874394; 481try { 482 let result: string = securityManager.getAppClipboardPolicy(wantTemp, tokenId); 483 console.info(`Succeeded in getting password policy, result : ${result}`); 484} catch(err) { 485 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 486} 487``` 488 489## securityManager.setAppClipboardPolicy<sup>18+</sup> 490 491setAppClipboardPolicy(admin: Want, bundleName: string, accountId: number, policy: ClipboardPolicy): void 492 493Sets the device clipboard policy with a specified bundle name and user ID. Currently, a maximum of 100 policies can be saved. 494 495**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 496 497**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 498 499**Parameters** 500 501| Name | Type | Mandatory | Description | 502| ------- | ------------------------------------------------------- | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | 503| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 504| bundleName | string | Yes | Bundle name of the application for which the device clipboard policy is set. | 505| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 506| policy | [ClipboardPolicy](#clipboardpolicy) | Yes | Clipboard policy to set. | 507 508**Error codes** 509 510For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 511 512| ID | Error Message | 513| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | 514| 9200001 | The application is not an administrator application of the device. | 515| 9200002 | The administrator application does not have permission to manage the device. | 516| 201 | Permission verification failed. The application does not have the permission required to call the API. | 517| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 518 519**Example** 520 521```ts 522import { Want } from '@kit.AbilityKit'; 523 524let wantTemp: Want = { 525 bundleName: 'com.example.myapplication', 526 abilityName: 'EntryAbility', 527}; 528let bundleName: string = 'com.example.myapplication'; 529let accountId: number = 100; 530try { 531 securityManager.setAppClipboardPolicy(wantTemp, bundleName, accountId, securityManager.ClipboardPolicy.IN_APP); 532 console.info(`Succeeded in setting clipboard policy.`); 533} catch(err) { 534 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 535} 536``` 537 538## securityManager.getAppClipboardPolicy<sup>18+</sup> 539 540getAppClipboardPolicy(admin: Want, bundleName: string, accountId: number): string 541 542Obtains the device clipboard policy with the specified bundle name and user ID. 543 544**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 545 546**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 547 548**Parameters** 549 550| Name | Type | Mandatory | Description | 551| ------- | ------------------------------------------------------- | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | 552| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 553| bundleName | string | Yes | Bundle name of the application for which the device clipboard policy is set. | 554| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 555 556**Return value** 557 558| Type | Description | 559| ----------------------------------- | -------- | 560| string | Device clipboard policy in JSON format.| 561 562**Error codes** 563 564For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 565 566| ID | Error Message | 567| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | 568| 9200001 | The application is not an administrator application of the device. | 569| 9200002 | The administrator application does not have permission to manage the device. | 570| 201 | Permission verification failed. The application does not have the permission required to call the API. | 571| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 572 573**Example** 574 575```ts 576import { Want } from '@kit.AbilityKit'; 577 578let wantTemp: Want = { 579 bundleName: 'com.example.myapplication', 580 abilityName: 'EntryAbility', 581}; 582let bundleName: string = 'com.example.myapplication'; 583let accountId: number = 100; 584try { 585 let result: string = securityManager.getAppClipboardPolicy(wantTemp, bundleName, accountId); 586 console.info(`Succeeded in getting password policy, result : ${result}`); 587} catch(err) { 588 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 589} 590``` 591 592## securityManager.setWatermarkImage<sup>14+</sup> 593 594setWatermarkImage(admin: Want, bundleName: string, source: string | image.PixelMap, accountId: number): void 595 596Sets the watermark policy. Currently, only 2-in-1 devices are supported. 597 598**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 599 600**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 601 602**Parameters** 603 604| Name | Type | Mandatory | Description | 605| -------- | ---------------------------------------- | ---- | ------------------------------- | 606| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 607| bundleName | string | Yes | Bundle name of the application for which the watermark is set. | 608| source | string \| [image.PixelMap](../apis-image-kit/js-apis-image.md) | Yes | **string** indicates the image path that can be accessed by the application, such as the application sandbox path.<br>**image.PixelMap** indicates an image object. The size of an image pixel cannot exceed 500 KB. | 609| accountId | number | Yes | User ID. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 610 611**Error codes** 612 613For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 614 615| ID| Error Message | 616| ------- | ---------------------------------------------------------------------------- | 617| 9200001 | The application is not an administrator application of the device. | 618| 9200002 | The administrator application does not have permission to manage the device. | 619| 201 | Permission verification failed. The application does not have the permission required to call the API. | 620| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 621 622**Example** 623 624```ts 625import { Want } from '@kit.AbilityKit'; 626let wantTemp: Want = { 627 bundleName: 'com.example.myapplication', 628 abilityName: 'EntryAbility', 629}; 630let bundleName: string = 'com.example.myapplication'; 631let source: string = '/data/storage/el1/base/test.png'; 632let accountId: number = 100; 633try { 634 securityManager.setWatermarkImage(wantTemp, bundleName, source, accountId); 635 console.info(`Succeeded in setting set watermarkImage policy.`); 636} catch(err) { 637 console.error(`Failed to set watermarkImage policy. Code: ${err.code}, message: ${err.message}`); 638} 639``` 640 641## securityManager.cancelWatermarkImage<sup>14+</sup> 642 643cancelWatermarkImage(admin: Want, bundleName: string, accountId: number): void 644 645Cancels the watermark policy. Currently, only 2-in-1 devices are supported. 646 647**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 648 649**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 650 651**Parameters** 652 653| Name | Type | Mandatory | Description | 654| -------- | ---------------------------------------- | ---- | ------------------------------- | 655| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 656| bundleName | string | Yes | Bundle name of the application for which the watermark is removed. | 657| accountId | number | Yes | User ID. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 658 659**Error codes** 660 661For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 662 663| ID| Error Message | 664| ------- | ---------------------------------------------------------------------------- | 665| 9200001 | The application is not an administrator application of the device. | 666| 9200002 | The administrator application does not have permission to manage the device. | 667| 201 | Permission verification failed. The application does not have the permission required to call the API. | 668| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 669 670**Example** 671 672```ts 673import { Want } from '@kit.AbilityKit'; 674let wantTemp: Want = { 675 bundleName: 'com.example.myapplication', 676 abilityName: 'EntryAbility', 677}; 678let bundleName: string = 'com.example.myapplication'; 679let accountId: number = 100; 680try { 681 securityManager.cancelWatermarkImage(wantTemp, bundleName, accountId); 682 console.info(`Succeeded in setting cancel watermarkImage policy.`); 683} catch(err) { 684 console.error(`Failed to cancel watermarkImage policy. Code: ${err.code}, message: ${err.message}`); 685} 686``` 687 688## CertBlob 689 690Represents the certificate information. 691 692**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 693 694| Name | Type | Mandatory| Description | 695| ------ | ---------- | ---- | ------------------ | 696| inData | Uint8Array | Yes | Binary content of the certificate.| 697| alias | string | Yes | Certificate alias. | 698 699## PasswordPolicy 700 701Represents a device password policy. 702 703**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 704 705| Name | Type | Mandatory| Description | 706| ----------- | --------| ---- | ------------------------------- | 707| complexityRegex | string | No| Regular expression for password complexity.| 708| validityPeriod | number | No| Password validity period, in ms.| 709| additionalDescription | string | No| Description of the device password.| 710 711## ClipboardPolicy 712 713Represents a device clipboard policy. 714 715**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 716 717| Name | Value| Description | 718| ----------- | -------- | ------------------------------- | 719| DEFAULT | 0 | Default policy.| 720| IN_APP | 1 | Allow the clipboard to be used in the same application.| 721| LOCAL_DEVICE | 2 | Allow the clipboard to be used on the same device.| 722| CROSS_DEVICE | 3 | Allow the clipboard to be used across devices.| 723
