1# @ohos.enterprise.securityManager (Security Management) 2 3The **securityManager** module provides device security management capabilities, including obtaining the security patch status and file system encryption status. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> - The APIs of this module can be used only in the stage model. 10> 11> - The APIs of this module can be called only by a device administrator application that is enabled. For details, see [MDM Kit Development](../../mdm/mdm-kit-guide.md). 12 13## Modules to Import 14 15```ts 16import { securityManager } from '@kit.MDMKit'; 17``` 18 19## securityManager.uninstallUserCertificate 20 21uninstallUserCertificate(admin: Want, certUri: string): Promise<void> 22 23Uninstalls a user certificate. This API uses a promise to return the result. 24 25**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 26 27**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 28 29**Parameters** 30 31| Name | Type | Mandatory| Description | 32| ------- | ------------------------------------------------------- | ---- | --------------------------------- | 33| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 34| certUri | string | Yes | Certificate URI, which is set and returned by the [installUserCertificate](#securitymanagerinstallusercertificate) API for installing a user certificate.| 35 36**Return value** 37 38| Type | Description | 39| ------------------- | ------------------------------------------------------------ | 40| Promise<void> | Promise that returns no value. An error object is thrown when a user certificate fails to be uninstalled.| 41 42**Error codes** 43 44For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 45 46| ID| Error Message | 47| -------- | ------------------------------------------------------------ | 48| 9200001 | The application is not an administrator application of the device. | 49| 9200002 | The administrator application does not have permission to manage the device. | 50| 9201001 | Failed to manage the certificate. | 51| 201 | Permission verification failed. The application does not have the permission required to call the API. | 52| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 53 54**Example** 55 56```ts 57import { Want } from '@kit.AbilityKit'; 58import { BusinessError } from '@kit.BasicServicesKit'; 59 60let wantTemp: Want = { 61 bundleName: 'com.example.myapplication', 62 abilityName: 'EntryAbility', 63}; 64let aliasStr = "certName"; 65securityManager.uninstallUserCertificate(wantTemp, aliasStr).then(() => { 66 console.info(`Succeeded in uninstalling user certificate.`); 67}).catch((err: BusinessError) => { 68 console.error(`Failed to uninstall user certificate. Code is ${err.code}, message is ${err.message}`); 69}); 70``` 71 72## securityManager.installUserCertificate 73 74installUserCertificate(admin: Want, certificate: CertBlob): Promise<string> 75 76Installs a user certificate. This API uses a promise to return the result. 77 78**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 79 80**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 81 82**Parameters** 83 84| Name | Type | Mandatory| Description | 85| ----------- | ------------------------------------------------------- | ---- | -------------- | 86| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 87| certificate | [CertBlob](#certblob) | Yes | Certificate information. The certificate file must be stored in a path that can be accessed by the application, such as the application sandbox path. | 88 89**Return value** 90 91| Type | Description | 92| --------------------- | ---------------------------------------------------- | 93| Promise<string> | Promise used to return the URI of the installed certificate. This URI can be used to uninstall the certificate.| 94 95**Error codes** 96 97For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 98 99| ID| Error Message | 100| -------- | ------------------------------------------------------------ | 101| 9200001 | The application is not an administrator application of the device. | 102| 9200002 | The administrator application does not have permission to manage the device. | 103| 9201001 | Failed to manage the certificate. | 104| 201 | Permission verification failed. The application does not have the permission required to call the API. | 105| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 106 107**Example** 108 109<!--code_no_check--> 110```ts 111import { common, Want } from '@kit.AbilityKit'; 112import { BusinessError } from '@kit.BasicServicesKit'; 113 114let wantTemp: Want = { 115 bundleName: 'com.example.myapplication', 116 abilityName: 'EntryAbility', 117}; 118let certFileArray: Uint8Array = new Uint8Array(); 119// The variable context needs to be initialized in MainAbility's onCreate callback function 120// test.cer needs to be placed in the rawfile directory 121// Obtain the context from the component and ensure that the return value of this.getUIContext().getHostContext() is UIAbilityContext. 122const context = this.getUIContext().getHostContext() as common.UIAbilityContext; 123context.resourceManager.getRawFileContent("test.cer").then((value) => { 124 certFileArray = value; 125 securityManager.installUserCertificate(wantTemp, { inData: certFileArray, alias: "cert_alias_xts" }) 126 .then((result) => { 127 console.info(`Succeeded in installing user certificate, result : ${JSON.stringify(result)}`); 128 }).catch((err: BusinessError) => { 129 console.error(`Failed to install user certificate. Code: ${err.code}, message: ${err.message}`); 130 }) 131}).catch((err: BusinessError) => { 132 console.error(`Failed to get raw file content. message: ${err.message}`); 133 return; 134}); 135``` 136 137## securityManager.installUserCertificate<sup>18+</sup> 138 139installUserCertificate(admin: Want, certificate: CertBlob, accountId: number): string 140 141Installs a user certificate based on the system account. 142 143**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 144 145**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 146 147**Parameters** 148 149| Name | Type | Mandatory| Description | 150| ----------- | ------------------------------------------------------- | ---- | -------------- | 151| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility.| 152| certificate | [CertBlob](#certblob) | Yes | Certificate information. The certificate file must be stored in a path that can be accessed by the application, such as the application sandbox path. | 153| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 154 155**Return value** 156 157| Type | Description | 158| --------------------- | ---------------------------------------------------- | 159| string | URI of the installed certificate, which is used to uninstall the certificate.| 160 161**Error codes** 162 163For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 164 165| ID| Error Message | 166| -------- | ------------------------------------------------------------ | 167| 9200001 | The application is not an administrator application of the device. | 168| 9200002 | The administrator application does not have permission to manage the device. | 169| 9201001 | Failed to manage the certificate. | 170| 201 | Permission verification failed. The application does not have the permission required to call the API. | 171 172**Example** 173 174<!--code_no_check--> 175```ts 176import { common, Want } from '@kit.AbilityKit'; 177 178let wantTemp: Want = { 179 bundleName: 'com.example.myapplication', 180 abilityName: 'EntryAbility', 181}; 182let certFileArray: Uint8Array = new Uint8Array(); 183let accountId: number = 100; 184// The variable context needs to be initialized in MainAbility's onCreate callback function 185// test.cer needs to be placed in the rawfile directory 186// Obtain the context from the component and ensure that the return value of this.getUIContext().getHostContext() is UIAbilityContext. 187const context = this.getUIContext().getHostContext() as common.UIAbilityContext; 188context.resourceManager.getRawFileContent("test.cer").then((value) => { 189 certFileArray = value; 190 try { 191 let result: string = securityManager.installUserCertificate(wantTemp, { inData: certFileArray, alias: "cert_alias_xts" }, accountId); 192 console.info(`Succeeded in installing user certificate. result: ${result}`); 193 } catch (err) { 194 console.error(`Failed to install user certificate. Code: ${err.code}, message: ${err.message}`); 195 } 196}); 197``` 198## securityManager.getUserCertificates<sup>18+</sup> 199 200getUserCertificates(admin: Want, accountId: number): Array<string> 201 202Obtains the user certificate of a specified system account. 203 204**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_CERTIFICATE 205 206**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 207 208**Parameters** 209 210| Name| Type | Mandatory| Description | 211| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 212| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 213| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 214 215**Return value** 216 217| Type | Description | 218| ------ | -------------------- | 219| Array<string> | All user certificates installed under the specified user ID.| 220 221**Error codes** 222 223For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 224 225| ID| Error Message | 226| -------- | ------------------------------------------------------------ | 227| 9200001 | The application is not an administrator application of the device. | 228| 9200002 | The administrator application does not have permission to manage the device. | 229| 201 | Permission verification failed. The application does not have the permission required to call the API. | 230 231**Example** 232 233```ts 234import { Want } from '@kit.AbilityKit'; 235 236let wantTemp: Want = { 237 bundleName: 'com.example.myapplication', 238 abilityName: 'EntryAbility', 239}; 240let accountId: number = 100; 241try { 242 let result: Array<string> = securityManager.getUserCertificates(wantTemp, accountId); 243 console.info(`Succeeded in getting the uri list of user Certificates. result: ${JSON.stringify(result)}`); 244} catch (err) { 245 console.error(`Failed to get the uri list of user Certificates. Code: ${err.code}, message: ${err.message}`); 246} 247``` 248 249## securityManager.getSecurityStatus 250 251getSecurityStatus(admin: Want, item: string): string 252 253Obtains the security status of the current device. 254 255**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 256 257**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 258 259**Parameters** 260 261| Name| Type | Mandatory| Description | 262| ------ | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 263| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 264| item | string | Yes | Type of the security status to obtain.<br>- **patch**: device security patch.<br>- **encryption**: device file system encryption.<!--RP1--><!--RP1End-->| 265 266**Return value** 267 268| Type | Description | 269| ------ | -------------------- | 270| string | Security status obtained.| 271 272**Error codes** 273 274For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 275 276| ID| Error Message | 277| -------- | ------------------------------------------------------------ | 278| 9200001 | The application is not an administrator application of the device. | 279| 9200002 | The administrator application does not have permission to manage the device. | 280| 201 | Permission verification failed. The application does not have the permission required to call the API. | 281| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 282 283**Example** 284 285```ts 286import { Want } from '@kit.AbilityKit'; 287 288let wantTemp: Want = { 289 bundleName: 'com.example.myapplication', 290 abilityName: 'EntryAbility', 291}; 292 293try { 294 let result: string = securityManager.getSecurityStatus(wantTemp, 'patch'); 295 console.info(`Succeeded in getting security patch tag. tag: ${result}`); 296} catch (err) { 297 console.error(`Failed to get security patch tag. Code: ${err.code}, message: ${err.message}`); 298} 299``` 300 301## securityManager.setPasswordPolicy 302 303setPasswordPolicy(admin: Want, policy: PasswordPolicy): void 304 305Sets the device password policy. 306 307**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 308 309**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 310 311**Parameters** 312 313| Name | Type | Mandatory | Description | 314| -------- | ---------------------------------------- | ---- | ------------------------------- | 315| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 316| policy | [PasswordPolicy](#passwordpolicy) | Yes| Device password policy to set.| 317 318**Error codes** 319 320For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 321 322| ID| Error Message | 323| ------- | ---------------------------------------------------------------------------- | 324| 9200001 | The application is not an administrator application of the device. | 325| 9200002 | The administrator application does not have permission to manage the device. | 326| 201 | Permission verification failed. The application does not have the permission required to call the API. | 327| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 328 329**Example** 330 331```ts 332import { Want } from '@kit.AbilityKit'; 333 334let wantTemp: Want = { 335 bundleName: 'com.example.myapplication', 336 abilityName: 'EntryAbility', 337}; 338 339let policy: securityManager.PasswordPolicy = { 340 complexityRegex: '^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,}$', 341 validityPeriod: 1, 342 additionalDescription: 'The password must contain at least eight characters, including at least one uppercase letter, one lowercase letter, one digit, and one special character.', 343} 344try { 345 securityManager.setPasswordPolicy(wantTemp, policy); 346 console.info(`Succeeded in setting password policy.`); 347} catch(err) { 348 console.error(`Failed to set password policy. Code: ${err.code}, message: ${err.message}`); 349} 350``` 351 352## securityManager.getPasswordPolicy 353 354getPasswordPolicy(admin: Want): PasswordPolicy 355 356Obtains the device password policy. 357 358**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 359 360**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 361 362**Parameters** 363 364| Name | Type | Mandatory | Description | 365| -------- | ---------------------------------------- | ---- | ------------------------------- | 366| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 367 368**Return value** 369 370| Type | Description | 371| --------------------- | ------------------------- | 372| [PasswordPolicy](#passwordpolicy) | Device password policy obtained.| 373 374**Error codes** 375 376For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 377 378| ID| Error Message | 379| ------- | ---------------------------------------------------------------------------- | 380| 9200001 | The application is not an administrator application of the device. | 381| 9200002 | The administrator application does not have permission to manage the device. | 382| 201 | Permission verification failed. The application does not have the permission required to call the API. | 383| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 384 385**Example** 386 387```ts 388import { Want } from '@kit.AbilityKit'; 389 390let wantTemp: Want = { 391 bundleName: 'com.example.myapplication', 392 abilityName: 'EntryAbility', 393}; 394 395try { 396 let result: securityManager.PasswordPolicy = securityManager.getPasswordPolicy(wantTemp); 397 console.info(`Succeeded in getting password policy, result : ${JSON.stringify(result)}`); 398} catch(err) { 399 console.error(`Failed to get password policy. Code: ${err.code}, message: ${err.message}`); 400} 401``` 402 403## securityManager.setAppClipboardPolicy 404 405setAppClipboardPolicy(admin: Want, tokenId: number, policy: ClipboardPolicy): void 406 407Sets the device clipboard policy. 408 409**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 410 411**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 412 413**Parameters** 414 415| Name | Type | Mandatory | Description | 416| -------- | ---------------------------------------- | ---- | ------------------------------- | 417| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 418| tokenId | number | Yes| Application token ID, which can be obtained using [bundleManager.getApplicationInfo](../apis-ability-kit/js-apis-bundleManager-applicationInfo.md). Currently, a maximum of 100 token IDs can be saved.| 419| policy | [ClipboardPolicy](#clipboardpolicy) | Yes| Clipboard policy to set.| 420 421**Error codes** 422 423For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 424 425| ID| Error Message | 426| ------- | ---------------------------------------------------------------------------- | 427| 9200001 | The application is not an administrator application of the device. | 428| 9200002 | The administrator application does not have permission to manage the device. | 429| 201 | Permission verification failed. The application does not have the permission required to call the API. | 430| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 431 432**Example** 433 434```ts 435import { Want } from '@kit.AbilityKit'; 436 437let wantTemp: Want = { 438 bundleName: 'com.example.myapplication', 439 abilityName: 'EntryAbility', 440}; 441let tokenId: number = 586874394; 442try { 443 securityManager.setAppClipboardPolicy(wantTemp, tokenId, securityManager.ClipboardPolicy.IN_APP); 444 console.info(`Succeeded in setting clipboard policy.`); 445} catch(err) { 446 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 447} 448``` 449 450## securityManager.getAppClipboardPolicy 451 452getAppClipboardPolicy(admin: Want, tokenId?: number): string 453 454Obtains the device clipboard policy. 455 456**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 457 458**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 459 460**Parameters** 461 462| Name | Type | Mandatory | Description | 463| -------- | ---------------------------------------- | ---- | ------------------------------- | 464| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 465| tokenId | number | No| Application token ID, which can be obtained using [bundleManager.getApplicationInfo](../apis-ability-kit/js-apis-bundleManager-applicationInfo.md). Currently, a maximum of 100 token IDs can be saved.| 466 467**Return value** 468 469| Type | Description | 470| --------------------- | ------------------------- | 471| string | Device clipboard policy in JSON format.| 472 473**Error codes** 474 475For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 476 477| ID| Error Message | 478| ------- | ---------------------------------------------------------------------------- | 479| 9200001 | The application is not an administrator application of the device. | 480| 9200002 | The administrator application does not have permission to manage the device. | 481| 201 | Permission verification failed. The application does not have the permission required to call the API. | 482| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 483 484**Example** 485 486```ts 487import { Want } from '@kit.AbilityKit'; 488 489let wantTemp: Want = { 490 bundleName: 'com.example.myapplication', 491 abilityName: 'EntryAbility', 492}; 493let tokenId: number = 586874394; 494try { 495 let result: string = securityManager.getAppClipboardPolicy(wantTemp, tokenId); 496 console.info(`Succeeded in getting password policy, result : ${result}`); 497} catch(err) { 498 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 499} 500``` 501 502## securityManager.setAppClipboardPolicy<sup>18+</sup> 503 504setAppClipboardPolicy(admin: Want, bundleName: string, accountId: number, policy: ClipboardPolicy): void 505 506Sets the device clipboard policy with a specified bundle name and user ID. Currently, a maximum of 100 policies can be saved. 507 508**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 509 510**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 511 512**Parameters** 513 514| Name | Type | Mandatory | Description | 515| ------- | ------------------------------------------------------- | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | 516| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 517| bundleName | string | Yes | Bundle name of the application for which the device clipboard policy is set. | 518| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 519| policy | [ClipboardPolicy](#clipboardpolicy) | Yes | Clipboard policy to set. | 520 521**Error codes** 522 523For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 524 525| ID | Error Message | 526| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | 527| 9200001 | The application is not an administrator application of the device. | 528| 9200002 | The administrator application does not have permission to manage the device. | 529| 201 | Permission verification failed. The application does not have the permission required to call the API. | 530 531**Example** 532 533```ts 534import { Want } from '@kit.AbilityKit'; 535 536let wantTemp: Want = { 537 bundleName: 'com.example.myapplication', 538 abilityName: 'EntryAbility', 539}; 540let bundleName: string = 'com.example.myapplication'; 541let accountId: number = 100; 542try { 543 securityManager.setAppClipboardPolicy(wantTemp, bundleName, accountId, securityManager.ClipboardPolicy.IN_APP); 544 console.info(`Succeeded in setting clipboard policy.`); 545} catch(err) { 546 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 547} 548``` 549 550## securityManager.getAppClipboardPolicy<sup>18+</sup> 551 552getAppClipboardPolicy(admin: Want, bundleName: string, accountId: number): string 553 554Obtains the device clipboard policy with the specified bundle name and user ID. 555 556**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 557 558**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 559 560**Parameters** 561 562| Name | Type | Mandatory | Description | 563| ------- | ------------------------------------------------------- | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | 564| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 565| bundleName | string | Yes | Bundle name of the application for which the device clipboard policy is set. | 566| accountId | number | Yes | User ID, which must be greater than or equal to 0. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 567 568**Return value** 569 570| Type | Description | 571| ----------------------------------- | -------- | 572| string | Device clipboard policy in JSON format.| 573 574**Error codes** 575 576For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 577 578| ID | Error Message | 579| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | 580| 9200001 | The application is not an administrator application of the device. | 581| 9200002 | The administrator application does not have permission to manage the device. | 582| 201 | Permission verification failed. The application does not have the permission required to call the API. | 583 584**Example** 585 586```ts 587import { Want } from '@kit.AbilityKit'; 588 589let wantTemp: Want = { 590 bundleName: 'com.example.myapplication', 591 abilityName: 'EntryAbility', 592}; 593let bundleName: string = 'com.example.myapplication'; 594let accountId: number = 100; 595try { 596 let result: string = securityManager.getAppClipboardPolicy(wantTemp, bundleName, accountId); 597 console.info(`Succeeded in getting password policy, result : ${result}`); 598} catch(err) { 599 console.error(`Failed to set clipboard policy. Code: ${err.code}, message: ${err.message}`); 600} 601``` 602 603## securityManager.setWatermarkImage<sup>14+</sup> 604 605setWatermarkImage(admin: Want, bundleName: string, source: string | image.PixelMap, accountId: number): void 606 607Sets the watermark policy. 608 609**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 610 611**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 612 613**Parameters** 614 615| Name | Type | Mandatory | Description | 616| -------- | ---------------------------------------- | ---- | ------------------------------- | 617| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 618| bundleName | string | Yes | Bundle name of the application for which the watermark is set. | 619| source | string \| [image.PixelMap](../apis-image-kit/arkts-apis-image-PixelMap.md) | Yes | **string** indicates the image path that can be accessed by the application, such as the application sandbox path.<br>**image.PixelMap** indicates an image object. The size of an image pixel cannot exceed 500 KB. | 620| accountId | number | Yes | User ID. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 621 622**Error codes** 623 624For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 625 626| ID| Error Message | 627| ------- | ---------------------------------------------------------------------------- | 628| 9200001 | The application is not an administrator application of the device. | 629| 9200002 | The administrator application does not have permission to manage the device. | 630| 201 | Permission verification failed. The application does not have the permission required to call the API. | 631| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 632 633**Example** 634 635```ts 636import { Want } from '@kit.AbilityKit'; 637 638let wantTemp: Want = { 639 bundleName: 'com.example.myapplication', 640 abilityName: 'EntryAbility', 641}; 642let bundleName: string = 'com.example.myapplication'; 643let source: string = '/data/storage/el1/base/test.png'; 644let accountId: number = 100; 645try { 646 securityManager.setWatermarkImage(wantTemp, bundleName, source, accountId); 647 console.info(`Succeeded in setting set watermarkImage policy.`); 648} catch(err) { 649 console.error(`Failed to set watermarkImage policy. Code: ${err.code}, message: ${err.message}`); 650} 651``` 652 653## securityManager.cancelWatermarkImage<sup>14+</sup> 654 655cancelWatermarkImage(admin: Want, bundleName: string, accountId: number): void 656 657Cancels the watermark policy. 658 659**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_SECURITY 660 661**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 662 663**Parameters** 664 665| Name | Type | Mandatory | Description | 666| -------- | ---------------------------------------- | ---- | ------------------------------- | 667| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 668| bundleName | string | Yes | Bundle name of the application for which the watermark is removed. | 669| accountId | number | Yes | User ID. You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9-1) of **@ohos.account.osAccount** to obtain the user ID.| 670 671**Error codes** 672 673For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 674 675| ID| Error Message | 676| ------- | ---------------------------------------------------------------------------- | 677| 9200001 | The application is not an administrator application of the device. | 678| 9200002 | The administrator application does not have permission to manage the device. | 679| 201 | Permission verification failed. The application does not have the permission required to call the API. | 680| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 681 682**Example** 683 684```ts 685import { Want } from '@kit.AbilityKit'; 686 687let wantTemp: Want = { 688 bundleName: 'com.example.myapplication', 689 abilityName: 'EntryAbility', 690}; 691let bundleName: string = 'com.example.myapplication'; 692let accountId: number = 100; 693try { 694 securityManager.cancelWatermarkImage(wantTemp, bundleName, accountId); 695 console.info(`Succeeded in setting cancel watermarkImage policy.`); 696} catch(err) { 697 console.error(`Failed to cancel watermarkImage policy. Code: ${err.code}, message: ${err.message}`); 698} 699``` 700 701## CertBlob 702 703Represents the certificate information. 704 705**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 706 707| Name | Type | Read-Only| Optional| Description | 708| ------ | ---------- | ---- | ---- | ------------------ | 709| inData | Uint8Array | No | No|Binary content of the certificate.| 710| alias | string | No | No|Certificate alias. | 711 712## PasswordPolicy 713 714Represents a device password policy. 715 716**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 717 718| Name | Type | Read-Only| Optional| Description | 719| ----------- | --------| ---- | ---- | --------------------------- | 720| complexityRegex | string | No| Yes| Regular expression for password complexity.| 721| validityPeriod | number | No| Yes| Password validity period, in ms.| 722| additionalDescription | string | No| Yes| Description of the device password.| 723 724## ClipboardPolicy 725 726Represents a device clipboard policy. 727 728**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 729 730| Name | Value| Description | 731| ----------- | -------- | ------------------------------- | 732| DEFAULT | 0 | Default policy.| 733| IN_APP | 1 | Allow the clipboard to be used in the same application.| 734| LOCAL_DEVICE | 2 | Allow the clipboard to be used on the same device.| 735| CROSS_DEVICE | 3 | Allow the clipboard to be used across devices.| 736
