<!--
{
  "availability" : [
    "macCatalyst: 13.0.0 -",
    "macOS: 10.4.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Security",
  "identifier" : "/documentation/Security/AuthorizationPluginInterface/MechanismCreate",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Property",
  "symbol" : {
    "kind" : "Instance Property",
    "modules" : [
      "Security"
    ],
    "preciseIdentifier" : "c:@S@AuthorizationPluginInterface@FI@MechanismCreate"
  },
  "title" : "MechanismCreate"
}
-->

# MechanismCreate

Creates an authorization mechanism.

```
int (*)(void *, struct __OpaqueAuthorizationEngine *, const char *, void **) MechanismCreate;
```

## Parameters

`inPlugin`

The authorization plug-in reference you assigned to the plug-in in the [`AuthorizationPluginCreate`](/documentation/Security/AuthorizationPluginCreate) function.

`inEngine`

An opaque handle that you must pass back to the authorization engine when you call one of the engine’s callback functions.

`mechanismId`

The mechanism ID specified in the authorization policy database is passed to the plug-in so that the plug-in can create the appropriate mechanism.

`outMechanism`

On output, points to an authorization mechanism reference that you define. The authorization engine includes this reference when it calls your plug-in so that you can identify which instance of a mechanism to invoke, deactivate, or destroy.

## Return Value

A result code. Return [`errAuthorizationSuccess`](/documentation/Security/errAuthorizationSuccess) (no error) if the function completes successfully and [`errAuthorizationInternal`](/documentation/Security/errAuthorizationInternal) (Security Server internal error) if any error occurs.

## Discussion

A given authorization plug-in can implement any number of authorization mechanisms, distinguished by their mechanism names in the authorization policy database.

When the authorization engine calls your [`MechanismCreate`](/documentation/Security/AuthorizationPluginInterface/MechanismCreate) function, you should create a mechanism of the type specified by the mechanismID parameter and return an authorization mechanism reference. Subsequently, the authorization engine can call your [`MechanismInvoke`](/documentation/Security/AuthorizationPluginInterface/MechanismInvoke) function to perform an authorization, or can direct you to deactivate or destroy the mechanism instance by calling your [`MechanismDeactivate`](/documentation/Security/AuthorizationPluginInterface/MechanismDeactivate) or [`MechanismDestroy`](/documentation/Security/AuthorizationPluginInterface/MechanismDestroy) functions.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)