Add an access rule

A rule allows or blocks requests by one dimension — client address
(ip, an address or CIDR), country, asn, device, client
certificate (cert), principal, time (a JSON time window),
client (cli, mcp, mcp:name=…, browser, api, agent) or
api-key — at one scope. Block beats allow; per dimension the most
specific scope's allowlist decides, and broader mandatory
allowlists intersect with it. A scope holds at most 200 rules.

A new rule reports for its first 24 hours (mode: report, with
enforceAt), then enforces. Send mode: report to keep it reporting,
or mode: enforce / enforceNow: true to enforce at once. A team
rule is mandatory unless told otherwise.

The lock-out guard. A rule that would refuse your own current
request is answered 409 would_lock_you_out with the reasons. Send
force: true to save it anyway: that needs a fresh step-up (or a
totp, or from the browser a password, in this body) and a
verified email address, which is how recovery reaches you.

Checked in the controller in every enforcement mode:
access-rule:write for the account, a device or a resource (and the
resource's access:write), access-rule:team for a team — which the
caller's role in that team must also carry. A verified account.

Capability: access-rule:write, checked in the route or controller in every mode. Access-rule:write (access-rule:team for a team); the lock-out guard; force needs a step-up.

curl --location 'https://api.prod-orm.io/security/access-rules' \ --header 'Content-Type: application/json' \ --data '{ "scopeKind": "account", "scopeId": "string", "effect": "allow", "dimension": "ip", "value": "string", "appliesTo": [ "string" ], "mode": "report", "enforceNow": true, "expiresAt": "2019-08-24T14:15:22.123Z", "note": "string", "mandatory": true, "force": true, "totp": "string", "password": "pa$$word" }'

{ "rule": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f", "scopeKind": "account", "scopeId": "string", "scope": { "kind": "account", "id": "string" }, "effect": "allow", "dimension": "ip", "value": null, "appliesTo": [ "string" ], "mandatory": true, "mode": "enforce", "enforceAt": "2019-08-24T14:15:22.123Z", "note": "string", "expiresAt": "2019-08-24T14:15:22.123Z", "enabled": true, "createdAt": "2019-08-24T14:15:22.123Z", "createdBy": 0, "lockdown": true, "legacy": "blockedIps" }, "forced": true }

Add an access rule

Request

Responses