Create Zero Trust Gateway Rule

Create a new Zero Trust Gateway Rule.

Request

Path Params

identifier

string

required

Body Params application/json

action

enum<string>

required

The action to preform when the associated traffic, identity, and device posture expressions are either absent or evaluate to 'true'.

Allowed values:

onoffallowblockscannoscansafesearchytrestrictedisolatenoisolateoverridel4_override

Example:

allow

description

string

optional

The description of the Rule.

Example:

Block the bad websites based on host name

device_posture

string

optional

The wirefilter expression to be used for device posture check matching.

Example:

any(device_posture.checks.passed[*] in {"1308749e-fcfb-4ebc-b051-fe022b632644"})

enabled

boolean

optional

Set if the rule is enabled.

Example:

true

filters

array[string]

optional

The protocol or layer to evaluate the traffic, identity, and device posture expressions.

Allowed values:

httpdnsl4

Example:

["http"]

identity

string

optional

The wirefilter expression to be used for identity matching.

Example:

any(identity.groups.name[*] in {"finance"})

name

string

required

The name of the Rule.

Example:

block bad websites

precedence

integer

optional

Precedence sets the ordering of the rules. Lower values indicate higher precedence. At each processing phase, applicable rules are evaluated in ascending order of this value.

rule_settings

object (rule-settings)

optional

Additional settings that modify the rule's action.

add_headers

object

optional

Add custom headers to allowed requests, in the form of key-value pairs. Keys are header names, pointing to an array with its header value(s).

Example:

{"My-Next-Header":["foo","bar"],"X-Custom-Header-Name":["somecustomvalue"]}

biso_admin_controls

object

optional

Configure how browser isolation behaves.

block_page_enabled

boolean

optional

Enable the custom block page.

Example:

true

block_reason

string

optional

The text describing why this block occurred that will be displayed on the custom block page (if enabled).

Example:

This website is a security risk

check_session

object

optional

Configure how session check behaves.

insecure_disable_dnssec_validation

boolean

optional

INSECURE - disable DNSSEC validation (for allow actions).

Example:

false

ip_categories

boolean

optional

Include IPs in DNS resolver category blocks. By default categories only block on domain names.

Example:

true

l4override

object

optional

Send matching traffic to the supplied destination IP address and port.

override_host

string

optional

Override matching DNS queries with this.

Example:

example.com

override_ips

array[string]

optional

Override matching DNS queries with this.

Example:

["1.1.1.1","2.2.2.2"]

traffic

string

optional

The wirefilter expression to be used for traffic matching.

Example:

http.request.uri matches ".*a/partial/uri.*" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10

Example

{
  "action": "allow",
  "description": "Block the bad websites based on host name",
  "device_posture": "any(device_posture.checks.passed[*] in {\"1308749e-fcfb-4ebc-b051-fe022b632644\"})",
  "enabled": true,
  "filters": [
    "http"
  ],
  "identity": "any(identity.groups.name[*] in {\"finance\"})",
  "name": "block bad websites",
  "precedence": 0,
  "rule_settings": {
    "add_headers": {
      "My-Next-Header": [
        "foo",
        "bar"
      ],
      "X-Custom-Header-Name": [
        "somecustomvalue"
      ]
    },
    "biso_admin_controls": {
      "dcp": false,
      "dd": false,
      "dk": false,
      "dp": false,
      "du": false
    },
    "block_page_enabled": true,
    "block_reason": "This website is a security risk",
    "check_session": {
      "duration": "300s",
      "enforce": true
    },
    "insecure_disable_dnssec_validation": false,
    "ip_categories": true,
    "l4override": {
      "ip": "1.1.1.1",
      "port": 0
    },
    "override_host": "example.com",
    "override_ips": [
      "1.1.1.1",
      "2.2.2.2"
    ]
  },
  "traffic": "http.request.uri matches \".*a/partial/uri.*\" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10"
}

Request samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200Create Zero Trust Gateway Rule response

application/json

Body

allOf {2}

optional

object (api-response-single)

optional

errors

array [object {2}]

messages

required

Example:

[]

messages

array [object {2}]

messages

required

Example:

[]

result

required

success

enum<boolean>

required

Whether the API call was successful

Allowed value:

true

Example:

true

object

optional

result

object (rules_components-schemas-rules)

optional

Example

{
  "errors": [],
  "messages": [],
  "result": {
    "action": "allow",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "deleted_at": "2019-08-24T14:15:22Z",
    "description": "Block the bad websites based on host name",
    "device_posture": "any(device_posture.checks.passed[*] in {\"1308749e-fcfb-4ebc-b051-fe022b632644\"})",
    "enabled": true,
    "filters": [
      "http"
    ],
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "identity": "any(identity.groups.name[*] in {\"finance\"})",
    "name": "block bad websites",
    "precedence": 0,
    "rule_settings": {
      "add_headers": {
        "My-Next-Header": [
          "foo",
          "bar"
        ],
        "X-Custom-Header-Name": [
          "somecustomvalue"
        ]
      },
      "biso_admin_controls": {
        "dcp": false,
        "dd": false,
        "dk": false,
        "dp": false,
        "du": false
      },
      "block_page_enabled": true,
      "block_reason": "This website is a security risk",
      "check_session": {
        "duration": "300s",
        "enforce": true
      },
      "insecure_disable_dnssec_validation": false,
      "ip_categories": true,
      "l4override": {
        "ip": "1.1.1.1",
        "port": 0
      },
      "override_host": "example.com",
      "override_ips": [
        "1.1.1.1",
        "2.2.2.2"
      ]
    },
    "traffic": "http.request.uri matches \".*a/partial/uri.*\" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  },
  "success": true
}

🟢200Create Zero Trust Gateway Rule response failure