PUT /accounts/{account_id}/gateway/rules/{rule_id}

Default value: "application/json"

The protocol or layer to evaluate the traffic, identity, and device posture expressions.

The wirefilter expression used for traffic matching.

The expiration time stamp and default duration of a DNS policy. Takes precedence over the policy's schedule configuration, if any.

This does not apply to HTTP or network policies.

Whether the policy has expired.

The default duration a policy will be active in minutes. Must be set in order to use the reset_expiration endpoint on this rule.

The time stamp at which the policy will expire and cease to be applied.

Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted but will be converted to the equivalent value with offset zero (UTC+00:00) and will be returned as time stamps with offset zero denoted by a trailing 'Z'.

Policies with an expiration do not consider the timezone of clients they are applied to, and expire "globally" at the point given by their expires_at value.

The name of the rule.

The action to preform when the associated traffic, identity, and device posture expressions are either absent or evaluate to true.

Possible values:

• "noscan"
• "block"
• "scan"
• "allow"
• "off"
• "resolve"
• "quarantine"
• "redirect"
• "on"
• "isolate"
• "noisolate"
• "override"
• "l4_override"
• "egress"
• "safesearch"
• "ytrestricted"

The description of the rule.

True if the rule is enabled.

Default value: false

The schedule for activating DNS policies. This does not apply to HTTP or network policies.

The time intervals when the rule will be active on Mondays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Mondays.

The time intervals when the rule will be active on Sundays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Sundays.

The time zone the rule will be evaluated against. If a valid time zone city name is provided, Gateway will always use the current time at that time zone. If this parameter is omitted, then Gateway will use the time zone inferred from the user's source IP to evaluate the rule. If Gateway cannot determine the time zone from the IP, we will fall back to the time zone of the user's connected data center.

The time intervals when the rule will be active on Fridays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Fridays.

The time intervals when the rule will be active on Thursdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Thursdays.

The time intervals when the rule will be active on Tuesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Tuesdays.

The time intervals when the rule will be active on Saturdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Saturdays.

The time intervals when the rule will be active on Wednesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Wednesdays.

The wirefilter expression used for identity matching.

Precedence sets the order of your rules. Lower values indicate higher precedence. At each processing phase, applicable rules are evaluated in ascending order of this value.

The wirefilter expression used for device posture check matching.

Additional settings that modify the rule's action.

Configure behavior when an upstream cert is invalid or an SSL error occurs.

The action performed when an untrusted certificate is seen. The default action is an error with HTTP code 526.

Possible values:

• "block"
• "error"
• "pass_through"

Enable the custom block page.

Default value: false

INSECURE - disable DNSSEC validation (for Allow actions).

Default value: false

Configure to forward the query to the internal DNS service, passing the specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is set to 'resolve'.

The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.

Possible values:

• "public_dns"
• "none"

Default value: "none"

The internal DNS view identifier that's passed to the internal DNS service.

Configure DLP payload logging.

Set to true to enable DLP payload logging for this rule.

Default value: false

Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when 'dns_resolvers' are specified or 'resolve_dns_internally' is set. Only valid when a rule's action is set to 'resolve'.

Default value: false

Set by children MSP accounts to bypass their parent's rules.

Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs.

The fallback IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via WARP IPs.

The IPv4 address to be used for egress.

The IPv6 range to be used for egress.

Set to true, to ignore the category matches at CNAME domains in a response. If unchecked, the categories in this rule will be checked against all the CNAME domain categories in a response.

Default value: false

Add custom headers to allowed requests, in the form of key-value pairs. Keys are header names, pointing to an array with its header value(s).

Override matching DNS queries with an IP or set of IPs.

Settings for the Audit SSH action.

Enable to turn on SSH command logging.

Default value: false

Override matching DNS queries with a hostname.

Custom block page settings. If missing/null, blocking will use the the account settings.

URI to which the user will be redirected

If true, context information will be passed as query parameters

Default value: false

Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally' are set. DNS queries will route to the address closest to their origin. Only valid when a rule's action is set to 'resolve'.

Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.

A port number to use for upstream resolver. Defaults to 53 if unspecified.

IPv4 address of upstream resolver.

Whether to connect to this resolver over a private network. Must be set when vnet_id is set.

Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.

A port number to use for upstream resolver. Defaults to 53 if unspecified.

IPv6 address of upstream resolver.

Whether to connect to this resolver over a private network. Must be set when vnet_id is set.

Configure a notification to display on the user's device when this rule is matched.

Customize the message shown in the notification.

If true, context information will be passed as query parameters

Optional URL to direct users to additional information. If not set, the notification will open a block page.

Set notification on

Default value: false

Configure how session check behaves.

Set to true to enable session enforcement.

Default value: false

Configure how fresh the session needs to be to be considered valid.

Configure how browser isolation behaves.

Configure whether pasting is enabled or not. When set with "remote_only", pasting content from the user's local clipboard into isolated pages is disabled. When absent, paste is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "remote_only"
• "enabled"

Set to false to enable printing. Only applies when version == "v1".

Default value: false

Configure whether printing is enabled or not. When absent, printing is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "enabled"

Configure whether uploading is enabled or not. When absent, uploading is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "enabled"

Configure whether copy is enabled or not. When set with "remote_only", copying isolated content from the remote browser to the user's local clipboard is disabled. When absent, copy is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "remote_only"
• "enabled"

Set to false to enable downloading. Only applies when version == "v1".

Default value: false

Set to false to enable uploading. Only applies when version == "v1".

Default value: false

Set to false to enable copy-pasting. Only applies when version == "v1".

Default value: false

Configure whether downloading enabled or not. When absent, downloading is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "enabled"

Indicates which version of the browser isolation controls should apply.

Possible values:

• "v1"
• "v2"

Default value: "v1"

Configure whether keyboard usage is enabled or not. When absent, keyboard usage is enabled. Only applies when version == "v2".

Possible values:

• "disabled"
• "enabled"

Set to false to enable keyboard usage. Only applies when version == "v1".

Default value: false

Settings that apply to redirect rules

URI to which the user will be redirected

If true, context information will be passed as query parameters

Default value: false

If true, the path and query parameters from the original request will be appended to target_uri

Default value: false

Send matching traffic to the supplied destination IP address and port.

A port number to use for TCP/UDP overrides.

IPv4 or IPv6 address.

Set to true to enable IPs in DNS resolver category blocks. By default categories only block based on domain names.

Default value: false

The text describing why this block occurred, displayed on the custom block page (if enabled).

Settings that apply to quarantine rules

Types of files to sandbox.

Set by parent MSP accounts to enable their children to bypass this rule.

Set to true to include IPs in DNS resolver indicator feed blocks. By default indicator feeds only block based on domain names.

Default value: false