Preview Egress Host Decision
curl --request POST \
--url https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"draftRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
},
"host": "<string>"
}
'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision"
payload = {
"draftRules": { "rules": [
{
"allowEmptyEncodedBody": True,
"allowResponseDecodeRefusals": True,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": True,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": True
}
] },
"host": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
draftRules: {
rules: [
{
allowEmptyEncodedBody: true,
allowResponseDecodeRefusals: true,
authzen: {appId: '<string>', serverId: '<string>'},
endpointPattern: '<string>',
exemptCredentialKinds: [],
exemptResponseCredentialKinds: [],
maxInspectedBodyBytes: '<string>',
principal: {all: true, entitlementId: '<string>', userId: '<string>'},
skipContentInspection: true
}
]
},
host: '<string>'
})
};
fetch('https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'draftRules' => [
'rules' => [
[
'allowEmptyEncodedBody' => true,
'allowResponseDecodeRefusals' => true,
'authzen' => [
'appId' => '<string>',
'serverId' => '<string>'
],
'endpointPattern' => '<string>',
'exemptCredentialKinds' => [
],
'exemptResponseCredentialKinds' => [
],
'maxInspectedBodyBytes' => '<string>',
'principal' => [
'all' => true,
'entitlementId' => '<string>',
'userId' => '<string>'
],
'skipContentInspection' => true
]
]
],
'host' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision"
payload := strings.NewReader("{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"after": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"before": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"canonicalHost": "<string>",
"check": {
"problems": [
{
"kind": "EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123
}
],
"valid": true,
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
},
"newRuleIndex": 123,
"overridesRuleIndex": 123,
"replacedEffect": "EDGE_EGRESS_EFFECT_UNSPECIFIED",
"resultingRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"effect": "EDGE_EGRESS_EFFECT_UNSPECIFIED",
"endpointPattern": "<string>",
"exemptCredentialKinds": [
"CREDENTIAL_KIND_UNSPECIFIED"
],
"exemptResponseCredentialKinds": [
"CREDENTIAL_KIND_UNSPECIFIED"
],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
},
"startsDefaultDeny": true,
"status": "STATUS_UNSPECIFIED",
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
}Edge
Preview Egress Host Decision
PreviewEgressHostDecision reports what blocking or allowing one host for every user would do, and the rule list that results. Nothing is saved.
POST
/
api
/
v1
/
apps
/
{app_id}
/
edges
/
{id}
/
egress-rules
/
preview-host-decision
Preview Egress Host Decision
curl --request POST \
--url https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"draftRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
},
"host": "<string>"
}
'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision"
payload = {
"draftRules": { "rules": [
{
"allowEmptyEncodedBody": True,
"allowResponseDecodeRefusals": True,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": True,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": True
}
] },
"host": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
draftRules: {
rules: [
{
allowEmptyEncodedBody: true,
allowResponseDecodeRefusals: true,
authzen: {appId: '<string>', serverId: '<string>'},
endpointPattern: '<string>',
exemptCredentialKinds: [],
exemptResponseCredentialKinds: [],
maxInspectedBodyBytes: '<string>',
principal: {all: true, entitlementId: '<string>', userId: '<string>'},
skipContentInspection: true
}
]
},
host: '<string>'
})
};
fetch('https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'draftRules' => [
'rules' => [
[
'allowEmptyEncodedBody' => true,
'allowResponseDecodeRefusals' => true,
'authzen' => [
'appId' => '<string>',
'serverId' => '<string>'
],
'endpointPattern' => '<string>',
'exemptCredentialKinds' => [
],
'exemptResponseCredentialKinds' => [
],
'maxInspectedBodyBytes' => '<string>',
'principal' => [
'all' => true,
'entitlementId' => '<string>',
'userId' => '<string>'
],
'skipContentInspection' => true
]
]
],
'host' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision"
payload := strings.NewReader("{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"draftRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n },\n \"host\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"after": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"before": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"canonicalHost": "<string>",
"check": {
"problems": [
{
"kind": "EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123
}
],
"valid": true,
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
},
"newRuleIndex": 123,
"overridesRuleIndex": 123,
"replacedEffect": "EDGE_EGRESS_EFFECT_UNSPECIFIED",
"resultingRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"effect": "EDGE_EGRESS_EFFECT_UNSPECIFIED",
"endpointPattern": "<string>",
"exemptCredentialKinds": [
"CREDENTIAL_KIND_UNSPECIFIED"
],
"exemptResponseCredentialKinds": [
"CREDENTIAL_KIND_UNSPECIFIED"
],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
},
"startsDefaultDeny": true,
"status": "STATUS_UNSPECIFIED",
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.
Body
application/json
EdgeServicePreviewEgressHostDecisionRequest asks what blocking or allowing one host for every user would do. Nothing is saved.
EdgeEgressRuleList wraps a rule list so an empty list is distinct from none.
Show child attributes
Show child attributes
The effect field.
Available options:
EDGE_EGRESS_EFFECT_UNSPECIFIED, EDGE_EGRESS_EFFECT_ALLOW, EDGE_EGRESS_EFFECT_DENY, EDGE_EGRESS_EFFECT_AUTHZEN The host to block or allow.
Response
200 - application/json
EdgeServicePreviewEgressHostDecisionResponse reports what the decision would do and the rule list that results.
EdgeServicePreviewEgressHostDecisionResponse reports what the decision would do and the rule list that results.
EdgeEgressHostVerdict is the rule step's verdict for one host, plus Time Bandit's SSRF floor for IP literals. The mode (observe or enforce) and content inspection are not part of it.
Show child attributes
Show child attributes
EdgeEgressHostVerdict is the rule step's verdict for one host, plus Time Bandit's SSRF floor for IP literals. The mode (observe or enforce) and content inspection are not part of it.
Show child attributes
Show child attributes
The host after canonicalization; the new rule's endpoint_pattern.
EdgeEgressRuleListCheck is Update's save-time verdict on a rule list.
Show child attributes
Show child attributes
Zero-based index of the new rule in resulting_rules, or -1 when no rule was added.
The rule the new one is placed before because it also matches the host, as an index in resulting_rules, or -1.
The effect of an every-user rule for exactly this host that the decision replaced, or unspecified when none was.
Available options:
EDGE_EGRESS_EFFECT_UNSPECIFIED, EDGE_EGRESS_EFFECT_ALLOW, EDGE_EGRESS_EFFECT_DENY, EDGE_EGRESS_EFFECT_AUTHZEN EdgeEgressRuleList wraps a rule list so an empty list is distinct from none.
Show child attributes
Show child attributes
The Edge never configured egress rules, so saving resulting_rules switches it to denying every host no rule allows.
The status field.
Available options:
STATUS_UNSPECIFIED, STATUS_READY, STATUS_ALREADY_DECIDED, STATUS_INVALID_HOST, STATUS_SSRF_BLOCKED, STATUS_UNRESOLVED_DENY_RULE Concerns about the decision that do not stop it from being saved, e.g. an Allow that goes before an AUTHZEN rule and so bypasses its server.
Show child attributes
Show child attributes
Was this page helpful?