> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Preview Egress Host Decision > PreviewEgressHostDecision reports what blocking or allowing one host for every user would do, and the rule list that results. Nothing is saved. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-host-decision: post: tags: - Edge summary: Preview Egress Host Decision description: |- PreviewEgressHostDecision reports what blocking or allowing one host for every user would do, and the rule list that results. Nothing is saved. operationId: c1.api.edge.v1.EdgeService.PreviewEgressHostDecision parameters: - in: path name: app_id required: true schema: description: The appId field. type: string - in: path name: id required: true schema: description: The id field. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.edge.v1.EdgeServicePreviewEgressHostDecisionRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.edge.v1.EdgeServicePreviewEgressHostDecisionResponse description: >- EdgeServicePreviewEgressHostDecisionResponse reports what the decision would do and the rule list that results. components: schemas: c1.api.edge.v1.EdgeServicePreviewEgressHostDecisionRequestInput: description: >- EdgeServicePreviewEgressHostDecisionRequest asks what blocking or allowing one host for every user would do. Nothing is saved. properties: draftRules: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleList' - type: 'null' effect: description: The effect field. enum: - EDGE_EGRESS_EFFECT_UNSPECIFIED - EDGE_EGRESS_EFFECT_ALLOW - EDGE_EGRESS_EFFECT_DENY - EDGE_EGRESS_EFFECT_AUTHZEN type: string x-speakeasy-unknown-values: allow host: description: The host to block or allow. type: string title: Edge Service Preview Egress Host Decision Request type: object x-speakeasy-name-override: EdgeServicePreviewEgressHostDecisionRequest c1.api.edge.v1.EdgeServicePreviewEgressHostDecisionResponse: description: |- EdgeServicePreviewEgressHostDecisionResponse reports what the decision would do and the rule list that results. properties: after: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressHostVerdict' - type: 'null' before: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressHostVerdict' - type: 'null' canonicalHost: description: The host after canonicalization; the new rule's endpoint_pattern. type: string check: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleListCheck' - type: 'null' newRuleIndex: description: >- Zero-based index of the new rule in resulting_rules, or -1 when no rule was added. format: int32 type: integer overridesRuleIndex: description: >- The rule the new one is placed before because it also matches the host, as an index in resulting_rules, or -1. format: int32 type: integer replacedEffect: description: >- The effect of an every-user rule for exactly this host that the decision replaced, or unspecified when none was. enum: - EDGE_EGRESS_EFFECT_UNSPECIFIED - EDGE_EGRESS_EFFECT_ALLOW - EDGE_EGRESS_EFFECT_DENY - EDGE_EGRESS_EFFECT_AUTHZEN type: string x-speakeasy-unknown-values: allow resultingRules: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleList' - type: 'null' startsDefaultDeny: description: >- The Edge never configured egress rules, so saving resulting_rules switches it to denying every host no rule allows. type: boolean status: description: The status field. enum: - STATUS_UNSPECIFIED - STATUS_READY - STATUS_ALREADY_DECIDED - STATUS_INVALID_HOST - STATUS_SSRF_BLOCKED - STATUS_UNRESOLVED_DENY_RULE type: string x-speakeasy-unknown-values: allow warnings: description: >- Concerns about the decision that do not stop it from being saved, e.g. an Allow that goes before an AUTHZEN rule and so bypasses its server. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleWarning' type: - array - 'null' title: Edge Service Preview Egress Host Decision Response type: object x-speakeasy-name-override: EdgeServicePreviewEgressHostDecisionResponse c1.api.edge.v1.EdgeEgressRuleList: description: >- EdgeEgressRuleList wraps a rule list so an empty list is distinct from none. properties: rules: description: The rules field. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRule' type: - array - 'null' title: Edge Egress Rule List type: object x-speakeasy-name-override: EdgeEgressRuleList c1.api.edge.v1.EdgeEgressHostVerdict: description: |- EdgeEgressHostVerdict is the rule step's verdict for one host, plus Time Bandit's SSRF floor for IP literals. The mode (observe or enforce) and content inspection are not part of it. properties: allowed: description: The allowed field. type: boolean canonicalHost: description: |- The host after canonicalization; empty when it could not be canonicalized. type: string delegatedAuthzenServerId: description: >- The AuthzenServer that decides the host at request time, set only with EDGE_EGRESS_EVALUATION_OUTCOME_DELEGATED_TO_AUTHZEN. type: string host: description: The host as requested. type: string hostError: description: |- Why the host cannot be evaluated; set only with EDGE_EGRESS_EVALUATION_OUTCOME_INVALID_HOST. type: string matchedRuleIndex: description: Zero-based index of the deciding rule, or -1 when no rule decided. format: int32 type: integer outcome: description: The outcome field. enum: - EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED - EDGE_EGRESS_EVALUATION_OUTCOME_NOT_RESTRICTED - EDGE_EGRESS_EVALUATION_OUTCOME_MATCHED_RULE - EDGE_EGRESS_EVALUATION_OUTCOME_DEFAULT_DENY - EDGE_EGRESS_EVALUATION_OUTCOME_INVALID_HOST - EDGE_EGRESS_EVALUATION_OUTCOME_UNRESOLVED_DENY_RULE - EDGE_EGRESS_EVALUATION_OUTCOME_SSRF_BLOCKED - EDGE_EGRESS_EVALUATION_OUTCOME_DELEGATED_TO_AUTHZEN type: string x-speakeasy-unknown-values: allow ruleMatches: description: Every rule whose pattern matches the host, in rule order. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleMatch' type: - array - 'null' title: Edge Egress Host Verdict type: object x-speakeasy-name-override: EdgeEgressHostVerdict c1.api.edge.v1.EdgeEgressRuleListCheck: description: EdgeEgressRuleListCheck is Update's save-time verdict on a rule list. properties: problems: description: >- Every problem Update would reject the list for, in rule order; empty when valid. Update itself reports only the first. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleProblem' type: - array - 'null' valid: description: The valid field. type: boolean warnings: description: Things worth fixing that do not stop Update from saving the list. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleWarning' type: - array - 'null' title: Edge Egress Rule List Check type: object x-speakeasy-name-override: EdgeEgressRuleListCheck c1.api.edge.v1.EdgeEgressRuleWarning: description: EdgeEgressRuleWarning is one non-blocking concern about a rule list. properties: authzenServerId: description: >- The AuthzenServer an AUTHZEN rule names, for the AUTHZEN warning kinds. type: string kind: description: The kind field. enum: - EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED - EDGE_EGRESS_RULE_WARNING_KIND_AUTHZEN_EVALUATE_GRANT_MISSING - EDGE_EGRESS_RULE_WARNING_KIND_AUTHZEN_NO_EDGE_PRINCIPAL - EDGE_EGRESS_RULE_WARNING_KIND_HOST_DECISION_BYPASSES_AUTHZEN_RULE type: string x-speakeasy-unknown-values: allow message: description: Human-readable explanation, including how to fix it. type: string ruleIndex: description: Zero-based rule index, or -1 for a warning about the whole list. format: int32 type: integer servicePrincipalIds: description: The service principals bound to the Edge that lack the grant. items: type: string type: - array - 'null' title: Edge Egress Rule Warning type: object x-speakeasy-name-override: EdgeEgressRuleWarning c1.api.edge.v1.EdgeEgressRule: description: > EdgeEgressRule is one ordered row of an Edge's egress access policy. This message contains a oneof named pdp. Only a single field of the following list may be set at a time: - authzen properties: allowEmptyEncodedBody: description: >- When true, a response or request whose declared Content-Encoding is a supported token (gzip, x-gzip, deflate, br, zstd) but whose body is empty or decodes to zero bytes is treated as an empty plaintext instead of failing closed. Off by default. Only meaningful on ALLOW rules. type: boolean allowResponseDecodeRefusals: description: >- When true, a decode refusal raised while recursively decoding content nested inside a RESPONSE body (e.g. a gzip-looking byte run in a binary download that fails to inflate, an embedded encoding past the depth/size bounds) is recorded but does not by itself block the response. Confirmed findings (credentials, keys, PANs) still apply. Off by default. Only meaningful on ALLOW rules. type: boolean authzen: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.AuthzenRef' - type: 'null' effect: description: The effect field. enum: - EDGE_EGRESS_EFFECT_UNSPECIFIED - EDGE_EGRESS_EFFECT_ALLOW - EDGE_EGRESS_EFFECT_DENY - EDGE_EGRESS_EFFECT_AUTHZEN type: string x-speakeasy-unknown-values: allow endpointPattern: description: |- Destination host to match: exact hostname, or a single leading "*." wildcard for subdomains (e.g. "*.example.com"). Port and path are out of scope for v1. type: string exemptCredentialKinds: description: >- Content-inspection finding classes this rule exempts from blocking on the *request* path, since the destination is already trusted for this principal. Never applies to response content; see exempt_response_credential_kinds for that, deliberately independent. items: enum: - CREDENTIAL_KIND_UNSPECIFIED - CREDENTIAL_KIND_JWT - CREDENTIAL_KIND_API_KEY - CREDENTIAL_KIND_PRIVATE_KEY - CREDENTIAL_KIND_VENDOR_CREDENTIAL - CREDENTIAL_KIND_PAN type: string x-speakeasy-unknown-values: allow type: - array - 'null' exemptResponseCredentialKinds: description: >- Content-inspection finding classes this rule exempts from blocking on the *response* path -- e.g. a destination's own credential-issuance reply (temporary cloud credentials, a continuation token) that the caller's own service legitimately needs to consume. Deliberately a separate list from exempt_credential_kinds, defaulting empty: trusting a destination's outbound credential never implies trusting whatever it sends back, and an admin must opt a kind into this list explicitly. items: enum: - CREDENTIAL_KIND_UNSPECIFIED - CREDENTIAL_KIND_JWT - CREDENTIAL_KIND_API_KEY - CREDENTIAL_KIND_PRIVATE_KEY - CREDENTIAL_KIND_VENDOR_CREDENTIAL - CREDENTIAL_KIND_PAN type: string x-speakeasy-unknown-values: allow type: - array - 'null' maxInspectedBodyBytes: description: |- Overrides, for destinations matching this rule, the largest body (in bytes) Time Bandit buffers for content inspection. 0 means unset: Time Bandit uses its fleet default (1 MiB). A body above the limit is still refused (fail closed) and is never forwarded uninspected. Only meaningful on ALLOW rules. Applies whether or not skip_content_inspection is set. format: uint64 type: string principal: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressPrincipal' - type: 'null' skipContentInspection: description: >- When true, decoding is optional for destinations matching this rule; inspection is not. Despite the name, this does NOT skip content inspection: every detector, guardrail and header scan still runs and any finding still denies. It only changes what happens when a body declares a Content-Encoding that Time Bandit has no decoder for. Without the flag the body is denied (fail closed); with it, the bytes are scanned as-is through the normal cascade. Trade-off: a secret inside genuine compression labelled with an unsupported token is not caught (plaintext and gzip still are). A supported encoding that is malformed or truncated, decoded output over the inspection cap, and bodies over the wire cap still fail closed. Off by default. Only meaningful on ALLOW rules. type: boolean title: Edge Egress Rule type: object x-speakeasy-name-override: EdgeEgressRule c1.api.edge.v1.EdgeEgressRuleMatch: description: EdgeEgressRuleMatch is one rule whose pattern matches an evaluated host. properties: entitlementOverCap: description: |- A Deny rule whose entitlement has more members than the Edge config carries; it applies to every user, so principal_match is MATCHES. type: boolean principalMatch: description: The principalMatch field. enum: - EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED - EDGE_EGRESS_PRINCIPAL_MATCH_MATCHES - EDGE_EGRESS_PRINCIPAL_MATCH_DOES_NOT_MATCH - EDGE_EGRESS_PRINCIPAL_MATCH_UNKNOWN type: string x-speakeasy-unknown-values: allow ruleIndex: description: The ruleIndex field. format: int32 type: integer shadowed: description: >- An earlier rule already decided this host for this caller, so this one never applies. Set only with EDGE_EGRESS_PRINCIPAL_MATCH_MATCHES. type: boolean title: Edge Egress Rule Match type: object x-speakeasy-name-override: EdgeEgressRuleMatch c1.api.edge.v1.EdgeEgressRuleProblem: description: EdgeEgressRuleProblem is one reason Update would reject a rule list. properties: kind: description: The kind field. enum: - EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED - EDGE_EGRESS_RULE_PROBLEM_KIND_TOO_MANY_RULES - EDGE_EGRESS_RULE_PROBLEM_KIND_INVALID_PATTERN - EDGE_EGRESS_RULE_PROBLEM_KIND_UNKNOWN_ENTITLEMENT - EDGE_EGRESS_RULE_PROBLEM_KIND_INVALID_BODY_LIMIT - EDGE_EGRESS_RULE_PROBLEM_KIND_AUTHZEN_SERVER_REQUIRED - EDGE_EGRESS_RULE_PROBLEM_KIND_UNEXPECTED_AUTHZEN_SERVER - EDGE_EGRESS_RULE_PROBLEM_KIND_UNKNOWN_AUTHZEN_SERVER - EDGE_EGRESS_RULE_PROBLEM_KIND_INACTIVE_AUTHZEN_SERVER type: string x-speakeasy-unknown-values: allow message: description: The same text Update returns for this problem. type: string ruleIndex: description: Zero-based rule index, or -1 for a problem with the whole list. format: int32 type: integer title: Edge Egress Rule Problem type: object x-speakeasy-name-override: EdgeEgressRuleProblem c1.api.edge.v1.AuthzenRef: description: >- AuthzenRef names an AuthzenServer. An empty app_id means the Edge's own app for rules saved before cross-app references were supported. properties: appId: description: App that owns the AuthzenServer. Empty resolves to the Edge's app. type: string serverId: description: >- ID of the AuthzenServer. It must exist in the target app and be in OBSERVE or ENFORCE mode. type: string title: Authzen Ref type: object x-speakeasy-name-override: AuthzenRef c1.api.edge.v1.EdgeEgressPrincipal: description: > EdgeEgressPrincipal is the caller a rule matches against. Exactly one arm must be set. This message contains a oneof named scope. Only a single field of the following list may be set at a time: - all - userId - entitlementId properties: all: description: >- The all field. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - boolean - 'null' entitlementId: description: >- An App Entitlement belonging to the same App the Edge belongs to. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - string - 'null' userId: description: >- The userId field. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - string - 'null' title: Edge Egress Principal type: object x-speakeasy-name-override: EdgeEgressPrincipal securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````