Preview Egress Rules Update
curl --request POST \
--url https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hosts": [
"<string>"
],
"principalUserId": "<string>",
"proposedRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
}
}
'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update"
payload = {
"hosts": ["<string>"],
"principalUserId": "<string>",
"proposedRules": { "rules": [
{
"allowEmptyEncodedBody": True,
"allowResponseDecodeRefusals": True,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": True,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": True
}
] }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
hosts: ['<string>'],
principalUserId: '<string>',
proposedRules: {
rules: [
{
allowEmptyEncodedBody: true,
allowResponseDecodeRefusals: true,
authzen: {appId: '<string>', serverId: '<string>'},
endpointPattern: '<string>',
exemptCredentialKinds: [],
exemptResponseCredentialKinds: [],
maxInspectedBodyBytes: '<string>',
principal: {all: true, entitlementId: '<string>', userId: '<string>'},
skipContentInspection: true
}
]
}
})
};
fetch('https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'hosts' => [
'<string>'
],
'principalUserId' => '<string>',
'proposedRules' => [
'rules' => [
[
'allowEmptyEncodedBody' => true,
'allowResponseDecodeRefusals' => true,
'authzen' => [
'appId' => '<string>',
'serverId' => '<string>'
],
'endpointPattern' => '<string>',
'exemptCredentialKinds' => [
],
'exemptResponseCredentialKinds' => [
],
'maxInspectedBodyBytes' => '<string>',
'principal' => [
'all' => true,
'entitlementId' => '<string>',
'userId' => '<string>'
],
'skipContentInspection' => true
]
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update"
payload := strings.NewReader("{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"check": {
"problems": [
{
"kind": "EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123
}
],
"valid": true,
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
},
"results": [
{
"after": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"before": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"deciderChanged": true,
"verdictChanged": true
}
],
"startsDefaultDeny": true
}Edge
Preview Egress Rules Update
PreviewEgressRulesUpdate checks a proposed egress rule list as Update would and compares each host’s verdict under the saved rules with its verdict under the proposed rules. Nothing is saved.
POST
/
api
/
v1
/
apps
/
{app_id}
/
edges
/
{id}
/
egress-rules
/
preview-update
Preview Egress Rules Update
curl --request POST \
--url https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hosts": [
"<string>"
],
"principalUserId": "<string>",
"proposedRules": {
"rules": [
{
"allowEmptyEncodedBody": true,
"allowResponseDecodeRefusals": true,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": true,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": true
}
]
}
}
'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update"
payload = {
"hosts": ["<string>"],
"principalUserId": "<string>",
"proposedRules": { "rules": [
{
"allowEmptyEncodedBody": True,
"allowResponseDecodeRefusals": True,
"authzen": {
"appId": "<string>",
"serverId": "<string>"
},
"endpointPattern": "<string>",
"exemptCredentialKinds": [],
"exemptResponseCredentialKinds": [],
"maxInspectedBodyBytes": "<string>",
"principal": {
"all": True,
"entitlementId": "<string>",
"userId": "<string>"
},
"skipContentInspection": True
}
] }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
hosts: ['<string>'],
principalUserId: '<string>',
proposedRules: {
rules: [
{
allowEmptyEncodedBody: true,
allowResponseDecodeRefusals: true,
authzen: {appId: '<string>', serverId: '<string>'},
endpointPattern: '<string>',
exemptCredentialKinds: [],
exemptResponseCredentialKinds: [],
maxInspectedBodyBytes: '<string>',
principal: {all: true, entitlementId: '<string>', userId: '<string>'},
skipContentInspection: true
}
]
}
})
};
fetch('https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'hosts' => [
'<string>'
],
'principalUserId' => '<string>',
'proposedRules' => [
'rules' => [
[
'allowEmptyEncodedBody' => true,
'allowResponseDecodeRefusals' => true,
'authzen' => [
'appId' => '<string>',
'serverId' => '<string>'
],
'endpointPattern' => '<string>',
'exemptCredentialKinds' => [
],
'exemptResponseCredentialKinds' => [
],
'maxInspectedBodyBytes' => '<string>',
'principal' => [
'all' => true,
'entitlementId' => '<string>',
'userId' => '<string>'
],
'skipContentInspection' => true
]
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update"
payload := strings.NewReader("{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"hosts\": [\n \"<string>\"\n ],\n \"principalUserId\": \"<string>\",\n \"proposedRules\": {\n \"rules\": [\n {\n \"allowEmptyEncodedBody\": true,\n \"allowResponseDecodeRefusals\": true,\n \"authzen\": {\n \"appId\": \"<string>\",\n \"serverId\": \"<string>\"\n },\n \"endpointPattern\": \"<string>\",\n \"exemptCredentialKinds\": [],\n \"exemptResponseCredentialKinds\": [],\n \"maxInspectedBodyBytes\": \"<string>\",\n \"principal\": {\n \"all\": true,\n \"entitlementId\": \"<string>\",\n \"userId\": \"<string>\"\n },\n \"skipContentInspection\": true\n }\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"check": {
"problems": [
{
"kind": "EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123
}
],
"valid": true,
"warnings": [
{
"authzenServerId": "<string>",
"kind": "EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED",
"message": "<string>",
"ruleIndex": 123,
"servicePrincipalIds": [
"<string>"
]
}
]
},
"results": [
{
"after": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"before": {
"allowed": true,
"canonicalHost": "<string>",
"delegatedAuthzenServerId": "<string>",
"host": "<string>",
"hostError": "<string>",
"matchedRuleIndex": 123,
"outcome": "EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED",
"ruleMatches": [
{
"entitlementOverCap": true,
"principalMatch": "EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED",
"ruleIndex": 123,
"shadowed": true
}
]
},
"deciderChanged": true,
"verdictChanged": true
}
],
"startsDefaultDeny": true
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.
Body
application/json
EdgeServicePreviewEgressRulesUpdateRequest asks what saving a rule list would do: whether Update accepts it, and how each host's verdict changes. Nothing is saved.
Hosts to compare before and after, in the order results are returned. Empty runs only the save check.
The C1 user to evaluate as. Empty: rules naming a user or an entitlement report EDGE_EGRESS_PRINCIPAL_MATCH_UNKNOWN and never decide the verdict.
EdgeEgressRuleList wraps a rule list so an empty list is distinct from none.
Show child attributes
Show child attributes
Response
200 - application/json
EdgeServicePreviewEgressRulesUpdateResponse reports the save check and each host's verdict before and after the change.
EdgeServicePreviewEgressRulesUpdateResponse reports the save check and each host's verdict before and after the change.
EdgeEgressRuleListCheck is Update's save-time verdict on a rule list.
Show child attributes
Show child attributes
One result per requested host, in request order.
Show child attributes
Show child attributes
The Edge never configured egress rules, so saving any list, even an empty one, switches it to denying every host no rule allows.
Was this page helpful?