> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Preview Egress Rules Update > PreviewEgressRulesUpdate checks a proposed egress rule list as Update would and compares each host's verdict under the saved rules with its verdict under the proposed rules. Nothing is saved. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/edges/{id}/egress-rules/preview-update: post: tags: - Edge summary: Preview Egress Rules Update description: |- PreviewEgressRulesUpdate checks a proposed egress rule list as Update would and compares each host's verdict under the saved rules with its verdict under the proposed rules. Nothing is saved. operationId: c1.api.edge.v1.EdgeService.PreviewEgressRulesUpdate parameters: - in: path name: app_id required: true schema: description: The appId field. type: string - in: path name: id required: true schema: description: The id field. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.edge.v1.EdgeServicePreviewEgressRulesUpdateRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.edge.v1.EdgeServicePreviewEgressRulesUpdateResponse description: >- EdgeServicePreviewEgressRulesUpdateResponse reports the save check and each host's verdict before and after the change. components: schemas: c1.api.edge.v1.EdgeServicePreviewEgressRulesUpdateRequestInput: description: |- EdgeServicePreviewEgressRulesUpdateRequest asks what saving a rule list would do: whether Update accepts it, and how each host's verdict changes. Nothing is saved. properties: hosts: description: >- Hosts to compare before and after, in the order results are returned. Empty runs only the save check. items: type: string type: - array - 'null' principalUserId: description: >- The C1 user to evaluate as. Empty: rules naming a user or an entitlement report EDGE_EGRESS_PRINCIPAL_MATCH_UNKNOWN and never decide the verdict. type: string proposedRules: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleList' - type: 'null' title: Edge Service Preview Egress Rules Update Request type: object x-speakeasy-name-override: EdgeServicePreviewEgressRulesUpdateRequest c1.api.edge.v1.EdgeServicePreviewEgressRulesUpdateResponse: description: >- EdgeServicePreviewEgressRulesUpdateResponse reports the save check and each host's verdict before and after the change. properties: check: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleListCheck' - type: 'null' results: description: One result per requested host, in request order. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressHostChange' type: - array - 'null' startsDefaultDeny: description: |- The Edge never configured egress rules, so saving any list, even an empty one, switches it to denying every host no rule allows. type: boolean title: Edge Service Preview Egress Rules Update Response type: object x-speakeasy-name-override: EdgeServicePreviewEgressRulesUpdateResponse c1.api.edge.v1.EdgeEgressRuleList: description: >- EdgeEgressRuleList wraps a rule list so an empty list is distinct from none. properties: rules: description: The rules field. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRule' type: - array - 'null' title: Edge Egress Rule List type: object x-speakeasy-name-override: EdgeEgressRuleList c1.api.edge.v1.EdgeEgressRuleListCheck: description: EdgeEgressRuleListCheck is Update's save-time verdict on a rule list. properties: problems: description: >- Every problem Update would reject the list for, in rule order; empty when valid. Update itself reports only the first. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleProblem' type: - array - 'null' valid: description: The valid field. type: boolean warnings: description: Things worth fixing that do not stop Update from saving the list. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleWarning' type: - array - 'null' title: Edge Egress Rule List Check type: object x-speakeasy-name-override: EdgeEgressRuleListCheck c1.api.edge.v1.EdgeEgressHostChange: description: |- EdgeEgressHostChange compares one host's verdict under the saved rules with its verdict under the proposed rules. properties: after: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressHostVerdict' - type: 'null' before: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressHostVerdict' - type: 'null' deciderChanged: description: |- A different rule decides the host after the change, compared by rule content since indexes shift, or only one side has a deciding rule. type: boolean verdictChanged: description: after.allowed differs from before.allowed. type: boolean title: Edge Egress Host Change type: object x-speakeasy-name-override: EdgeEgressHostChange c1.api.edge.v1.EdgeEgressRule: description: > EdgeEgressRule is one ordered row of an Edge's egress access policy. This message contains a oneof named pdp. Only a single field of the following list may be set at a time: - authzen properties: allowEmptyEncodedBody: description: >- When true, a response or request whose declared Content-Encoding is a supported token (gzip, x-gzip, deflate, br, zstd) but whose body is empty or decodes to zero bytes is treated as an empty plaintext instead of failing closed. Off by default. Only meaningful on ALLOW rules. type: boolean allowResponseDecodeRefusals: description: >- When true, a decode refusal raised while recursively decoding content nested inside a RESPONSE body (e.g. a gzip-looking byte run in a binary download that fails to inflate, an embedded encoding past the depth/size bounds) is recorded but does not by itself block the response. Confirmed findings (credentials, keys, PANs) still apply. Off by default. Only meaningful on ALLOW rules. type: boolean authzen: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.AuthzenRef' - type: 'null' effect: description: The effect field. enum: - EDGE_EGRESS_EFFECT_UNSPECIFIED - EDGE_EGRESS_EFFECT_ALLOW - EDGE_EGRESS_EFFECT_DENY - EDGE_EGRESS_EFFECT_AUTHZEN type: string x-speakeasy-unknown-values: allow endpointPattern: description: |- Destination host to match: exact hostname, or a single leading "*." wildcard for subdomains (e.g. "*.example.com"). Port and path are out of scope for v1. type: string exemptCredentialKinds: description: >- Content-inspection finding classes this rule exempts from blocking on the *request* path, since the destination is already trusted for this principal. Never applies to response content; see exempt_response_credential_kinds for that, deliberately independent. items: enum: - CREDENTIAL_KIND_UNSPECIFIED - CREDENTIAL_KIND_JWT - CREDENTIAL_KIND_API_KEY - CREDENTIAL_KIND_PRIVATE_KEY - CREDENTIAL_KIND_VENDOR_CREDENTIAL - CREDENTIAL_KIND_PAN type: string x-speakeasy-unknown-values: allow type: - array - 'null' exemptResponseCredentialKinds: description: >- Content-inspection finding classes this rule exempts from blocking on the *response* path -- e.g. a destination's own credential-issuance reply (temporary cloud credentials, a continuation token) that the caller's own service legitimately needs to consume. Deliberately a separate list from exempt_credential_kinds, defaulting empty: trusting a destination's outbound credential never implies trusting whatever it sends back, and an admin must opt a kind into this list explicitly. items: enum: - CREDENTIAL_KIND_UNSPECIFIED - CREDENTIAL_KIND_JWT - CREDENTIAL_KIND_API_KEY - CREDENTIAL_KIND_PRIVATE_KEY - CREDENTIAL_KIND_VENDOR_CREDENTIAL - CREDENTIAL_KIND_PAN type: string x-speakeasy-unknown-values: allow type: - array - 'null' maxInspectedBodyBytes: description: |- Overrides, for destinations matching this rule, the largest body (in bytes) Time Bandit buffers for content inspection. 0 means unset: Time Bandit uses its fleet default (1 MiB). A body above the limit is still refused (fail closed) and is never forwarded uninspected. Only meaningful on ALLOW rules. Applies whether or not skip_content_inspection is set. format: uint64 type: string principal: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressPrincipal' - type: 'null' skipContentInspection: description: >- When true, decoding is optional for destinations matching this rule; inspection is not. Despite the name, this does NOT skip content inspection: every detector, guardrail and header scan still runs and any finding still denies. It only changes what happens when a body declares a Content-Encoding that Time Bandit has no decoder for. Without the flag the body is denied (fail closed); with it, the bytes are scanned as-is through the normal cascade. Trade-off: a secret inside genuine compression labelled with an unsupported token is not caught (plaintext and gzip still are). A supported encoding that is malformed or truncated, decoded output over the inspection cap, and bodies over the wire cap still fail closed. Off by default. Only meaningful on ALLOW rules. type: boolean title: Edge Egress Rule type: object x-speakeasy-name-override: EdgeEgressRule c1.api.edge.v1.EdgeEgressRuleProblem: description: EdgeEgressRuleProblem is one reason Update would reject a rule list. properties: kind: description: The kind field. enum: - EDGE_EGRESS_RULE_PROBLEM_KIND_UNSPECIFIED - EDGE_EGRESS_RULE_PROBLEM_KIND_TOO_MANY_RULES - EDGE_EGRESS_RULE_PROBLEM_KIND_INVALID_PATTERN - EDGE_EGRESS_RULE_PROBLEM_KIND_UNKNOWN_ENTITLEMENT - EDGE_EGRESS_RULE_PROBLEM_KIND_INVALID_BODY_LIMIT - EDGE_EGRESS_RULE_PROBLEM_KIND_AUTHZEN_SERVER_REQUIRED - EDGE_EGRESS_RULE_PROBLEM_KIND_UNEXPECTED_AUTHZEN_SERVER - EDGE_EGRESS_RULE_PROBLEM_KIND_UNKNOWN_AUTHZEN_SERVER - EDGE_EGRESS_RULE_PROBLEM_KIND_INACTIVE_AUTHZEN_SERVER type: string x-speakeasy-unknown-values: allow message: description: The same text Update returns for this problem. type: string ruleIndex: description: Zero-based rule index, or -1 for a problem with the whole list. format: int32 type: integer title: Edge Egress Rule Problem type: object x-speakeasy-name-override: EdgeEgressRuleProblem c1.api.edge.v1.EdgeEgressRuleWarning: description: EdgeEgressRuleWarning is one non-blocking concern about a rule list. properties: authzenServerId: description: >- The AuthzenServer an AUTHZEN rule names, for the AUTHZEN warning kinds. type: string kind: description: The kind field. enum: - EDGE_EGRESS_RULE_WARNING_KIND_UNSPECIFIED - EDGE_EGRESS_RULE_WARNING_KIND_AUTHZEN_EVALUATE_GRANT_MISSING - EDGE_EGRESS_RULE_WARNING_KIND_AUTHZEN_NO_EDGE_PRINCIPAL - EDGE_EGRESS_RULE_WARNING_KIND_HOST_DECISION_BYPASSES_AUTHZEN_RULE type: string x-speakeasy-unknown-values: allow message: description: Human-readable explanation, including how to fix it. type: string ruleIndex: description: Zero-based rule index, or -1 for a warning about the whole list. format: int32 type: integer servicePrincipalIds: description: The service principals bound to the Edge that lack the grant. items: type: string type: - array - 'null' title: Edge Egress Rule Warning type: object x-speakeasy-name-override: EdgeEgressRuleWarning c1.api.edge.v1.EdgeEgressHostVerdict: description: |- EdgeEgressHostVerdict is the rule step's verdict for one host, plus Time Bandit's SSRF floor for IP literals. The mode (observe or enforce) and content inspection are not part of it. properties: allowed: description: The allowed field. type: boolean canonicalHost: description: |- The host after canonicalization; empty when it could not be canonicalized. type: string delegatedAuthzenServerId: description: >- The AuthzenServer that decides the host at request time, set only with EDGE_EGRESS_EVALUATION_OUTCOME_DELEGATED_TO_AUTHZEN. type: string host: description: The host as requested. type: string hostError: description: |- Why the host cannot be evaluated; set only with EDGE_EGRESS_EVALUATION_OUTCOME_INVALID_HOST. type: string matchedRuleIndex: description: Zero-based index of the deciding rule, or -1 when no rule decided. format: int32 type: integer outcome: description: The outcome field. enum: - EDGE_EGRESS_EVALUATION_OUTCOME_UNSPECIFIED - EDGE_EGRESS_EVALUATION_OUTCOME_NOT_RESTRICTED - EDGE_EGRESS_EVALUATION_OUTCOME_MATCHED_RULE - EDGE_EGRESS_EVALUATION_OUTCOME_DEFAULT_DENY - EDGE_EGRESS_EVALUATION_OUTCOME_INVALID_HOST - EDGE_EGRESS_EVALUATION_OUTCOME_UNRESOLVED_DENY_RULE - EDGE_EGRESS_EVALUATION_OUTCOME_SSRF_BLOCKED - EDGE_EGRESS_EVALUATION_OUTCOME_DELEGATED_TO_AUTHZEN type: string x-speakeasy-unknown-values: allow ruleMatches: description: Every rule whose pattern matches the host, in rule order. items: $ref: '#/components/schemas/c1.api.edge.v1.EdgeEgressRuleMatch' type: - array - 'null' title: Edge Egress Host Verdict type: object x-speakeasy-name-override: EdgeEgressHostVerdict c1.api.edge.v1.AuthzenRef: description: >- AuthzenRef names an AuthzenServer. An empty app_id means the Edge's own app for rules saved before cross-app references were supported. properties: appId: description: App that owns the AuthzenServer. Empty resolves to the Edge's app. type: string serverId: description: >- ID of the AuthzenServer. It must exist in the target app and be in OBSERVE or ENFORCE mode. type: string title: Authzen Ref type: object x-speakeasy-name-override: AuthzenRef c1.api.edge.v1.EdgeEgressPrincipal: description: > EdgeEgressPrincipal is the caller a rule matches against. Exactly one arm must be set. This message contains a oneof named scope. Only a single field of the following list may be set at a time: - all - userId - entitlementId properties: all: description: >- The all field. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - boolean - 'null' entitlementId: description: >- An App Entitlement belonging to the same App the Edge belongs to. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - string - 'null' userId: description: >- The userId field. This field is part of the `scope` oneof. See the documentation for `c1.api.edge.v1.EdgeEgressPrincipal` for more details. type: - string - 'null' title: Edge Egress Principal type: object x-speakeasy-name-override: EdgeEgressPrincipal c1.api.edge.v1.EdgeEgressRuleMatch: description: EdgeEgressRuleMatch is one rule whose pattern matches an evaluated host. properties: entitlementOverCap: description: |- A Deny rule whose entitlement has more members than the Edge config carries; it applies to every user, so principal_match is MATCHES. type: boolean principalMatch: description: The principalMatch field. enum: - EDGE_EGRESS_PRINCIPAL_MATCH_UNSPECIFIED - EDGE_EGRESS_PRINCIPAL_MATCH_MATCHES - EDGE_EGRESS_PRINCIPAL_MATCH_DOES_NOT_MATCH - EDGE_EGRESS_PRINCIPAL_MATCH_UNKNOWN type: string x-speakeasy-unknown-values: allow ruleIndex: description: The ruleIndex field. format: int32 type: integer shadowed: description: >- An earlier rule already decided this host for this caller, so this one never applies. Set only with EDGE_EGRESS_PRINCIPAL_MATCH_MATCHES. type: boolean title: Edge Egress Rule Match type: object x-speakeasy-name-override: EdgeEgressRuleMatch securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````