Create Conditions Firewall

Add Firewall Condition

POST /v1/firewall/policies/{uuid}/conditions

Attach a match condition to a firewall policy. Each condition in a policy carries a logical_operator (AND or OR) that controls how it composes with the next condition — see below.

Conditions match on request attributes: source_ip / CIDR, country and asn (both derived from the source IP via the platform's geolocation feed, refreshed daily), browser, user_agent, endpoint (the endpoint’s uuid), path, method, header, cookie, protocol (http / tcp / udp), and port. Note protocol / port apply at the transport layer, so they also gate raw TCP/UDP tunnels — not just HTTP.

Path parameters

uuid string (uuid) Req

The policy's uuid (= its id) from /firewall/policies.

Request body

type string Req

Match category. See list for the catalog (case-insensitive; stored lowercased).

operator string Req

Comparison operator. Per type: source_ip / protocol / port / method accept equals / in / not_in; free-form string fields path / endpoint add contains / starts_with / ends_with / regex; and the optionally-present fields header / cookie / user_agent / browser / country / asn additionally allow exists / not_exists (country / asn take equals / in / not_in / exists / not_exists). Case-insensitive; stored lowercased.

value string

Pattern. Multiple values comma-separated for operator: "in" ("RU,KP,IR"). Format per type: country = ISO 3166-1 alpha-2; asn = AS number (AS15169 or 15169); protocol = http / tcp / udp; port = 1–65535; method = HTTP verb (uppercased); source_ip = IP or CIDR; endpoint = the endpoint's uuid from GET /v1/endpoints (a list for in / not_in; a legacy integer endpoint id of your own endpoint is stored and returned as its uuid; a hostname is stored as typed and matches nothing); regex values are full Go regexp syntax. Empty value is allowed only for exists / not_exists.

logical_operator string

AND (default) or OR. Connects this condition to the NEXT condition in the policy's evaluation order. Sequence is left-to-right: cond1 [op1] cond2 [op2] cond3 .... Stored upper-cased.

Response (201 Created)

The new condition, appended last in the policy's evaluation order, with the fields described in list: uuid, policy_uuid, condition_type, operator, condition_value (stored form: an in list is joined with ", "), logical_operator, created_at, and id / policy_id (the same uuids).

Errors

400 Bad Request

Invalid type / operator combination, malformed regex, malformed CIDR, or invalid JSON.

401 Unauthorized

Missing auth.

404 Not Found

Policy doesn't exist, belongs to another account, or the path segment isn't a uuid.

Request — geo-restrict
curl -X POST "https://api.ngris.com/v1/firewall/policies/019c32cb-35d7-786f-b2c5-d108951e23d8/conditions" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "country",
    "operator": "in",
    "value": "RU,KP,IR"
  }'

Request — block raw TCP
curl -X POST "https://api.ngris.com/v1/firewall/policies/019c32cb-35d7-786f-b2c5-d108951e23d8/conditions" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"type": "protocol", "operator": "equals", "value": "tcp"}'

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
client.firewall.create_condition("019c32cb-35d7-786f-b2c5-d108951e23d8", {
    "type": "country", "operator": "in", "value": "RU,KP,IR",
})

Response — 201 Created
{
  "id": "019c4790-e565-733a-8f1b-52bc76befe65",
  "uuid": "019c4790-e565-733a-8f1b-52bc76befe65",
  "policy_id": "019c32cb-35d7-786f-b2c5-d108951e23d8",
  "policy_uuid": "019c32cb-35d7-786f-b2c5-d108951e23d8",
  "condition_type": "country",
  "operator": "in",
  "condition_value": "RU, KP, IR",
  "logical_operator": "AND",
  "created_at": "2026-04-29T13:00:00Z"
}

Was this helpful?

PreviousList Conditions NextUpdate Condition

On this page

Add Firewall Condition

Was this helpful?