Add Firewall Condition
Attach a match condition to a firewall policy. Each condition in a policy carries a logical_operator (AND or OR) that controls how it composes with the next condition — see below.
Conditions match on request attributes: source_ip / CIDR, country and asn (both derived from the source IP via the platform's geolocation feed, refreshed daily), browser, user_agent, endpoint (host), path, method, header, cookie, protocol (http / tcp / udp), and port. Note protocol / port apply at the transport layer, so they also gate raw TCP/UDP tunnels — not just HTTP.
Path parameters
id string (uuid) Req
Policy UUID.
Request body
type string Req
Match category. See list for the catalog (case-insensitive; stored lowercased).
operator string Req
Comparison operator. Per type:
source_ip / protocol / port / method accept equals / in / not_in; free-form string fields path / endpoint add contains / starts_with / ends_with / regex; and the optionally-present fields header / cookie / user_agent / browser / country / asn additionally allow exists / not_exists (country / asn take equals / in / not_in / exists / not_exists). Case-insensitive; stored lowercased.value string
Pattern. Multiple values comma-separated for
operator: "in" ("RU,KP,IR"). Format per type: country = ISO 3166-1 alpha-2; asn = AS number (AS15169 or 15169); protocol = http / tcp / udp; port = 1–65535; method = HTTP verb (uppercased); source_ip = IP or CIDR; regex values are full Go regexp syntax. Empty value is allowed only for exists / not_exists.logical_operator string
AND (default) or OR. Connects this condition to the NEXT condition in the policy's evaluation order. Sequence is left-to-right: cond1 [op1] cond2 [op2] cond3 .... Stored upper-cased.Response (201 Created)
The newly-created condition.
Errors
400 Bad Request
Invalid
type / operator combination, malformed regex, malformed CIDR, or invalid JSON.401 Unauthorized
Missing auth.
404 Not Found
Policy doesn't exist.
Request — geo-restrict
curl -X POST "https://api.ngris.com/v1/firewall/policies/abc-123/conditions" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"type": "country",
"operator": "in",
"value": "RU,KP,IR"
}'
Request — block raw TCP
curl -X POST "https://api.ngris.com/v1/firewall/policies/abc-123/conditions" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"type": "protocol", "operator": "equals", "value": "tcp"}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client.firewall.create_condition("abc-123", {
"type": "country", "operator": "in", "value": "RU,KP,IR",
})
Response — 201 Created
{
"id": "cond-1",
"policy_id": "abc-123",
"condition_type": "country",
"operator": "in",
"condition_value": "RU,KP,IR",
"logical_operator": "AND",
"created_at": "2026-04-29T13:00:00Z"
}