List Firewall Policies

GET /v1/firewall/policies

List the WAF/firewall policies on the calling user's account. Firewall policies are evaluated before traffic policies — a request blocked by the firewall never reaches the agent. Each policy has an action (allow or block) and a list of conditions; if all conditions match, the action fires.

Policies are evaluated in priority order (lower first). The first matching policy determines the verdict; subsequent policies are skipped (allow-list / block-list semantics).

Distinct from traffic policies: firewall policies are account-wide and binary (allow/block), while traffic policies attach per-endpoint and can do rich actions (rate limit, redirect, transform).

Query parameters

enabled boolean
Filter to enabled (true) or disabled (false) policies. Omit for all.
include_conditions boolean
Default true — each policy carries its full conditions array. Set false to omit conditions for a lighter response.
page, page_size int
Opt-in pagination. Omitting page returns the full set. When page is supplied without page_size, default page size applies; capped at 200. When paginated, the response object also carries total, page, and page_size.

Response (200 OK)

A JSON object {"policies": [...]} (ordered by priority ASC). Each policy:

id string (uuid)
Policy UUID. Used in /policies/{id}.
user_id int64
Owner.
account_id int64?
Owning account (omitted when null).
name, description string
Free-form label and description.
action string
allow or block. allow stops further policy evaluation and lets the request through; block rejects (HTTP 403 by default, or the account's custom firewall error template if active).
priority int
Lower runs earlier. Default 100.
enabled boolean
false skips this policy at evaluation time.
conditions array
The policy's conditions (included unless include_conditions=false). A policy with zero conditions matches every request (use carefully). Each condition: {id, policy_id, condition_type, operator, condition_value, logical_operator, created_at}.
hit_count, last_matched, hits_daily int / datetime? / int[]
Traffic-log match stats over the last 7 days (best-effort). last_matched is null if never matched in-window; hits_daily is a per-day series (index 0 = oldest).
shadowed, shadow_reason boolean / string
Set when a higher-priority catch-all renders this policy unreachable. Only computed when conditions are loaded.
created_at, updated_at datetime
RFC 3339 UTC.

The top-level response object may also include a posture summary (account-level firewall stats) alongside policies.

Errors

401 Unauthorized
Missing auth.
Request
curl "https://api.ngris.com/v1/firewall/policies" \ -H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") for p in client.firewall.list_policies(): print(f"[{p['priority']:>3}] {p['action']:<6} {p['name']}")
Response — 200 OK
{ "policies": [ { "id": "abc-123", "user_id": 1024, "name": "block-tor", "description": "Block known Tor exit nodes", "action": "block", "priority": 10, "enabled": true, "conditions": [ {"id": "cond-1", "policy_id": "abc-123", "condition_type": "country", "operator": "in", "condition_value": "RU, KP", "logical_operator": "AND", "created_at": "2026-04-01T00:00:00Z"} ], "hit_count": 42, "created_at": "2026-04-01T00:00:00Z", "updated_at": "2026-04-01T00:00:00Z" } ] }
On this page
List Firewall Policies
Iris