---
title: "POST /v1/{+parent}/securityActions"
method: POST
path: "/v1/{+parent}/securityActions"
tags: ["organizations"]
---

# POST /v1/{+parent}/securityActions

`POST /v1/{+parent}/securityActions`

CreateSecurityAction creates a SecurityAction.

## Path parameters

- `parent` string, required

## Query parameters

- `securityActionId` string

## Request body

- GoogleCloudApigeeV1SecurityAction — A SecurityAction is rule that can be enforced at an environment level. The result is one of: - A denied API call - An explicitly allowed API call - A flagged API call (HTTP headers added before the target receives it) At least one condition is required to create a SecurityAction.
  - `allow` GoogleCloudApigeeV1SecurityActionAllow — Message that should be set in case of an Allow Action. This does not have any fields.
  - `flag` GoogleCloudApigeeV1SecurityActionFlag — The message that should be set in the case of a Flag action.
    - `headers` GoogleCloudApigeeV1SecurityActionHttpHeader[] — Optional. A list of HTTP headers to be sent to the target in case of a FLAG SecurityAction. Limit 5 headers per SecurityAction. At least one is mandatory.
      - `name` string — The header name to be sent to the target.
      - `value` string — The header value to be sent to the target.
  - `updateTime` string, google-datetime — Output only. The update time for this SecurityAction. This reflects when this SecurityAction changed states.
  - `deny` GoogleCloudApigeeV1SecurityActionDeny — Message that should be set in case of a Deny Action.
    - `responseCode` integer — Optional. The HTTP response code if the Action = DENY.
  - `createTime` string, google-datetime — Output only. The create time for this SecurityAction.
  - `state` 'STATE_UNSPECIFIED' | 'ENABLED' | 'DISABLED' — Required. Only an ENABLED SecurityAction is enforced. An ENABLED SecurityAction past its expiration time will not be enforced.
  - `ttl` string, google-duration — Input only. The TTL for this SecurityAction.
  - `description` string — Optional. An optional user provided description of the SecurityAction.
  - `expireTime` string, google-datetime — The expiration for this SecurityAction.
  - `conditionConfig` GoogleCloudApigeeV1SecurityActionConditionConfig — The following are a list of conditions. A valid SecurityAction must contain at least one condition. Within a condition, each element is ORed. Across conditions elements are ANDed. For example if a SecurityAction has the following: ip_address_ranges: ["ip1", "ip2"] and bot_reasons: ["Flooder", "Robot Abuser"] then this is interpreted as: enforce the action if the incoming request has ((ip_address_ranges = "ip1" OR ip_address_ranges = "ip2") AND (bot_reasons="Flooder" OR bot_reasons="Robot Abuser")). Conditions other than ip_address_ranges and bot_reasons cannot be ANDed.
    - `developerApps` string[] — Optional. A list of developer apps. Limit 1000 per action.
    - `developers` string[] — Optional. A list of developers. Limit 1000 per action.
    - `asns` string[] — Optional. A list of ASN numbers to act on, e.g. 23. https://en.wikipedia.org/wiki/Autonomous_system_(Internet) This uses int64 instead of uint32 because of https://linter.aip.dev/141/forbidden-types.
    - `regionCodes` string[] — Optional. A list of countries/region codes to act on, e.g. US. This follows https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
    - `apiKeys` string[] — Optional. A list of API keys. Limit 1000 per action.
    - `apiProducts` string[] — Optional. A list of API Products. Limit 1000 per action.
    - `botReasons` string[] — Optional. A list of Bot Reasons. Current options: Flooder, Brute Guessor, Static Content Scraper, OAuth Abuser, Robot Abuser, TorListRule, Advanced Anomaly Detection, Advanced API Scraper, Search Engine Crawlers, Public Clouds, Public Cloud AWS, Public Cloud Azure, and Public Cloud Google.
    - `httpMethods` string[] — Optional. Act only on particular HTTP methods. E.g. A read-only API can block POST/PUT/DELETE methods. Accepted values are: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE and PATCH.
    - `userAgents` string[] — Optional. A list of user agents to deny. We look for exact matches. Limit 50 per action.
    - `ipAddressRanges` string[] — Optional. A list of IP addresses. This could be either IPv4 or IPv6. Limited to 100 per action.
    - `accessTokens` string[] — Optional. A list of access_tokens. Limit 1000 per action.
  - `apiProxies` string[] — Optional. If unset, this would apply to all proxies in the environment. If set, this action is enforced only if at least one proxy in the repeated list is deployed at the time of enforcement. If set, several restrictions are enforced on SecurityActions. There can be at most 100 enabled actions with proxies set in an env. Several other restrictions apply on conditions and are detailed later.
  - `name` string — Immutable. This field is ignored during creation as per AIP-133. Please set the `security_action_id` field in the CreateSecurityActionRequest when creating a new SecurityAction. Format: organizations/{org}/environments/{env}/securityActions/{security_action}

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/apigee.md) · [All operations](https://skmtc.net/google/apis/apigee/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/apigee/versions/6e272fa448a7/schema)