--- title: "POST /v1/{+parent}/authzPolicies" method: POST path: "/v1/{+parent}/authzPolicies" tags: ["projects"] --- # POST /v1/{+parent}/authzPolicies `POST /v1/{+parent}/authzPolicies` Creates a new AuthzPolicy in a given project and location. ## Path parameters - `parent` string, required ## Query parameters - `authzPolicyId` string - `requestId` string ## Request body - AuthzPolicy — `AuthzPolicy` is a resource that allows to forward traffic to a callout backend designed to scan the traffic for security purposes. - `target` AuthzPolicyTarget — Specifies the set of targets to which this policy should be applied to. - `loadBalancingScheme` 'LOAD_BALANCING_SCHEME_UNSPECIFIED' | 'INTERNAL_MANAGED' | 'EXTERNAL_MANAGED' | 'INTERNAL_SELF_MANAGED' — Optional. All gateways and forwarding rules referenced by this policy and extensions must share the same load balancing scheme. Required only when targeting forwarding rules. If targeting Secure Web Proxy, this field must be `INTERNAL_MANAGED` or not specified. Must not be specified when targeting Agent Gateway. Supported values: `INTERNAL_MANAGED` and `EXTERNAL_MANAGED`. For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service). - `resources` string[] — Required. A list of references to the Forwarding Rules, Secure Web Proxy Gateways, or Agent Gateways on which this policy will be applied. - `createTime` string, google-datetime — Output only. The timestamp when the resource was created. - `description` string — Optional. A human-readable description of the resource. - `labels` object — Optional. Set of labels associated with the `AuthzPolicy` resource. The format must comply with [the following requirements](/compute/docs/labeling-resources#requirements). - `customProvider` AuthzPolicyCustomProvider — Allows delegating authorization decisions to Cloud IAP or to Service Extensions. - `cloudIap` AuthzPolicyCustomProviderCloudIap — Optional. Delegates authorization decisions to Cloud IAP. Applicable only for managed load balancers. Enabling Cloud IAP at the AuthzPolicy level is not compatible with Cloud IAP settings in the BackendService. Enabling IAP in both places will result in request failure. Ensure that IAP is enabled in either the AuthzPolicy or the BackendService but not in both places. - `authzExtension` AuthzPolicyCustomProviderAuthzExtension — Optional. Delegate authorization decision to user authored extension. Only one of cloudIap or authzExtension can be specified. - `resources` string[] — Required. A list of references to authorization extensions that will be invoked for requests matching this policy. Limited to 1 custom provider. - `name` string — Required. Identifier. Name of the `AuthzPolicy` resource in the following format: `projects/{project}/locations/{location}/authzPolicies/{authz_policy}`. - `action` 'AUTHZ_ACTION_UNSPECIFIED' | 'ALLOW' | 'DENY' | 'CUSTOM' — Required. Can be one of `ALLOW`, `DENY`, `CUSTOM`. When the action is `CUSTOM`, `customProvider` must be specified. When the action is `ALLOW`, only requests matching the policy will be allowed. When the action is `DENY`, only requests matching the policy will be denied. When a request arrives, the policies are evaluated in the following order: 1. If there is a `CUSTOM` policy that matches the request, the `CUSTOM` policy is evaluated using the custom authorization providers and the request is denied if the provider rejects the request. 2. If there are any `DENY` policies that match the request, the request is denied. 3. If there are no `ALLOW` policies for the resource or if any of the `ALLOW` policies match the request, the request is allowed. 4. Else the request is denied by default if none of the configured AuthzPolicies with `ALLOW` action match the request. - `policyProfile` 'POLICY_PROFILE_UNSPECIFIED' | 'REQUEST_AUTHZ' | 'CONTENT_AUTHZ' — Optional. Immutable. Defines the type of authorization being performed. If not specified, `REQUEST_AUTHZ` is applied. This field cannot be changed once AuthzPolicy is created. - `updateTime` string, google-datetime — Output only. The timestamp when the resource was updated. - `networkRules` AuthzPolicyAuthzRule[] — Optional. A list of authorization network rules to match against the incoming request. A policy match occurs when at least one network rule matches the request. At least one network rule is required for Allow or Deny Action if no HTTP rules are provided. Network rules are mutually exclusive with HTTP rules. Limited to 5 rules. - `from` AuthzPolicyAuthzRuleFrom — Describes properties of one or more sources of a request. - `sources` AuthzPolicyAuthzRuleFromRequestSource[] — Optional. Describes the properties of a request's sources. At least one of sources or notSources must be specified. Limited to 1 source. A match occurs when ANY source (in sources or notSources) matches the request. Within a single source, the match follows AND semantics across fields and OR semantics within a single field, i.e. a match occurs when ANY principal matches AND ANY ipBlocks match. - `ipBlocks` AuthzPolicyAuthzRuleIpBlock[] — Optional. A list of IP addresses or IP address ranges to match against the source IP address of the request. Limited to 10 ip_blocks per Authorization Policy - `length` integer — Required. The length of the address range. - `prefix` string — Required. The address prefix. - `resources` AuthzPolicyAuthzRuleRequestResource[] — Optional. A list of resources to match against the resource of the source VM of a request. Limited to 10 resources per Authorization Policy. - `tagValueIdSet` AuthzPolicyAuthzRuleRequestResourceTagValueIdSet — Describes a set of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. - `ids` string[] — Required. A list of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. The match follows AND semantics which means all the ids must match. Limited to 5 ids in the Tag value id set. - `iamServiceAccount` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `principals` AuthzPolicyAuthzRulePrincipal[] — Optional. A list of identities derived from the client's certificate. This field will not match on a request unless frontend mutual TLS is enabled for the forwarding rule or Gateway and the client certificate has been successfully validated by mTLS. Each identity is a string whose value is matched against a list of URI SANs, DNS Name SANs, or the common name in the client's certificate. A match happens when any principal matches with the rule. Limited to 50 principals per Authorization Policy for regional internal Application Load Balancers, regional external Application Load Balancers, cross-region internal Application Load Balancers, and Cloud Service Mesh while 25 principals per Authorization Policy for global external Application Load Balancers. - `principalSelector` 'PRINCIPAL_SELECTOR_UNSPECIFIED' | 'CLIENT_CERT_URI_SAN' | 'CLIENT_CERT_DNS_NAME_SAN' | 'CLIENT_CERT_COMMON_NAME' — Optional. An enum to decide what principal value the principal rule will match against. If not specified, the PrincipalSelector is CLIENT_CERT_URI_SAN. - `principal` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `notSources` AuthzPolicyAuthzRuleFromRequestSource[] — Optional. Describes the negated properties of request sources. Matches requests from sources that do not match the criteria specified in this field. At least one of sources or notSources must be specified. - `ipBlocks` AuthzPolicyAuthzRuleIpBlock[] — Optional. A list of IP addresses or IP address ranges to match against the source IP address of the request. Limited to 10 ip_blocks per Authorization Policy - `length` integer — Required. The length of the address range. - `prefix` string — Required. The address prefix. - `resources` AuthzPolicyAuthzRuleRequestResource[] — Optional. A list of resources to match against the resource of the source VM of a request. Limited to 10 resources per Authorization Policy. - `tagValueIdSet` AuthzPolicyAuthzRuleRequestResourceTagValueIdSet — Describes a set of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. - `ids` string[] — Required. A list of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. The match follows AND semantics which means all the ids must match. Limited to 5 ids in the Tag value id set. - `iamServiceAccount` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `principals` AuthzPolicyAuthzRulePrincipal[] — Optional. A list of identities derived from the client's certificate. This field will not match on a request unless frontend mutual TLS is enabled for the forwarding rule or Gateway and the client certificate has been successfully validated by mTLS. Each identity is a string whose value is matched against a list of URI SANs, DNS Name SANs, or the common name in the client's certificate. A match happens when any principal matches with the rule. Limited to 50 principals per Authorization Policy for regional internal Application Load Balancers, regional external Application Load Balancers, cross-region internal Application Load Balancers, and Cloud Service Mesh while 25 principals per Authorization Policy for global external Application Load Balancers. - `principalSelector` 'PRINCIPAL_SELECTOR_UNSPECIFIED' | 'CLIENT_CERT_URI_SAN' | 'CLIENT_CERT_DNS_NAME_SAN' | 'CLIENT_CERT_COMMON_NAME' — Optional. An enum to decide what principal value the principal rule will match against. If not specified, the PrincipalSelector is CLIENT_CERT_URI_SAN. - `principal` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `when` string — Optional. CEL expression that describes the conditions to be satisfied for the action. The result of the CEL expression is ANDed with the from and to. Refer to the CEL language reference for a list of available attributes. - `to` AuthzPolicyAuthzRuleTo — Describes properties of one or more targets of a request. - `notOperations` AuthzPolicyAuthzRuleToRequestOperation[] — Optional. Describes the negated properties of the targets of a request. Matches requests for operations that do not match the criteria specified in this field. At least one of operations or notOperations must be specified. - `paths` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of paths to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 paths per Authorization Policy. Note that this path match includes the query parameters. For gRPC services, this should be a fully-qualified name of the form /package.service/method. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `hosts` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of HTTP Hosts to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 hosts per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `methods` string[] — Optional. A list of HTTP methods to match against. Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS). It only allows exact match and is always case sensitive. Limited to 10 methods per Authorization Policy. - `snis` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of SNIs to match against. The match can be one of exact, prefix, suffix, or contains (substring match). If there is no SNI (i.e. plaintext HTTP traffic), the request will be denied. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 SNIs per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `headerSet` AuthzPolicyAuthzRuleToRequestOperationHeaderSet — Describes a set of HTTP headers to match against. - `headers` AuthzPolicyAuthzRuleHeaderMatch[] — Required. A list of headers to match against in http header. The match can be one of exact, prefix, suffix, or contains (substring match). The match follows AND semantics which means all the headers must match. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 headers per Authorization Policy. - `name` string — Optional. Specifies the name of the header in the request. - `value` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - … - `mcp` AuthzPolicyAuthzRuleToRequestOperationMCP — Describes a set of MCP protocol attributes to match against for a given MCP request. - `baseProtocolMethodsOption` 'BASE_PROTOCOL_METHODS_OPTION_UNSPECIFIED' | 'SKIP_BASE_PROTOCOL_METHODS' | 'MATCH_BASE_PROTOCOL_METHODS' — Optional. If specified, matches on the MCP protocol’s non-access specific methods namely: * initialize * completion/ * logging/ * notifications/ * ping Defaults to SKIP_BASE_PROTOCOL_METHODS if not specified. - `methods` AuthzPolicyAuthzRuleToRequestOperationMCPMethod[] — Optional. A list of MCP methods and associated parameters to match on. It is recommended to use this field to match on tools, prompts and resource accesses while setting the baseProtocolMethodsOption to MATCH_BASE_PROTOCOL_METHODS to match on all the other MCP protocol methods. Limited to 10 MCP methods per Authorization Policy. - `name` string — Required. The MCP method to match against. Allowed values are as follows: 1. `tools`, `prompts`, `resources` - these will match against all sub methods under the respective methods. 2. `prompts/list`, `tools/list`, `resources/list`, `resources/templates/list` 3. `prompts/get`, `tools/call`, `resources/subscribe`, `resources/unsubscribe`, `resources/read` Params cannot be specified for categories 1 and 2. - `params` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of MCP method parameters to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 MCP method parameters per Authorization Policy. - … - `operations` AuthzPolicyAuthzRuleToRequestOperation[] — Optional. Describes properties of one or more targets of a request. At least one of operations or notOperations must be specified. Limited to 1 operation. A match occurs when ANY operation (in operations or notOperations) matches. Within an operation, the match follows AND semantics across fields and OR semantics within a field, i.e. a match occurs when ANY path matches AND ANY header matches and ANY method matches. - `paths` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of paths to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 paths per Authorization Policy. Note that this path match includes the query parameters. For gRPC services, this should be a fully-qualified name of the form /package.service/method. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `hosts` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of HTTP Hosts to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 hosts per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `methods` string[] — Optional. A list of HTTP methods to match against. Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS). It only allows exact match and is always case sensitive. Limited to 10 methods per Authorization Policy. - `snis` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of SNIs to match against. The match can be one of exact, prefix, suffix, or contains (substring match). If there is no SNI (i.e. plaintext HTTP traffic), the request will be denied. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 SNIs per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `headerSet` AuthzPolicyAuthzRuleToRequestOperationHeaderSet — Describes a set of HTTP headers to match against. - `headers` AuthzPolicyAuthzRuleHeaderMatch[] — Required. A list of headers to match against in http header. The match can be one of exact, prefix, suffix, or contains (substring match). The match follows AND semantics which means all the headers must match. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 headers per Authorization Policy. - `name` string — Optional. Specifies the name of the header in the request. - `value` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - … - `mcp` AuthzPolicyAuthzRuleToRequestOperationMCP — Describes a set of MCP protocol attributes to match against for a given MCP request. - `baseProtocolMethodsOption` 'BASE_PROTOCOL_METHODS_OPTION_UNSPECIFIED' | 'SKIP_BASE_PROTOCOL_METHODS' | 'MATCH_BASE_PROTOCOL_METHODS' — Optional. If specified, matches on the MCP protocol’s non-access specific methods namely: * initialize * completion/ * logging/ * notifications/ * ping Defaults to SKIP_BASE_PROTOCOL_METHODS if not specified. - `methods` AuthzPolicyAuthzRuleToRequestOperationMCPMethod[] — Optional. A list of MCP methods and associated parameters to match on. It is recommended to use this field to match on tools, prompts and resource accesses while setting the baseProtocolMethodsOption to MATCH_BASE_PROTOCOL_METHODS to match on all the other MCP protocol methods. Limited to 10 MCP methods per Authorization Policy. - `name` string — Required. The MCP method to match against. Allowed values are as follows: 1. `tools`, `prompts`, `resources` - these will match against all sub methods under the respective methods. 2. `prompts/list`, `tools/list`, `resources/list`, `resources/templates/list` 3. `prompts/get`, `tools/call`, `resources/subscribe`, `resources/unsubscribe`, `resources/read` Params cannot be specified for categories 1 and 2. - `params` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of MCP method parameters to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 MCP method parameters per Authorization Policy. - … - `httpRules` AuthzPolicyAuthzRule[] — Optional. A list of authorization HTTP rules to match against the incoming request. A policy match occurs when at least one HTTP rule matches the request or when no HTTP rules are specified in the policy. At least one HTTP Rule is required for Allow or Deny Action. Limited to 5 rules. - `from` AuthzPolicyAuthzRuleFrom — Describes properties of one or more sources of a request. - `sources` AuthzPolicyAuthzRuleFromRequestSource[] — Optional. Describes the properties of a request's sources. At least one of sources or notSources must be specified. Limited to 1 source. A match occurs when ANY source (in sources or notSources) matches the request. Within a single source, the match follows AND semantics across fields and OR semantics within a single field, i.e. a match occurs when ANY principal matches AND ANY ipBlocks match. - `ipBlocks` AuthzPolicyAuthzRuleIpBlock[] — Optional. A list of IP addresses or IP address ranges to match against the source IP address of the request. Limited to 10 ip_blocks per Authorization Policy - `length` integer — Required. The length of the address range. - `prefix` string — Required. The address prefix. - `resources` AuthzPolicyAuthzRuleRequestResource[] — Optional. A list of resources to match against the resource of the source VM of a request. Limited to 10 resources per Authorization Policy. - `tagValueIdSet` AuthzPolicyAuthzRuleRequestResourceTagValueIdSet — Describes a set of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. - `ids` string[] — Required. A list of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. The match follows AND semantics which means all the ids must match. Limited to 5 ids in the Tag value id set. - `iamServiceAccount` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `principals` AuthzPolicyAuthzRulePrincipal[] — Optional. A list of identities derived from the client's certificate. This field will not match on a request unless frontend mutual TLS is enabled for the forwarding rule or Gateway and the client certificate has been successfully validated by mTLS. Each identity is a string whose value is matched against a list of URI SANs, DNS Name SANs, or the common name in the client's certificate. A match happens when any principal matches with the rule. Limited to 50 principals per Authorization Policy for regional internal Application Load Balancers, regional external Application Load Balancers, cross-region internal Application Load Balancers, and Cloud Service Mesh while 25 principals per Authorization Policy for global external Application Load Balancers. - `principalSelector` 'PRINCIPAL_SELECTOR_UNSPECIFIED' | 'CLIENT_CERT_URI_SAN' | 'CLIENT_CERT_DNS_NAME_SAN' | 'CLIENT_CERT_COMMON_NAME' — Optional. An enum to decide what principal value the principal rule will match against. If not specified, the PrincipalSelector is CLIENT_CERT_URI_SAN. - `principal` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `notSources` AuthzPolicyAuthzRuleFromRequestSource[] — Optional. Describes the negated properties of request sources. Matches requests from sources that do not match the criteria specified in this field. At least one of sources or notSources must be specified. - `ipBlocks` AuthzPolicyAuthzRuleIpBlock[] — Optional. A list of IP addresses or IP address ranges to match against the source IP address of the request. Limited to 10 ip_blocks per Authorization Policy - `length` integer — Required. The length of the address range. - `prefix` string — Required. The address prefix. - `resources` AuthzPolicyAuthzRuleRequestResource[] — Optional. A list of resources to match against the resource of the source VM of a request. Limited to 10 resources per Authorization Policy. - `tagValueIdSet` AuthzPolicyAuthzRuleRequestResourceTagValueIdSet — Describes a set of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. - `ids` string[] — Required. A list of resource tag value permanent IDs to match against the resource manager tags value associated with the source VM of a request. The match follows AND semantics which means all the ids must match. Limited to 5 ids in the Tag value id set. - `iamServiceAccount` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `principals` AuthzPolicyAuthzRulePrincipal[] — Optional. A list of identities derived from the client's certificate. This field will not match on a request unless frontend mutual TLS is enabled for the forwarding rule or Gateway and the client certificate has been successfully validated by mTLS. Each identity is a string whose value is matched against a list of URI SANs, DNS Name SANs, or the common name in the client's certificate. A match happens when any principal matches with the rule. Limited to 50 principals per Authorization Policy for regional internal Application Load Balancers, regional external Application Load Balancers, cross-region internal Application Load Balancers, and Cloud Service Mesh while 25 principals per Authorization Policy for global external Application Load Balancers. - `principalSelector` 'PRINCIPAL_SELECTOR_UNSPECIFIED' | 'CLIENT_CERT_URI_SAN' | 'CLIENT_CERT_DNS_NAME_SAN' | 'CLIENT_CERT_COMMON_NAME' — Optional. An enum to decide what principal value the principal rule will match against. If not specified, the PrincipalSelector is CLIENT_CERT_URI_SAN. - `principal` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `when` string — Optional. CEL expression that describes the conditions to be satisfied for the action. The result of the CEL expression is ANDed with the from and to. Refer to the CEL language reference for a list of available attributes. - `to` AuthzPolicyAuthzRuleTo — Describes properties of one or more targets of a request. - `notOperations` AuthzPolicyAuthzRuleToRequestOperation[] — Optional. Describes the negated properties of the targets of a request. Matches requests for operations that do not match the criteria specified in this field. At least one of operations or notOperations must be specified. - `paths` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of paths to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 paths per Authorization Policy. Note that this path match includes the query parameters. For gRPC services, this should be a fully-qualified name of the form /package.service/method. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `hosts` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of HTTP Hosts to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 hosts per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `methods` string[] — Optional. A list of HTTP methods to match against. Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS). It only allows exact match and is always case sensitive. Limited to 10 methods per Authorization Policy. - `snis` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of SNIs to match against. The match can be one of exact, prefix, suffix, or contains (substring match). If there is no SNI (i.e. plaintext HTTP traffic), the request will be denied. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 SNIs per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `headerSet` AuthzPolicyAuthzRuleToRequestOperationHeaderSet — Describes a set of HTTP headers to match against. - `headers` AuthzPolicyAuthzRuleHeaderMatch[] — Required. A list of headers to match against in http header. The match can be one of exact, prefix, suffix, or contains (substring match). The match follows AND semantics which means all the headers must match. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 headers per Authorization Policy. - `name` string — Optional. Specifies the name of the header in the request. - `value` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - … - `mcp` AuthzPolicyAuthzRuleToRequestOperationMCP — Describes a set of MCP protocol attributes to match against for a given MCP request. - `baseProtocolMethodsOption` 'BASE_PROTOCOL_METHODS_OPTION_UNSPECIFIED' | 'SKIP_BASE_PROTOCOL_METHODS' | 'MATCH_BASE_PROTOCOL_METHODS' — Optional. If specified, matches on the MCP protocol’s non-access specific methods namely: * initialize * completion/ * logging/ * notifications/ * ping Defaults to SKIP_BASE_PROTOCOL_METHODS if not specified. - `methods` AuthzPolicyAuthzRuleToRequestOperationMCPMethod[] — Optional. A list of MCP methods and associated parameters to match on. It is recommended to use this field to match on tools, prompts and resource accesses while setting the baseProtocolMethodsOption to MATCH_BASE_PROTOCOL_METHODS to match on all the other MCP protocol methods. Limited to 10 MCP methods per Authorization Policy. - `name` string — Required. The MCP method to match against. Allowed values are as follows: 1. `tools`, `prompts`, `resources` - these will match against all sub methods under the respective methods. 2. `prompts/list`, `tools/list`, `resources/list`, `resources/templates/list` 3. `prompts/get`, `tools/call`, `resources/subscribe`, `resources/unsubscribe`, `resources/read` Params cannot be specified for categories 1 and 2. - `params` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of MCP method parameters to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 MCP method parameters per Authorization Policy. - … - `operations` AuthzPolicyAuthzRuleToRequestOperation[] — Optional. Describes properties of one or more targets of a request. At least one of operations or notOperations must be specified. Limited to 1 operation. A match occurs when ANY operation (in operations or notOperations) matches. Within an operation, the match follows AND semantics across fields and OR semantics within a field, i.e. a match occurs when ANY path matches AND ANY header matches and ANY method matches. - `paths` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of paths to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 paths per Authorization Policy. Note that this path match includes the query parameters. For gRPC services, this should be a fully-qualified name of the form /package.service/method. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `hosts` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of HTTP Hosts to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 hosts per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `methods` string[] — Optional. A list of HTTP methods to match against. Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS). It only allows exact match and is always case sensitive. Limited to 10 methods per Authorization Policy. - `snis` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of SNIs to match against. The match can be one of exact, prefix, suffix, or contains (substring match). If there is no SNI (i.e. plaintext HTTP traffic), the request will be denied. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 SNIs per Authorization Policy. - `exact` string — The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``. - `prefix` string — The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``abc.xyz`` - `suffix` string — The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc`` - `contains` string — The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * ``abc`` matches the value ``xyz.abc.def`` - `ignoreCase` boolean — If true, indicates the exact/prefix/suffix/contains matching should be case insensitive. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if set to true. - `headerSet` AuthzPolicyAuthzRuleToRequestOperationHeaderSet — Describes a set of HTTP headers to match against. - `headers` AuthzPolicyAuthzRuleHeaderMatch[] — Required. A list of headers to match against in http header. The match can be one of exact, prefix, suffix, or contains (substring match). The match follows AND semantics which means all the headers must match. Matches are always case sensitive unless the ignoreCase is set. Limited to 10 headers per Authorization Policy. - `name` string — Optional. Specifies the name of the header in the request. - `value` AuthzPolicyAuthzRuleStringMatch — Determines how a string value should be matched. - … - `mcp` AuthzPolicyAuthzRuleToRequestOperationMCP — Describes a set of MCP protocol attributes to match against for a given MCP request. - `baseProtocolMethodsOption` 'BASE_PROTOCOL_METHODS_OPTION_UNSPECIFIED' | 'SKIP_BASE_PROTOCOL_METHODS' | 'MATCH_BASE_PROTOCOL_METHODS' — Optional. If specified, matches on the MCP protocol’s non-access specific methods namely: * initialize * completion/ * logging/ * notifications/ * ping Defaults to SKIP_BASE_PROTOCOL_METHODS if not specified. - `methods` AuthzPolicyAuthzRuleToRequestOperationMCPMethod[] — Optional. A list of MCP methods and associated parameters to match on. It is recommended to use this field to match on tools, prompts and resource accesses while setting the baseProtocolMethodsOption to MATCH_BASE_PROTOCOL_METHODS to match on all the other MCP protocol methods. Limited to 10 MCP methods per Authorization Policy. - `name` string — Required. The MCP method to match against. Allowed values are as follows: 1. `tools`, `prompts`, `resources` - these will match against all sub methods under the respective methods. 2. `prompts/list`, `tools/list`, `resources/list`, `resources/templates/list` 3. `prompts/get`, `tools/call`, `resources/subscribe`, `resources/unsubscribe`, `resources/read` Params cannot be specified for categories 1 and 2. - `params` AuthzPolicyAuthzRuleStringMatch[] — Optional. A list of MCP method parameters to match against. The match can be one of exact, prefix, suffix, or contains (substring match). Matches are always case sensitive unless the ignoreCase is set. Limited to 10 MCP method parameters per Authorization Policy. - … ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/networksecurity.md) · [All operations](https://skmtc.net/google/apis/networksecurity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networksecurity/versions/4afd54463fe6/schema)