---
title: "POST /v1/{+parent}/securityProfiles"
method: POST
path: "/v1/{+parent}/securityProfiles"
tags: ["projects"]
---

# POST /v1/{+parent}/securityProfiles

`POST /v1/{+parent}/securityProfiles`

Creates a new SecurityProfile in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `securityProfileId` string

## Request body

- SecurityProfile — SecurityProfile is a resource that defines the behavior for one of many ProfileTypes.
  - `threatPreventionProfile` ThreatPreventionProfile — ThreatPreventionProfile defines an action for specific threat signatures or severity levels.
    - `antivirusOverrides` AntivirusOverride[] — Optional. Configuration for overriding antivirus actions per protocol.
      - `action` 'THREAT_ACTION_UNSPECIFIED' | 'DEFAULT_ACTION' | 'ALLOW' | 'ALERT' | 'DENY' — Required. Threat action override. For some threat types, only a subset of actions applies.
      - `protocol` 'PROTOCOL_UNSPECIFIED' | 'SMTP' | 'SMB' | 'POP3' | 'IMAP' | 'HTTP2' | 'HTTP' | 'FTP' — Required. Protocol to match.
    - `threatOverrides` ThreatOverride[] — Optional. Configuration for overriding threats actions by threat_id match. If a threat is matched both by configuration provided in severity_overrides and threat_overrides, the threat_overrides action is applied.
      - `threatId` string — Required. Vendor-specific ID of a threat to override.
      - `type` 'THREAT_TYPE_UNSPECIFIED' | 'UNKNOWN' | 'VULNERABILITY' | 'ANTIVIRUS' | 'SPYWARE' | 'DNS' — Output only. Type of the threat (read only).
      - `action` 'THREAT_ACTION_UNSPECIFIED' | 'DEFAULT_ACTION' | 'ALLOW' | 'ALERT' | 'DENY' — Required. Threat action override. For some threat types, only a subset of actions applies.
    - `severityOverrides` SeverityOverride[] — Optional. Configuration for overriding threats actions by severity match.
      - `severity` 'SEVERITY_UNSPECIFIED' | 'INFORMATIONAL' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' — Required. Severity level to match.
      - `action` 'THREAT_ACTION_UNSPECIFIED' | 'DEFAULT_ACTION' | 'ALLOW' | 'ALERT' | 'DENY' — Required. Threat action override.
  - `urlFilteringProfile` UrlFilteringProfile — UrlFilteringProfile defines filters based on URL.
    - `urlFilters` UrlFilter[] — Optional. The list of filtering configs in which each config defines an action to take for some URL match.
      - `filteringAction` 'URL_FILTERING_ACTION_UNSPECIFIED' | 'ALLOW' | 'DENY' — Required. The action taken when this filter is applied.
      - `priority` integer — Required. The priority of this filter within the URL Filtering Profile. Lower integers indicate higher priorities. The priority of a filter must be unique within a URL Filtering Profile.
      - `urls` string[] — Required. The list of strings that a URL must match with for this filter to be applied.
  - `updateTime` string, google-datetime — Output only. Last resource update timestamp.
  - `name` string — Immutable. Identifier. Name of the SecurityProfile resource. It matches pattern `projects|organizations/*/locations/{location}/securityProfiles/{security_profile}`.
  - `labels` object — Optional. Labels as key value pairs.
  - `customMirroringProfile` CustomMirroringProfile — CustomMirroringProfile defines out-of-band integration behavior (mirroring). It is used by mirroring rules with a MIRROR action.
    - `mirroringEndpointGroup` string — Required. Immutable. The target MirroringEndpointGroup. When a mirroring rule with this security profile attached matches a packet, a replica will be mirrored to the location-local target in this group.
  - `description` string — Optional. An optional description of the profile. Max length 512 characters.
  - `createTime` string, google-datetime — Output only. Resource creation timestamp.
  - `type` 'PROFILE_TYPE_UNSPECIFIED' | 'THREAT_PREVENTION' | 'CUSTOM_MIRRORING' | 'CUSTOM_INTERCEPT' | 'URL_FILTERING' — Immutable. The single ProfileType that the SecurityProfile resource configures.
  - `customInterceptProfile` CustomInterceptProfile — CustomInterceptProfile defines in-band integration behavior (intercept). It is used by firewall rules with an APPLY_SECURITY_PROFILE_GROUP action.
    - `interceptEndpointGroup` string — Required. The target InterceptEndpointGroup. When a firewall rule with this security profile attached matches a packet, the packet will be intercepted to the location-local target in this group.
  - `etag` string — Output only. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/networksecurity.md) · [All operations](https://skmtc.net/google/apis/networksecurity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networksecurity/versions/4afd54463fe6/schema)