Sign in
latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Unwanted Access Rules

List Unwanted Access Rules

Shows Unwanted Access Rules associated with your account.

Unwanted Access Rules govern how Huntress responds to identity access attempts matching specific attributes. Each rule targets a category (country, vpn, ip_address) and declares a determination — expected or unauthorized — at the account, organization, or identity scope.

Note: This endpoint will also return a pagination key on the root level. Please refer to the pagination section within our docs for more information.

get/v1/unwanted_access_rules

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

organization_idinteger

Filter by organization ID within Huntress account.

identity_idinteger

Filter results to rules attached directly to this identity.

type'expected' | 'unauthorized'

Filter by rule type.

status'active' | 'scheduled' | 'expired'

Filter by rule status as shown in the Portal UI.

scope'account' | 'organization' | 'identity'

Filter by the level the rule is attached to.

category'country' | 'vpn' | 'ip_address'

Limit results to a single rule category.

country_codestring

Filter by country code value (ISO 3166-1 alpha-2). Implies category=country.

vpnstring

Filter by VPN (tunnel operator) value. Implies category=vpn.

ip_addressstring

Filter by IP Address value. Implies category=ip_address.

logic'standard' | 'catchall' | 'catchall_exception'

Filter by rule logic. standard returns rules with explicit values, catchall returns rules matching all values in a category, and catchall_exception returns rules that exclude specifically set values from an existing catchall rule. Omit this parameter to include all three.

Response

List Unwanted Access Rules

Example response

{
  "unwanted_access_rules": [
    {
      "id": 84938,
      "applied_to": {
        "type": "Organization",
        "id": 1234,
        "name": "ExampleCo"
      },
      "category": "country",
      "country_code": "US",
      "vpn": "NORD_VPN",
      "ip_address": "203.0.113.0/24",
      "type": "unauthorized",
      "status": "active",
      "logic": "standard",
      "note": "Approved by compliance — regional office access",
      "starts_at": "2025-09-05T18:20:34Z",
      "expires_at": "2025-12-05T18:20:34Z",
      "created_by": "Jane Doe",
      "created_at": "2025-09-05T18:20:34Z",
      "updated_at": "2025-09-05T18:20:34Z"
    }
  ]
}