---
title: "List Unwanted Access Rules"
method: GET
path: "/v1/unwanted_access_rules"
tags: ["Unwanted Access Rules"]
---

# List Unwanted Access Rules

`GET /v1/unwanted_access_rules`

Shows Unwanted Access Rules associated with your account.

Unwanted Access Rules govern how Huntress responds to identity access attempts matching specific attributes. Each rule targets a category (country, vpn, ip_address) and declares a determination — `expected` or `unauthorized` — at the account, organization, or identity scope.

**Note:** This endpoint will also return a `pagination` key on the root level.
Please refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.

## Query parameters

- `limit` integer
- `page_token` string
- `organization_id` integer
- `identity_id` integer
- `type` 'expected' | 'unauthorized'
- `status` 'active' | 'scheduled' | 'expired'
- `scope` 'account' | 'organization' | 'identity'
- `category` 'country' | 'vpn' | 'ip_address'
- `country_code` string
- `vpn` string
- `ip_address` string
- `logic` 'standard' | 'catchall' | 'catchall_exception'

## Response `200`

List Unwanted Access Rules

- object
  - `unwanted_access_rules` UnwantedAccessRule[], required
    - `id` integer — A Huntress-unique identifier for the rule.
    - `applied_to` unknown
    - `category` 'country' | 'vpn' | 'ip_address' — The category of attribute this rule governs.
    - `country_code` string — ISO 3166-1 alpha-2 country code this rule matches. Null unless `category` is `country`.
    - `vpn` string — Tunnel operator name this rule matches. Null unless `category` is `vpn`.
    - `ip_address` string — IP Address this rule matches. Null unless `category` is `ip_address`.
    - `type` 'expected' | 'unauthorized' — Whether matching access is expected or unauthorized.
    - `status` 'active' | 'scheduled' | 'expired' | 'not_applicable' — The current status of the rule.
    - `logic` 'catchall_exception' | 'catchall' | 'standard' — How the rule matches: `standard` matches a specific value within the `country`, `vpn`, or `ip_address` category, `catchall` matches all values in the category, and `catchall_exception` opts the resource out of an inherited catchall.
    - `note` string — Optional free-text note the rule author attached to the rule.
    - `starts_at` string, date-time — ISO-8601 formatted timestamp for when this rule becomes active. Null for unscheduled rules.
    - `expires_at` string, date-time — ISO-8601 formatted timestamp for when this rule expires. Null if the rule does not expire.
    - `created_by` string — The name of the user who created this rule, or "Deleted" if the user has been removed.
    - `created_at` string, date-time — ISO-8601 formatted timestamp for when this rule was created.
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this rule was last updated.
  - `pagination` Pagination, required — Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `400` — Invalid request parameters.
- `403` — There was an issue with your API credential or permissions.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)