POST
/v1/mgmt/authaccess/rule/tenant/{tenantId}Authorization
Descope Project ID and Management Key AuthorizationBearer <token>
Project ID:Management Key as bearer token.
In: header
Path Parameters
tenantId*string
Request Body
application/json
id?string
Server-generated, rejected on create and required on update.
name?string
description?string
enabled?boolean
Defaults to true on create.
effect?string
Required on create. Evaluation is first-match.
conditions?unknown
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
createdTime?integer
int32 epoch seconds: proto3 emits int64 as JSON string. See .claude/rules/proto-files.md.
Format
int32modifiedTime?integer
Format
int32evaluationOrder?integer
1-based position in the evaluation order, set through the reorder and settings endpoints.
Format
int32expireTime?integer
Epoch seconds after which the rule is no longer evaluated. 0 means never.
Format
int32Create a tenant-level auth access policy rule. The rule is appended at the end of the tenant evaluation order, using a valid management key.
curl -X POST "https://api.descope.com/v1/mgmt/authaccess/rule/tenant/string" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "string", "name": "string", "description": "string", "enabled": true, "effect": "string", "conditions": null, "createdTime": 0, "modifiedTime": 0, "evaluationOrder": 0, "expireTime": 0}/** * conditions is a list of {key, operator, values} objects, all of which must match. key is one of request.ip, * request.country, user.email, user.emailDomain, user.loginId and user.phone. operator is one of equal, notEqual, in, * notIn, inCidr and notInCidr, where equal, notEqual, inCidr and notInCidr take exactly one value. Values must be in * canonical form: lowercase emails and domains, uppercase countries, E.164 phones and compressed IP addresses. With * equal and notEqual the value may instead be a reference of the form {{jwtClaims.<name>}}, which compares the * attribute against the named top-level custom claim of the token the caller presented. An absent claim never * matches, notEqual included. */export interface Response {/** * Server-generated, rejected on create and required on update. */id?: stringname?: stringdescription?: string/** * Defaults to true on create. */enabled?: boolean/** * Required on create. Evaluation is first-match. */effect?: string/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */conditions?: {[k: string]: unknown}/** * int32 epoch seconds: proto3 emits int64 as JSON string. See .claude/rules/proto-files.md. */createdTime?: numbermodifiedTime?: number/** * 1-based position in the evaluation order, set through the reorder and settings endpoints. */evaluationOrder?: number/** * Epoch seconds after which the rule is no longer evaluated. 0 means never. */expireTime?: number} Was this helpful?