Rules API
Allow or deny a call on a proxy, a credential, a target, or an MCP server.
Path, header, query, body, and token matches are on Predicates. Credential, target, and MCP rules use their own parent. The body is the same. A rule can hang off a proxy, an inbound credential, a target, or a direct MCP server. A proxy-backed MCP server returns 409. Create the rule on the backing proxy.
Evaluation
The runtime sorts active rules by descending priority and evaluates every match. Any matching deny wins, including when matching rules have equal priority. If every matching rule is allow, the call continues. If no rule matches, the parent record's default rule effect is used.
A denied request stops before the target call. The request log records the decision for the proxy, inbound credential, target, and target credential scopes.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/proxies/:proxyId/rules | List proxy rules |
| POST | /api/clients/:clientId/proxies/:proxyId/rules | Create a proxy rule |
| PUT | /api/clients/:clientId/proxies/:proxyId/rules/:ruleId | Update a proxy rule |
| DELETE | /api/clients/:clientId/proxies/:proxyId/rules/:ruleId | Delete a proxy rule |
| GET | /api/clients/:clientId/credentials/:credentialId/rules | List credential rules |
| POST | /api/clients/:clientId/credentials/:credentialId/rules | Create a credential rule |
| GET | /api/clients/:clientId/targets/:targetId/rules | List target rules |
| POST | /api/clients/:clientId/targets/:targetId/rules | Create a target rule |
| GET | /api/clients/:clientId/mcps/:mcpId/rules | List MCP rules |
| POST | /api/clients/:clientId/mcps/:mcpId/rules | Create an MCP rule |
List rules
GET /api/clients/:clientId/proxies/:proxyId/rules returns the rules on that proxy. Credential, target, and MCP list paths return the same shape. Add /:ruleId to return one rule.
Query parameters
None.
Response attributes
| Attribute | Type | Description |
|---|---|---|
rules | array | One or more rule objects. |
rules[].sKey | string | Rule id. Pass this as ruleId on other endpoints. |
rules[].pKey / parentId | string | Parent id (proxy, credential, target, or MCP server). |
rules[].userId | string | Creator user id. |
rules[].clientId | string | Organisation id. |
rules[].effect | string | "allow" or "deny". |
rules[].ruleActive | boolean | Whether the rule is evaluated. |
rules[].priority | number | Higher numbers are evaluated first. |
rules[].methods | array or null | HTTP methods the rule applies to, or null for all. |
rules[].path | object or null | Path predicate. Uses the Predicates shape. |
rules[].query | array or null | Query-parameter predicates. |
rules[].headers | array or null | Header predicates. |
rules[].body | array or null | JSON body predicates. |
rules[].token | array or null | JWT claim predicates. |
rules[].variables | array or null | Variable bindings. |
rules[].notes | string or null | Free-text note. |
rules[].alerts | object or null | Digest policy. |
rules[].ruleRegion | string | Region copied from the parent. |
rules[].createdAt | string | ISO 8601 creation time. |
rules[].updatedAt | string | ISO 8601 last update time. |
message | string | "Success". |
Create a proxy rule
POST /api/clients/:clientId/proxies/:proxyId/rules creates an allow or deny rule.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"effect": "allow",
"ruleActive": true,
"priority": 10
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"effect": "allow",
"ruleActive": true,
"priority": 10
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"effect\": \"allow\",\n \"ruleActive\": true,\n \"priority\": 10\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"effect": "allow",
"ruleActive": true,
"priority": 10
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"effect\": \"allow\",\n \"ruleActive\": true,\n \"priority\": 10\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"rules": [
{
"pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"sKey": "8f0c3d51-2b74-4a96-b1e3-5d7a9c2e4f08",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"ruleRegion": "us-east-2",
"effect": "allow",
"ruleActive": true,
"methods": null,
"path": null,
"query": null,
"headers": null,
"body": null,
"token": null,
"variables": null,
"priority": 10,
"notes": null,
"alerts": null,
"createdAt": "2026-11-02T07:30:00.000Z",
"updatedAt": "2026-11-02T07:30:00.000Z"
}
],
"message": "Success"
}{
"message": "Input failed data validation",
"errors": [
"/effect: must have required property 'effect'"
]
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns a rules array containing the created rule, with message set to "Success".
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
effect | string | ✓ | "allow" or "deny". |
ruleActive | boolean | ✓ | When true, the rule is evaluated. |
methods | string[] | — | HTTP methods this rule applies to: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". Omit to match every method. |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. Evaluated when the inbound credential has verified a JWT. |
variables | object[] | — | Bindings reused inside patterns. Each item is { name, source, key }. source is "headers", "params", "body", "static", or "jwtClaim". See Predicates. |
priority | number | — | Evaluation order. A higher number is evaluated first. Defaults to 0. |
notes | string | — | Free-text note stored on the rule. |
alerts | object | — | Digest policy on a proxy or a direct MCP server. Shape: { enabled, cadence?, alertNote? }. enabled is required inside the object. cadence is "minute", "hour", "day", or "month", and is required when enabled is true. alertNote is at most 500 characters. A credential or target rejects this field. |
The server sets pKey, sKey, userId, clientId, parentId, ruleRegion, createdAt, and updatedAt.
Returns a rules array. The attributes match List rules.
Update a proxy rule
PUT /api/clients/:clientId/proxies/:proxyId/rules/:ruleId updates one rule. Credential, target, and MCP rules take the same body on their own parent path.
All fields are optional. Omit a field to leave it unchanged; send null to clear it.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
effect | string | — | "allow" or "deny". |
ruleActive | boolean | — | Whether the rule is evaluated. |
methods | string[] | — | HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. |
variables | object[] | — | { name, source, key } bindings. source is "headers", "params", "body", "static", or "jwtClaim". See Predicates. |
priority | number | — | Evaluation order. A higher number is evaluated first. |
notes | string | — | Free-text note stored on the rule. |
alerts | object | — | { enabled, cadence?, alertNote? }. When the saved policy has enabled: true, cadence ("minute", "hour", "day", or "month") is required. alertNote is at most 500 characters. Allowed on a proxy or a direct MCP server. |
Returns a rules array with the updated rule. The attributes match List rules. updatedAt is the time of this call.
Delete a proxy rule
DELETE /api/clients/:clientId/proxies/:proxyId/rules/:ruleId removes the rule. The response message is "Rule deleted successfully from all tables".