RequestRocketRequestRocketDocs
ControlRules

Rules API

Allow or deny a call on a proxy, a credential, a target, or an MCP server.

Path, header, query, body, and token matches are on Predicates. Credential, target, and MCP rules use their own parent. The body is the same. A rule can hang off a proxy, an inbound credential, a target, or a direct MCP server. A proxy-backed MCP server returns 409. Create the rule on the backing proxy.

Evaluation

The runtime sorts active rules by descending priority and evaluates every match. Any matching deny wins, including when matching rules have equal priority. If every matching rule is allow, the call continues. If no rule matches, the parent record's default rule effect is used.

A denied request stops before the target call. The request log records the decision for the proxy, inbound credential, target, and target credential scopes.

Endpoints

MethodPathWhat it does
GET/api/clients/:clientId/proxies/:proxyId/rulesList proxy rules
POST/api/clients/:clientId/proxies/:proxyId/rulesCreate a proxy rule
PUT/api/clients/:clientId/proxies/:proxyId/rules/:ruleIdUpdate a proxy rule
DELETE/api/clients/:clientId/proxies/:proxyId/rules/:ruleIdDelete a proxy rule
GET/api/clients/:clientId/credentials/:credentialId/rulesList credential rules
POST/api/clients/:clientId/credentials/:credentialId/rulesCreate a credential rule
GET/api/clients/:clientId/targets/:targetId/rulesList target rules
POST/api/clients/:clientId/targets/:targetId/rulesCreate a target rule
GET/api/clients/:clientId/mcps/:mcpId/rulesList MCP rules
POST/api/clients/:clientId/mcps/:mcpId/rulesCreate an MCP rule

List rules

GET /api/clients/:clientId/proxies/:proxyId/rules returns the rules on that proxy. Credential, target, and MCP list paths return the same shape. Add /:ruleId to return one rule.

Query parameters

None.

Response attributes

AttributeTypeDescription
rulesarrayOne or more rule objects.
rules[].sKeystringRule id. Pass this as ruleId on other endpoints.
rules[].pKey / parentIdstringParent id (proxy, credential, target, or MCP server).
rules[].userIdstringCreator user id.
rules[].clientIdstringOrganisation id.
rules[].effectstring"allow" or "deny".
rules[].ruleActivebooleanWhether the rule is evaluated.
rules[].prioritynumberHigher numbers are evaluated first.
rules[].methodsarray or nullHTTP methods the rule applies to, or null for all.
rules[].pathobject or nullPath predicate. Uses the Predicates shape.
rules[].queryarray or nullQuery-parameter predicates.
rules[].headersarray or nullHeader predicates.
rules[].bodyarray or nullJSON body predicates.
rules[].tokenarray or nullJWT claim predicates.
rules[].variablesarray or nullVariable bindings.
rules[].notesstring or nullFree-text note.
rules[].alertsobject or nullDigest policy.
rules[].ruleRegionstringRegion copied from the parent.
rules[].createdAtstringISO 8601 creation time.
rules[].updatedAtstringISO 8601 last update time.
messagestring"Success".

Create a proxy rule

POST /api/clients/:clientId/proxies/:proxyId/rules creates an allow or deny rule.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "effect": "allow",
  "ruleActive": true,
  "priority": 10
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "effect": "allow",
  "ruleActive": true,
  "priority": 10
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"effect\": \"allow\",\n  \"ruleActive\": true,\n  \"priority\": 10\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "effect": "allow",
  "ruleActive": true,
  "priority": 10
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/rules"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"effect\": \"allow\",\n  \"ruleActive\": true,\n  \"priority\": 10\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "rules": [
    {
      "pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "sKey": "8f0c3d51-2b74-4a96-b1e3-5d7a9c2e4f08",
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "ruleRegion": "us-east-2",
      "effect": "allow",
      "ruleActive": true,
      "methods": null,
      "path": null,
      "query": null,
      "headers": null,
      "body": null,
      "token": null,
      "variables": null,
      "priority": 10,
      "notes": null,
      "alerts": null,
      "createdAt": "2026-11-02T07:30:00.000Z",
      "updatedAt": "2026-11-02T07:30:00.000Z"
    }
  ],
  "message": "Success"
}
{
  "message": "Input failed data validation",
  "errors": [
    "/effect: must have required property 'effect'"
  ]
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Returns a rules array containing the created rule, with message set to "Success".

Request body

ParameterTypeRequiredDescription
effectstring✓"allow" or "deny".
ruleActiveboolean✓When true, the rule is evaluated.
methodsstring[]—HTTP methods this rule applies to: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". Omit to match every method.
pathobject—Path check. Same shape as Predicates.
queryobject[]—Query-parameter checks. Same shape as Predicates.
headersobject[]—Header checks. Same shape as Predicates.
bodyobject[]—JSON body checks. Same shape as Predicates.
tokenobject[]—JWT claim checks. Same shape as Predicates. Evaluated when the inbound credential has verified a JWT.
variablesobject[]—Bindings reused inside patterns. Each item is { name, source, key }. source is "headers", "params", "body", "static", or "jwtClaim". See Predicates.
prioritynumber—Evaluation order. A higher number is evaluated first. Defaults to 0.
notesstring—Free-text note stored on the rule.
alertsobject—Digest policy on a proxy or a direct MCP server. Shape: { enabled, cadence?, alertNote? }. enabled is required inside the object. cadence is "minute", "hour", "day", or "month", and is required when enabled is true. alertNote is at most 500 characters. A credential or target rejects this field.

The server sets pKey, sKey, userId, clientId, parentId, ruleRegion, createdAt, and updatedAt.

Returns a rules array. The attributes match List rules.

Update a proxy rule

PUT /api/clients/:clientId/proxies/:proxyId/rules/:ruleId updates one rule. Credential, target, and MCP rules take the same body on their own parent path.

All fields are optional. Omit a field to leave it unchanged; send null to clear it.

Request body

ParameterTypeRequiredDescription
effectstring—"allow" or "deny".
ruleActiveboolean—Whether the rule is evaluated.
methodsstring[]—HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS".
pathobject—Path check. Same shape as Predicates.
queryobject[]—Query-parameter checks. Same shape as Predicates.
headersobject[]—Header checks. Same shape as Predicates.
bodyobject[]—JSON body checks. Same shape as Predicates.
tokenobject[]—JWT claim checks. Same shape as Predicates.
variablesobject[]—{ name, source, key } bindings. source is "headers", "params", "body", "static", or "jwtClaim". See Predicates.
prioritynumber—Evaluation order. A higher number is evaluated first.
notesstring—Free-text note stored on the rule.
alertsobject—{ enabled, cadence?, alertNote? }. When the saved policy has enabled: true, cadence ("minute", "hour", "day", or "month") is required. alertNote is at most 500 characters. Allowed on a proxy or a direct MCP server.

Returns a rules array with the updated rule. The attributes match List rules. updatedAt is the time of this call.

Delete a proxy rule

DELETE /api/clients/:clientId/proxies/:proxyId/rules/:ruleId removes the rule. The response message is "Rule deleted successfully from all tables".

Next

On this page