---
title: "Create an Application Request Rule"
method: POST
path: "/workspace/applications/{application_id}/request_rules"
tags: ["Applications - Request Rules"]
---

# Create an Application Request Rule

`POST /workspace/applications/{application_id}/request_rules`

Create a new Rule for a specific Application in your account.

## Path parameters

- `application_id` integer, required

## Request body

- RequestPhaseRuleRequest
  - `name` string, required
  - `active` boolean
  - `criteria` array[], required
    - ApplicationCriterionFieldRequest[]
      - `conditional` 'if' | 'or' | 'and', required — * `if` - if * `or` - or * `and` - and
      - `variable` '$(arg_<name>)' | '$(args)' | '$(cookie_<name>)' | '$(device_group)' | '$(geoip_city_continent_code)' | '$(geoip_city_country_code)' | '$(geoip_city_country_name)' | '$(geoip_city)' | '$(geoip_continent_code)' | '$(geoip_country_code)' | '$(geoip_country_name)' | '$(geoip_region_name)' | '$(geoip_region)' | '$(host)' | '$(domain)' | '$(http_<header_name>)' | '$(remote_addr)' | '$(remote_user)' | '$(request_method)' | '$(request_uri)' | '$(request)' | '$(scheme)' | '$(sent_http_<header_name>)' | '$(status)' | '$(upstream_addr)' | '$(upstream_cookie_<name>)' | '$(upstream_http_<header_name>)' | '$(upstream_status)' | '$(uri)' | '$(server_addr)' | '$(server_port)' | '$(ssl_client_cert)' | '$(ssl_client_escaped_cert)' | '$(ssl_client_fingerprint)' | '$(ssl_client_i_dn)' | '$(ssl_client_s_dn_parsed)' | '$(ssl_client_s_dn)' | '$(ssl_client_serial)' | '$(ssl_client_v_end)' | '$(ssl_client_v_remain)' | '$(ssl_client_v_start)' | '$(ssl_client_verify)' | '$(tcpinfo_rtt)' | '$(remote_port)' | '$(request_body)', required — * `$(arg_<name>)` - $(arg_<name>) * `$(args)` - $(args) * `$(cookie_<name>)` - $(cookie_<name>) * `$(device_group)` - $(device_group) * `$(geoip_city_continent_code)` - $(geoip_city_continent_code) * `$(geoip_city_country_code)` - $(geoip_city_country_code) * `$(geoip_city_country_name)` - $(geoip_city_country_name) * `$(geoip_city)` - $(geoip_city) * `$(geoip_continent_code)` - $(geoip_continent_code) * `$(geoip_country_code)` - $(geoip_country_code) * `$(geoip_country_name)` - $(geoip_country_name) * `$(geoip_region_name)` - $(geoip_region_name) * `$(geoip_region)` - $(geoip_region) * `$(host)` - $(host) * `$(domain)` - $(domain) * `$(http_<header_name>)` - $(http_<header_name>) * `$(remote_addr)` - $(remote_addr) * `$(remote_user)` - $(remote_user) * `$(request_method)` - $(request_method) * `$(request_uri)` - $(request_uri) * `$(request)` - $(request) * `$(scheme)` - $(scheme) * `$(sent_http_<header_name>)` - $(sent_http_<header_name>) * `$(status)` - $(status) * `$(upstream_addr)` - $(upstream_addr) * `$(upstream_cookie_<name>)` - $(upstream_cookie_<name>) * `$(upstream_http_<header_name>)` - $(upstream_http_<header_name>) * `$(upstream_status)` - $(upstream_status) * `$(uri)` - $(uri) * `$(server_addr)` - $(server_addr) * `$(server_port)` - $(server_port) * `$(ssl_client_cert)` - $(ssl_client_cert) * `$(ssl_client_escaped_cert)` - $(ssl_client_escaped_cert) * `$(ssl_client_fingerprint)` - $(ssl_client_fingerprint) * `$(ssl_client_i_dn)` - $(ssl_client_i_dn) * `$(ssl_client_s_dn_parsed)` - $(ssl_client_s_dn_parsed) * `$(ssl_client_s_dn)` - $(ssl_client_s_dn) * `$(ssl_client_serial)` - $(ssl_client_serial) * `$(ssl_client_v_end)` - $(ssl_client_v_end) * `$(ssl_client_v_remain)` - $(ssl_client_v_remain) * `$(ssl_client_v_start)` - $(ssl_client_v_start) * `$(ssl_client_verify)` - $(ssl_client_verify) * `$(tcpinfo_rtt)` - $(tcpinfo_rtt) * `$(remote_port)` - $(remote_port) * `$(request_body)` - $(request_body)
      - `operator` 'does_not_exist' | 'does_not_match' | 'does_not_start_with' | 'exists' | 'is_equal' | 'is_in_list' | 'is_not_equal' | 'is_not_in_list' | 'matches' | 'starts_with', required — * `does_not_exist` - does_not_exist * `does_not_match` - does_not_match * `does_not_start_with` - does_not_start_with * `exists` - exists * `is_equal` - is_equal * `is_in_list` - is_in_list * `is_not_equal` - is_not_equal * `is_not_in_list` - is_not_in_list * `matches` - matches * `starts_with` - starts_with
      - `argument` union
        - integer
        - string
  - `behaviors` RequestPhaseBehaviorRequest[], required
    - union
      - object — Behaviors without arguments
        - `type` 'deny' | 'no_content' | 'deliver' | 'finish_request_phase' | 'forward_cookies' | 'optimize_images' | 'bypass_cache' | 'enable_gzip' | 'redirect_http_to_https', required — * `deny` - deny * `no_content` - no_content * `deliver` - deliver * `finish_request_phase` - finish_request_phase * `forward_cookies` - forward_cookies * `optimize_images` - optimize_images * `bypass_cache` - bypass_cache * `enable_gzip` - enable_gzip * `redirect_http_to_https` - redirect_http_to_https
      - object — Behaviors with arguments (string or integer)
        - `type` 'add_request_cookie' | 'add_request_header' | 'add_response_header' | 'filter_request_cookie' | 'filter_request_header' | 'filter_response_cookie' | 'filter_response_header' | 'redirect_to_301' | 'redirect_to_302' | 'rewrite_request' | 'run_function' | 'set_cache_policy' | 'set_connector' | 'set_cookie' | 'set_origin', required — Behavior type
        - `attributes` BehaviorArgsAttributes, required — Behavior attributes containing the value parameter
          - `value` union, required — Value can be string or integer depending on the behavior type
            - string
            - integer
      - object — Behaviors for capturing match groups
        - `type` 'capture_match_groups', required
        - `attributes` BehaviorCaptureMatchGroupsAttributes, required
          - `subject` string, required
          - `regex` string, required
          - `captured_array` string, required
  - `description` string

## Response `201`

Application request rule created successfully.

- RequestPhaseRuleResponse
  - `state` string
  - `data` RequestPhaseRule, required
    - `id` integer, required
    - `name` string, required
    - `active` boolean
    - `criteria` array[], required
      - ApplicationCriterionField[]
        - `conditional` 'if' | 'or' | 'and', required — * `if` - if * `or` - or * `and` - and
        - `variable` '$(arg_<name>)' | '$(args)' | '$(cookie_<name>)' | '$(device_group)' | '$(geoip_city_continent_code)' | '$(geoip_city_country_code)' | '$(geoip_city_country_name)' | '$(geoip_city)' | '$(geoip_continent_code)' | '$(geoip_country_code)' | '$(geoip_country_name)' | '$(geoip_region_name)' | '$(geoip_region)' | '$(host)' | '$(domain)' | '$(http_<header_name>)' | '$(remote_addr)' | '$(remote_user)' | '$(request_method)' | '$(request_uri)' | '$(request)' | '$(scheme)' | '$(sent_http_<header_name>)' | '$(status)' | '$(upstream_addr)' | '$(upstream_cookie_<name>)' | '$(upstream_http_<header_name>)' | '$(upstream_status)' | '$(uri)' | '$(server_addr)' | '$(server_port)' | '$(ssl_client_cert)' | '$(ssl_client_escaped_cert)' | '$(ssl_client_fingerprint)' | '$(ssl_client_i_dn)' | '$(ssl_client_s_dn_parsed)' | '$(ssl_client_s_dn)' | '$(ssl_client_serial)' | '$(ssl_client_v_end)' | '$(ssl_client_v_remain)' | '$(ssl_client_v_start)' | '$(ssl_client_verify)' | '$(tcpinfo_rtt)' | '$(remote_port)' | '$(request_body)', required — * `$(arg_<name>)` - $(arg_<name>) * `$(args)` - $(args) * `$(cookie_<name>)` - $(cookie_<name>) * `$(device_group)` - $(device_group) * `$(geoip_city_continent_code)` - $(geoip_city_continent_code) * `$(geoip_city_country_code)` - $(geoip_city_country_code) * `$(geoip_city_country_name)` - $(geoip_city_country_name) * `$(geoip_city)` - $(geoip_city) * `$(geoip_continent_code)` - $(geoip_continent_code) * `$(geoip_country_code)` - $(geoip_country_code) * `$(geoip_country_name)` - $(geoip_country_name) * `$(geoip_region_name)` - $(geoip_region_name) * `$(geoip_region)` - $(geoip_region) * `$(host)` - $(host) * `$(domain)` - $(domain) * `$(http_<header_name>)` - $(http_<header_name>) * `$(remote_addr)` - $(remote_addr) * `$(remote_user)` - $(remote_user) * `$(request_method)` - $(request_method) * `$(request_uri)` - $(request_uri) * `$(request)` - $(request) * `$(scheme)` - $(scheme) * `$(sent_http_<header_name>)` - $(sent_http_<header_name>) * `$(status)` - $(status) * `$(upstream_addr)` - $(upstream_addr) * `$(upstream_cookie_<name>)` - $(upstream_cookie_<name>) * `$(upstream_http_<header_name>)` - $(upstream_http_<header_name>) * `$(upstream_status)` - $(upstream_status) * `$(uri)` - $(uri) * `$(server_addr)` - $(server_addr) * `$(server_port)` - $(server_port) * `$(ssl_client_cert)` - $(ssl_client_cert) * `$(ssl_client_escaped_cert)` - $(ssl_client_escaped_cert) * `$(ssl_client_fingerprint)` - $(ssl_client_fingerprint) * `$(ssl_client_i_dn)` - $(ssl_client_i_dn) * `$(ssl_client_s_dn_parsed)` - $(ssl_client_s_dn_parsed) * `$(ssl_client_s_dn)` - $(ssl_client_s_dn) * `$(ssl_client_serial)` - $(ssl_client_serial) * `$(ssl_client_v_end)` - $(ssl_client_v_end) * `$(ssl_client_v_remain)` - $(ssl_client_v_remain) * `$(ssl_client_v_start)` - $(ssl_client_v_start) * `$(ssl_client_verify)` - $(ssl_client_verify) * `$(tcpinfo_rtt)` - $(tcpinfo_rtt) * `$(remote_port)` - $(remote_port) * `$(request_body)` - $(request_body)
        - `operator` 'does_not_exist' | 'does_not_match' | 'does_not_start_with' | 'exists' | 'is_equal' | 'is_in_list' | 'is_not_equal' | 'is_not_in_list' | 'matches' | 'starts_with', required — * `does_not_exist` - does_not_exist * `does_not_match` - does_not_match * `does_not_start_with` - does_not_start_with * `exists` - exists * `is_equal` - is_equal * `is_in_list` - is_in_list * `is_not_equal` - is_not_equal * `is_not_in_list` - is_not_in_list * `matches` - matches * `starts_with` - starts_with
        - `argument` union
          - integer
          - string
    - `behaviors` RequestPhaseBehavior[], required
      - union
        - object — Behaviors without arguments
          - `type` 'deny' | 'no_content' | 'deliver' | 'finish_request_phase' | 'forward_cookies' | 'optimize_images' | 'bypass_cache' | 'enable_gzip' | 'redirect_http_to_https', required — * `deny` - deny * `no_content` - no_content * `deliver` - deliver * `finish_request_phase` - finish_request_phase * `forward_cookies` - forward_cookies * `optimize_images` - optimize_images * `bypass_cache` - bypass_cache * `enable_gzip` - enable_gzip * `redirect_http_to_https` - redirect_http_to_https
        - object — Behaviors with arguments (string or integer)
          - `type` 'add_request_cookie' | 'add_request_header' | 'add_response_header' | 'filter_request_cookie' | 'filter_request_header' | 'filter_response_cookie' | 'filter_response_header' | 'redirect_to_301' | 'redirect_to_302' | 'rewrite_request' | 'run_function' | 'set_cache_policy' | 'set_connector' | 'set_cookie' | 'set_origin', required — Behavior type
          - `attributes` BehaviorArgsAttributes, required — Behavior attributes containing the value parameter
            - `value` union, required — Value can be string or integer depending on the behavior type
              - …
        - object — Behaviors for capturing match groups
          - `type` 'capture_match_groups', required
          - `attributes` BehaviorCaptureMatchGroupsAttributes, required
            - `subject` string, required
            - `regex` string, required
            - `captured_array` string, required
    - `description` string
    - `order` integer, required
    - `last_editor` string, nullable, required
    - `last_modified` string, date-time, nullable, required
    - `created_at` string, date-time, required

## Other responses

- `400` — Validation Error
- `401` — Authentication Failed
- `403` — Permission Denied
- `404` — Not Found
- `405` — Method Not Allowed
- `406` — Not Acceptable
- `429` — Throttled
- `500` — Internal Server Error

---

[API](https://skmtc.dev/azion/apis/azion-api.md) · [All operations](https://skmtc.dev/azion/apis/azion-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azion/azion-api/revisions/bb3250697218/schema)