JUjumpcloud
Authentication Policies

Create an Authentication Policy

Create an authentication policy.

Sample Request

curl -X POST https://console.jumpcloud.com/api/v2/authn/policies \
  -H 'accept: application/json' \
  -H 'content-type: application/json' \
  -H 'x-api-key: {API_KEY}' \
  -d '{
    "name": "Sample Policy",
    "disabled": false,
    "effect": {
      "action": "allow"
    },
    "targets": {
      "users": {
        "inclusions": ["ALL"]
      },
      "userGroups": {
        "exclusions": [{USER_GROUP_ID}]
      },
      "resources": [ {"type": "user_portal" } ]
    },
    "conditions":{
      "ipAddressIn": [{IP_LIST_ID}]
    }
  }'
post/authn/policies

Request

Headers

x-org-idstring

Organization identifier that can be obtained from console settings.

Request body

idstring
namestring
descriptionstring
disabledboolean
monitorOnlyboolean
managedBy'ORGANIZATION' | 'ENTERPRISE' | 'UNKNOWN'

Policy ownership.

orgIdstring

Owning organization object id (hex). Populated on aggregate list rows.

orgNamestring

Live owning organization display name from organization metadata. Populated on aggregate list rows when managedBy is ORGANIZATION.

type'user_portal' | 'application' | 'ldap' | 'admin_portal'
conditionsobject

Conditions may be added to an authentication policy using the following conditional language:

<conditions> ::= <expression>
<expression> ::= <deviceEncrypted> | <deviceManaged> | <ipAddressIn> |
                 <locationIn> | <notExpression> | <allExpression> |
                 <anyExpression>
<deviceEncrypted> ::= { "deviceEncrypted": <boolean> }
<deviceManaged> ::= { "deviceManaged": <boolean> }
<ipAddressIn> ::= { "ipAddressIn": [ <objectId>, ... ] }
<locationIn> ::= { "locationIn": {
                     "countries": [
                       <iso_3166_country_code>, ...
                     ]
                   }
                 }
<notExpression> ::= { "not": <expression> }
<allExpression> ::= { "all": [ <expression>, ... ] }
<anyExpression> ::= { "any": [ <expression>, ... ] }

For example, to add a condition that applies to IP addresses in a given list, the following condition can be added:

{"ipAddressIn": [ <ip_list_object_id> ]}

If you would rather exclude IP addresses in the given lists, the following condition could be added:

{
  "not": {
    "ipAddressIn": [ <ip_list_object_id_1>, <ip_list_object_id_2> ]
  }
}

You may also include more than one condition and choose whether "all" or "any" of them must be met for the policy to apply:

{
  "all": [
    {
      "ipAddressIn": [ <ip_list_object_id>, ... ]
    },
    {
      "deviceManaged": true
    },
    {
      "locationIn": {
        countries: [ <iso_3166_country_code>, ... ]
      }
    }
  ]
}

Response

Created

idstring
namestring
descriptionstring
disabledboolean
monitorOnlyboolean
managedBy'ORGANIZATION' | 'ENTERPRISE' | 'UNKNOWN'

Policy ownership.

orgIdstring

Owning organization object id (hex). Populated on aggregate list rows.

orgNamestring

Live owning organization display name from organization metadata. Populated on aggregate list rows when managedBy is ORGANIZATION.

type'user_portal' | 'application' | 'ldap' | 'admin_portal'
conditionsobject

Conditions may be added to an authentication policy using the following conditional language:

<conditions> ::= <expression>
<expression> ::= <deviceEncrypted> | <deviceManaged> | <ipAddressIn> |
                 <locationIn> | <notExpression> | <allExpression> |
                 <anyExpression>
<deviceEncrypted> ::= { "deviceEncrypted": <boolean> }
<deviceManaged> ::= { "deviceManaged": <boolean> }
<ipAddressIn> ::= { "ipAddressIn": [ <objectId>, ... ] }
<locationIn> ::= { "locationIn": {
                     "countries": [
                       <iso_3166_country_code>, ...
                     ]
                   }
                 }
<notExpression> ::= { "not": <expression> }
<allExpression> ::= { "all": [ <expression>, ... ] }
<anyExpression> ::= { "any": [ <expression>, ... ] }

For example, to add a condition that applies to IP addresses in a given list, the following condition can be added:

{"ipAddressIn": [ <ip_list_object_id> ]}

If you would rather exclude IP addresses in the given lists, the following condition could be added:

{
  "not": {
    "ipAddressIn": [ <ip_list_object_id_1>, <ip_list_object_id_2> ]
  }
}

You may also include more than one condition and choose whether "all" or "any" of them must be met for the policy to apply:

{
  "all": [
    {
      "ipAddressIn": [ <ip_list_object_id>, ... ]
    },
    {
      "deviceManaged": true
    },
    {
      "locationIn": {
        countries: [ <iso_3166_country_code>, ... ]
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.