---
title: "Create System Bypass Rule"
method: POST
path: "/v1/security/firewall/bypass"
tags: ["security"]
---

# Create System Bypass Rule

`POST /v1/security/firewall/bypass`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/security/firewall/bypass`
- Auth: HTTP bearer

Create new system bypass rules

## Query parameters

- `projectId` string, required
- `teamId` string
- `slug` string

## Request body

- union
  - object
    - `domain` string, required
    - `projectScope` boolean: If the specified bypass will apply to all domains for a project.
    - `sourceIp` string
    - `allSources` boolean
    - `ttl` number: Time to live in milliseconds
    - `note` string
  - object
    - `domain` string
    - `projectScope` boolean, required: If the specified bypass will apply to all domains for a project.
    - `sourceIp` string
    - `allSources` boolean
    - `ttl` number: Time to live in milliseconds
    - `note` string

## Response `200`

- union
  - object
    - `ok` false | true, required
    - `pagination` unknown, required
    - `result` object[], required
      - `Domain` string, required
      - `Id` string, required
      - `Ip` string
      - `IsProjectRule` false | true, required
      - `Note` string, required
      - `OwnerId` string, required
      - `ProjectId` string, required
  - object
    - `ok` false | true, required
    - `result` object[]
      - `Action` 'block' | 'bypass'
      - `ActorId` string
      - `CreatedAt` string, required
      - `DeletedAt` string
      - `Domain` string, required
      - `ExpiresAt` number, nullable
      - `Id` string, required
      - `Ip` string, required
      - `IsProjectRule` false | true
      - `Note` string
      - `OwnerId` string, required
      - `ProjectId` string
      - `UpdatedAt` string, required
      - `UpdatedAtHour` string, required

## Other responses

- `400`: One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `402`
- `403`: You do not have permission to access this resource.
- `404`
- `410`
- `500`

## Changes

- **2026-09-03** `f2c3b0a5aef3`: 1 info
  - added the non-success response with the status `402`
- **2026-07-21** `2ae10ee9d21c`: 1 info
  - added the non-success response with the status `410`
- **2026-01-22** `c12186034433`: 1 breaking, 1 info
  - added `subschema #1, subschema #2` to the response body `oneOf` list for the response status `200`
  - removed `subschema #1, subschema #2` from the response body `oneOf` list for the response status `200`
- **2025-03-19** `37b482c58c92`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v1/security/firewall/bypass/post.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)