openapi: 3.1.0
info:
  title: Google Cloud Armor SecurityPolicies SecurityPolicyRules API
  description: Provides programmatic access to manage security policies, rules, and threat intelligence configurations for protecting applications from DDoS attacks and web-based threats.
  version: v1
  contact:
    name: Google Cloud
    url: https://cloud.google.com/armor/docs
servers:
- url: https://compute.googleapis.com/compute/v1
  description: Google Cloud Armor production endpoint
security:
- oauth2:
  - https://www.googleapis.com/auth/compute
tags:
- name: SecurityPolicyRules
  description: Manage individual rules within security policies
paths:
  /projects/{project}/global/securityPolicies/{securityPolicy}/addRule:
    post:
      operationId: addSecurityPolicyRule
      summary: Google Cloud Armor Add a rule to a security policy
      description: Adds a rule to the specified security policy.
      tags:
      - SecurityPolicyRules
      parameters:
      - name: project
        in: path
        required: true
        schema:
          type: string
      - name: securityPolicy
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityPolicyRule'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Operation'
  /projects/{project}/global/securityPolicies/{securityPolicy}/removeRule:
    post:
      operationId: removeSecurityPolicyRule
      summary: Google Cloud Armor Remove a rule from a security policy
      description: Removes a rule from the specified security policy.
      tags:
      - SecurityPolicyRules
      parameters:
      - name: project
        in: path
        required: true
        schema:
          type: string
      - name: securityPolicy
        in: path
        required: true
        schema:
          type: string
      - name: priority
        in: query
        required: true
        schema:
          type: integer
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Operation'
components:
  schemas:
    SecurityPolicyRule:
      type: object
      properties:
        priority:
          type: integer
          description: Priority of the rule (lower number = higher priority)
        description:
          type: string
          description: An optional description of the rule
        match:
          type: object
          properties:
            versionedExpr:
              type: string
              enum:
              - SRC_IPS_V1
            config:
              type: object
              properties:
                srcIpRanges:
                  type: array
                  items:
                    type: string
            expr:
              type: object
              properties:
                expression:
                  type: string
                  description: CEL expression for matching
        action:
          type: string
          enum:
          - allow
          - deny(403)
          - deny(404)
          - deny(502)
          - throttle
          - rate_based_ban
          description: Action to take when the rule matches
        preview:
          type: boolean
          description: Whether the rule is in preview mode
    Operation:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        targetLink:
          type: string
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          tokenUrl: https://oauth2.googleapis.com/token
          scopes:
            https://www.googleapis.com/auth/compute: Manage your Google Compute Engine resources
            https://www.googleapis.com/auth/cloud-platform: Full access to Google Cloud Platform resources